joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40645d
pop dword [ebp - 0x40]
mov eax, 0x40645d
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xf06399d2
sub dword [ebp - 0x50], 0xa2115487
mov dword [ebp - 0x4c], 0xf37bb5f8
add dword [ebp - 0x4c], 0x3eb7964d
mov dword [ebp - 0x48], 0x430a54d5
sub dword [ebp - 0x48], 0xf6be10a7
mov dword [ebp - 0x44], 0x1d9d56c8
add dword [ebp - 0x44], 0xe262a938
lea eax, [ebp - 0x50]
push eax
mov eax, 0xb24ddc69
add eax, 0x4df2a40f
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x8c9dedcf
sub dword [ebp - 0x50], 0x182b8479
mov dword [ebp - 0x4c], 0x658704a7
sub dword [ebp - 0x4c], 0x241aa332
mov dword [ebp - 0x48], 0x20f7a446
add dword [ebp - 0x48], 0x4277c826
mov dword [ebp - 0x44], 0x91514560
sub dword [ebp - 0x44], 0x91514560
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xef909d99
add eax, 0x10afe2e3
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38e13
push 0
call eax
mov ecx, 0x4f4f
xor esi, esi
add esi, eax
mov edi, 0x451400
add edi, dword [ebp - 0x40]
mov ebx, 0x47691974
xor dword [ebp - 0x14], 0x7ad4a8
mov edx, dword [edi]
add dword [ebp - 4], 0x8f090721
sub edx, ebx
mov dword [ebp - 0x10], 0xeb52dff
mov dword [esi], edx
add dword [ebp - 0x30], 0x8bfd99c3
add esi, 0x62926165
sub esi, 0x62926161
add edi, 0x1def5dd4
sub edi, 0x1def5dd0
loop 0x40656a
add eax, 0x7e1a5ad0
sub eax, 0x7e192ac1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbdf78dd9
sub ecx, 0xbdb78dd9
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x10b4d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10b4d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10b4d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b4d06a
add dl, dl
jne 0x10b4d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b4d0dc
xor eax, eax
add dl, dl
jne 0x10b4d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b4d17d
add dl, dl
jne 0x10b4d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b4d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b4d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b4d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10b4d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10b4d075
mov eax, 1
add dl, dl
jne 0x10b4d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b4d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b4d0e1
sub eax, ebx
mov ebx, 1
jne 0x10b4d128
mov ecx, 1
add dl, dl
jne 0x10b4d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10b4d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b4d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b4d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10b4d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10b4d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b4d136
cmp eax, 0x7d00
jae 0x10b4d16d
cmp eax, 0x500
jb 0x10b4d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b4d075
cmp eax, 0x7f
ja 0x10b4d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b4d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10b4d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10b4d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x405301
pop dword [ebp - 0x28]
mov eax, 0x405301
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x4273f7e0
add dword [ebp - 0x38], 0xbde4d6b
mov dword [ebp - 0x34], 0xb8ed9812
add dword [ebp - 0x34], 0x7945b433
mov dword [ebp - 0x30], 0x7ba4df9b
add dword [ebp - 0x30], 0xd0a76493
mov dword [ebp - 0x2c], 0xc0c8892f
sub dword [ebp - 0x2c], 0xc0c8892f
lea eax, [ebp - 0x38]
push eax
mov eax, 0x2c4e459
sub eax, 0x2841405
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x4cd7c3b0
add dword [ebp - 0x38], 0x279aa5a6
mov dword [ebp - 0x34], 0x3cf392f3
sub dword [ebp - 0x34], 0xfb87317e
mov dword [ebp - 0x30], 0x8880e4da
add dword [ebp - 0x30], 0xdaee8792
mov dword [ebp - 0x2c], 0x1d484682
sub dword [ebp - 0x2c], 0x1d484682
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xd1de7d2c
sub eax, 0xd19dace0
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x39b0a
push 0
call eax
mov ecx, 0x18581a7
sub ecx, 0x185390c
mov edx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x28]
mov esi, 0x38b8e351
sub esi, 0x274ae2bb
xor dword [ebp - 0x1c], ecx
mov ebx, dword [edi]
mov dword [ebp - 0x20], 0x1863197b
xor ebx, esi
sub dword [ebp - 0x20], ebx
mov dword [edx], ebx
add edx, 4
add edi, 0x7bb164c5
sub edi, 0x7bb164c1
loop 0x405418
add eax, 0x4b795536
add eax, 0xb487c009
xor ebx, ebx
add ebx, eax
add eax, 0xf159d006
add eax, 0xea62fff
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x53a0a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe3000]
push edi
jmp 0x53a0ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53a0c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a0b0
mov eax, 1
add ebx, ebx
jne 0x53a0d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53a0e4
jne 0x53a103
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a103
dec eax
add ebx, ebx
jne 0x53a0f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53a0c8
add ebx, ebx
jne 0x53a0ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53a155
xor ecx, ecx
sub eax, 3
jb 0x53a11b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53a18a
sar eax, 1
mov ebp, eax
jmp 0x53a126
add ebx, ebx
jne 0x53a126
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a0f4
inc ecx
add ebx, ebx
jne 0x53a134
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a0f4
add ebx, ebx
jne 0x53a141
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53a136
jne 0x53a152
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53a136
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53a174
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53a166
jmp 0x53a0b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53a174
add edi, ecx
jmp 0x53a0b6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53a192
cmp byte [edi], 0x11
jne 0x53a192
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53a197
lea edi, [esi + 0x133000]
mov eax, dword [edi]
or eax, eax
je 0x53a20f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19b798]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19b914]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53a1c4
mov ecx, edi
jns 0x53a1f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19b918]
or eax, eax
je 0x53a209
mov dword [ebx], eax
add ebx, 4
jmp 0x53a1e1
call dword [esi + 0x19b928]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x53a240
cmp al, 0xef
ja 0x53a233
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x53a215
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x53a222
mov ebp, dword [esi + 0x19b91c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53a274
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x750610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7564cc]
cmp dword [eax + 0x28], 0
jne 0x750628
xor eax, eax
jmp 0x750757
mov ecx, dword [0x75643c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x756430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x75642c], eax
push 0
call dword [0x754138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x754138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x756430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x75642c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x7564b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x754680
push 0x7546d0
push 0x88
call dword [0x754134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x756428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x75410c]
push eax
call fcn.00750550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x754148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x75412c]
push 0x7505e0
mov edx, dword [0x7564cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x75413c]
mov dword [0x756434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x754130]
test eax, eax
je 0x750757
cmp dword [ebp - 0x38], 0x12
jne 0x75074b
mov dword [0x756444], 0
call fcn.00750760
xor eax, eax
jmp 0x750757
lea edx, [ebp - 0x3c]
push edx
call dword [0x754140]
jmp 0x75071c
mov esp, ebp
pop ebp
ret 4

Function at 0x751b30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.007540dc]
call dword [fcn.00754124]
call dword [fcn.00754128]
call dword [fcn.00754094]
call dword [fcn.007540fc]
call dword [fcn.007540f4]
call dword [fcn.00754150]
call dword [fcn.0075400c]
call dword [fcn.00754000]
call dword [fcn.00754160]
call fcn.00753674
mov eax, 1
pop ebp
ret 4
Function at 0x7526cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x754168
sub eax, eax
test esi, esi
je 0x7527a4
sub eax, 1
test ecx, ecx
je 0x7527a2
test esi, 3
je 0x75270a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x7526ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x752789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x752714
mov ecx, edx
test ecx, ecx
je 0x7527a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x75278f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x7527ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0075282f
jae 0x7527ba
xor ecx, ecx
call fcn.0075282f
jae 0x7527e9
xor eax, eax
call fcn.0075282f
jae 0x7527f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0075282f
adc al, al
jae 0x7527db
jne 0x752825
stosb byte es:[edi], al
jmp 0x7527bd
call fcn.0075283b
sub ecx, ebx
jne 0x752802
call fcn.00752839
jmp 0x752821
lodsb al, byte [esi]
shr eax, 1
je 0x75284b
adc ecx, ecx
jmp 0x75281e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00752839
cmp eax, 0x7d00
jae 0x75281e
cmp ah, 5
jae 0x75281f
cmp eax, 0x7f
ja 0x752820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7527bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x75317c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x756000]
jne 0x753186
repz ret
jmp fcn.0075342d

Function at 0xaefb4f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt edx, edx
jno 0xaefbc2
rdtsc
jmp 0xaefb89
jmp 0xaefba2
sub esp, 0xbc
mov ebp, esp
or cx, 0x1af8
jae 0xaefb73
lea eax, [ebp - 0x40]
jmp 0xaefbdc
lea eax, [ebp - 0x40]
shr ebx, cl
rdtsc
jmp 0xaefb89
shr ebx, cl
jmp fcn.00aefba7
Function at 0xb07972
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0af37c8
jmp 0xb079d3
call fcn.00b07925
lea esp, [esp + 5]
lea esp, [esp + 3]
jmp 0xb0796a
push eax
push ecx
call 0xb07972
jnp 0xb079d9
push dword [esp + 3]
jae 0xb0811e
jb 0xb08063
push edi
rol byte [esi + 0x21], 1
shl byte [eax - 0x35], 1
dec ebp
frstor dword [edi + edx*2 - 0x4950a31c]
lea ebx, [eax + ebp]
jmp 0xb07a10
mov esp, 0x74c43552
or byte [ecx + 0x388b7819], cl
test al, 0xcb
bound ebx, qword [ebp + 0x48f66ec]
and al, 0x8d
and al, 2
mov dword [esp], edi
pushfd
jmp 0xb05add
inc ax
jmp 0xb07a1c
neg ebx
jne 0xb079fa
inc ax
jmp 0xb07a1c
mov ebp, dword [esp + 0x2c]
xchg di, cx
not dh
xchg al, bh
jmp 0xb07ab2
xchg dl, bh
mov dl, byte [esp]
jmp 0xb07a6b
mov edx, esp
jmp 0xb07a3b
jmp 0xb07a9a
sub esp, 0xc0
mov esi, esp
cmp bx, 0xbd86
jl 0xb07a55
mov dh, al
mov dl, cl
seto bh
jmp 0xb07ae6
stc
pop word [esp + 9]
push word [esp + 7]
lea esp, [esp + 1]
jmp 0xb07af0
mov dh, al
mov dl, cl
seto bh
jmp 0xb07ae6
lea edi, [esp]
xor ah, 0xa3
jg 0xb07a51
mov edx, esp
xchg dl, bh
mov dl, byte [esp]
jmp 0xb07a6b
pop word [esp + 9]
push word [esp + 7]
lea esp, [esp + 1]
mov edx, dword [esp]
jmp 0xb07af3
mov ebx, ebp
sub esp, 0x15
jne 0xb07a83
stc
jmp 0xb07ac3
mov edx, dword [esp]
xchg ecx, eax
push esp
btc dx, sp
jns 0xb07c3d
mov word [esp], di
clc
mov cl, byte [esp + 1]
jmp 0xb07b34
lea esp, [esp + 2]
push edx
jmp 0xb0812d
mov ecx, 0xd1daf442
sub esp, 0xa
push dword [esp]
lea esp, [esp + 2]
jmp 0xb07bb4
lea esp, [esp + 4]
not ebp
stc
jae 0xb07b1e
jb 0xb07b60
lea esp, [esp + 2]
jmp 0xb07bb4
mov ecx, 0xfdd890d5
mov ax, 0xc3bf
jmp 0xb07bef
mov ecx, 0xd1daf442
sub esp, 0xa
push dword [esp]
call fcn.00b07b87
and byte [edi - 0x1d75dbe4], al
mov dl, 9
bswap edx
mov dl, byte [esp]
jmp 0xb07c0e
mov word [esp], di
clc
mov cl, byte [esp + 1]
jmp 0xb07b34
lea esp, [esp + 0xc]
xor ebp, 0x7710791b
mov dl, bh
mov edx, edi
mov eax, 0x702a57a0
jmp 0xb07b45
xchg dword [esp], ebx
add eax, ecx
mov cx, 0x4382
push dword [esp]
ret 4
xor ebp, 0x6b049499
not edx
not dx
pushal
cmp ah, dh
jmp 0xb07da3
lea ebx, [ebx - 0x31]
xchg al, ch
rdtsc
lea eax, [ebx + ebp]
clc
lea edx, [ebp*4]
jmp 0xb07be0
not al
pop cx
pop dword [esp + 0xa]
lea esp, [esp + 2]
jmp 0xb07cbc
jmp 0xb07ba9
bt ecx, edx
mov edx, dword [esp]
bsr cx, sp
jmp 0xb07c90
jmp 0xb07c99
bt ecx, edx
mov edx, dword [esp]
bsr cx, sp
mov ax, 0xb1ee
lea eax, [ebx + 0x11]
mov edx, 0x7a7db62f
clc
jp 0xb07c4e
mov dh, byte [esp]
jmp 0xb07c9c
mov ax, 0xb1ee
lea eax, [ebx + 0x11]
jmp 0xb07c76
mov dh, byte [esp]
neg ebp
mov ax, 0xb7bc
ror dx, 0xe
jmp 0xb07ce4
lea esp, [esp + 0x18]
neg ebp
btr cx, dx
jns 0xb07c65
js 0xb07c42
add ebp, dword [edi]
dec edx
jae 0xb07d02
mov dx, word [esp]
jmp 0xb07cec
jnp 0xb07d20
mov ecx, ebp
bswap ecx
jmp 0xb07d24
pushfd
push dword [esp]
jmp 0xb07d26
mov dx, word [esp]
pushfd
push dword [esp]
jmp 0xb07d26
mov ecx, ebp
bswap ecx
jmp 0xb07cce
pop dword [esp + 0xa]
lea esp, [esp + 2]
jmp 0xb07cbc
jae 0xb07c25
not al
pop cx
jmp 0xb07d4f
mov byte [esp], al
mov dword [esp], esp
lea esp, [esp + 4]
jmp 0xb07b14
mov byte [esp], al
mov dword [esp], esp
lea esp, [esp + 4]
lea esp, [esp + 2]
push edx
push ax
call fcn.00b07a33
Function at 0xb0829b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], dh
mov dword [esp], eax
push dword [esp + 2]
jne 0xb0829d
add esp, 1
jmp 0xb082ba
jmp 0xb08285
add esp, 1
jmp 0xb082d0
lea esp, [esp + 3]
Function at 0xbf97e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
jmp 0xbf9ead
jmp 0xbf9f9e
mov dword [esp + 0x24], eax
jmp 0xbf9fe3
call 0xbf954a
jmp 0xbfa015
stc
call 0xbf971a
shr cx, cl
mov edx, ebx
jmp 0xbf97e2
push ebp
call 0xbf97e9
cwde
pop ax
setle dh
mov dl, byte [esp]
lea esp, [esp + 2]
jmp 0xbf9811
mov esi, 0x62ad8dfb
lea ecx, [ebp - 0x41]
cmc
jmp 0xbf9af8
rcl dl, 0
jmp 0xbf986d
lea ebp, [ebx*4]
jmp 0xbf9ac8
lea ebp, [ebx*4]
rdtsc
jmp 0xbf9aca
pop esi
mov ax, word [esp]
xor bp, bx
js 0xbf9849
jns 0xbf9856
xchg word [esp + 1], bx
mov ebp, dword [esp + 4]
bts cx, di
jmp 0xbf9898
mov bx, 0xe2
call 0xbf9879
jg 0xbf98ae
lea esp, [esp + 8]
jmp fcn.00aedb58
lea esp, [esp + 8]
jmp fcn.00aedb58
jmp 0xbf988f
rdtsc
pop edx
neg bl
jg 0xbf9900
mov bx, 0xe2
jmp 0xbf9893
jge 0xbf9820
rcl dl, 0
jmp 0xbf986d
pushfd
sub esp, 0x15
pop dword [esp + 3]
mov word [esp + 0x20], bp
lea esp, [esp + 3]
lea esi, [esi + 0x4a]
jmp 0xbf9753
popal
inc dword [esp + 8]
jmp 0xbf9f88
popfd
ret
pop ecx
sub ecx, fcn.00bf94fa
mov dword [ecx + 0xbf9e6a], eax
movzx ebx, byte [eax]
add ebx, 0x26b04deb
jmp 0xbfa007
jmp 0xbfa09b
popal
inc dword [esp + 8]
popfd
ret
cmp ebx, 0x26b04eb7
je 0xbfa06b
jne 0xbf94b4
pop eax
jmp 0xbfa047
pushal
jmp 0xbf9545
sub eax, 0x61c0d620
jmp 0xbfa053
call 0xbfa065
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
retf 0xe8
invalid
invalid
add cl, ch
sbb ebp, dword [eax]
add byte [eax], al
sbb dword [eax + 0x5b], edi
mov dl, 0xad
mov esp, 0x247c839c
add al, 0
jne 0xbf9fde
je 0xbfa02b
add ebx, 0xae406079
jmp 0xbfa0b7
inc dword [esp + 8]
popfd
ret
cmp ebx, 0xae406145
je 0xbfa11b
jne 0xbf94ff
call 0xbfa0ca
jmp 0xc26991
jge 0xbfa169
fbld tbyte [esi]
call 0xbfa13a
into
xlatb
xchg ecx, eax
adc ah, byte [edi - 0x2cf622a2]
and ebp, eax
cmp edx, dword [ecx]
outsb dx, byte [esi]
cmp ebx, eax
setbe byte [ecx]
rol byte [ebx - 0x7417afc6], 0xfd
out dx, eax
invalid
and al, 2
xchg dword [esp + 4], esi
sub esp, 0xe
jmp 0xbf9b75
pop eax
sub eax, 0x58e97a19
jmp 0xc269ce
call 0xc269de
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
sbb byte [eax + ebx*8], cl
pop eax
jmp 0xc26a39
call fcn.00c26a53
push cs
fnstenv [ebx - 0x3e]
xchg ecx, eax
sar ah, 1
stosb byte es:[edi], al
iretd
Function at 0xc26b5a
Capabilities:
Packed with generic packer

Disassembly:
call fcn.00bfa191
jmp 0xc26b3b
call 0xbfa1f3
jmp 0xc26b8c
mov dword [esp + 0x24], eax
jmp fcn.00c26c05
push 0
pushfd
pushfd
mov byte [esp + 2], al
push ax
jmp 0xc26b14
jmp 0xc26c1b
pushal
jmp 0xbfa18c
lea esp, [esp + 2]
lea esp, [esp + 4]
cmp dword [esp + 4], 0
jne 0xc26ae3
je 0xc26af9
call dword [eax - 0x1b432d6f]
jmp 0xc26ba7
pop eax
sub eax, 0xe4ce4159
jmp 0xc26b48
call 0xc26b5a
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
leave
add dword [0xbc0ffc95], 0x4324b631
mov esi, 0xd94e270e
cmp byte [eax - 0x73], dl
push eax
lea esp, [esp + 4]
jmp 0xc26ac7
push edx
jmp 0xc26bcc
pop ecx
sub ecx, 0xbfa1f3
jmp 0xc26b76
call 0xc26bc1
dec ecx
inc ebp
call fcn.006cbd39
sub esp, edx
push 0xdee0a12a
xchg dword [edx + 0x4f7c6d72], ecx
salc
push eax
call fcn.00af9ecb
jmp 0xbfa1ee
pushal
xchg dl, ah
call 0xc26bd5
pop esi
mov eax, dword [esp + 3]
mov eax, 0xfd456481
mov dword [esp + 0x18], ecx
jmp 0xc26c38
inc dword [esp + 8]
popfd
ret
lea esp, [esp + 4]
popal
lea edx, [edx + 0xc26ac8]
mov dword [edx], eax
pop edx
movzx ebx, byte [eax]
add ebx, 0xe8ed678e
jmp 0xc26c6e
cmp ebx, 0xe8ed685a
je 0xc26cd2
jne 0xbfa233
jmp 0xc26d2b
popfd
ret
xchg edx, eax
cmc
add al, 0xb5
dec ecx
call 0x2da00ee7
inc dword [esp + 8]
jmp 0xc26c81
Function at 0xc2ad29
Capabilities:
Encode data using xor

Disassembly:
call 0xc297d3
jmp 0xc2a55c
mov dword [esp + 0x24], eax
jmp 0xc2a59f
call 0xc29813
jmp 0xc2a6fc
mov dword [esp + 0x24], eax
jmp 0xc2a628
call 0xc29aff
jmp 0xc2acdc
add byte [eax], al
mov dword [esp + 0x24], eax
jmp 0xc2af7a
jmp 0xc2a572
pop ecx
jmp 0xc2a57d
push eax
call fcn.00af9ecb
jmp 0xc297ce
sub ecx, 0xc297d3
jmp 0xc2a5b5
popal
jmp 0xc2a5e5
mov dword [ecx + 0xc2a416], eax
movzx ebx, byte [eax]
jmp 0xc2a5c4
add ebx, 0xfe6a2470
cmp ebx, 0xfe6a253c
jmp 0xc2a601
inc dword [esp + 8]
popfd
ret
je 0xc2a62e
jne 0xc29805
pushfd
push di
lea esp, [esp + 2]
jmp 0xc2a79e
inc dword [esp + 8]
jmp 0xc2a6de
popal
inc dword [esp + 8]
push ebx
lea esp, [esp + 4]
jmp 0xc2a6c8
call 0xc2a67e
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
les ebx, [esi]
and eax, 0x59ccebd1
jmp 0xc2a6bd
lea esi, [esi + 0xc2a5f1]
mov dword [esi], eax
pop esi
jmp 0xc2a6e0
sub ecx, fcn.00c29840
push esi
mov esi, ecx
jmp 0xc2a6a7
popfd
ret
popfd
ret
push ebp
mov ebp, eax
movzx ebx, byte [ebp]
pop ebp
jmp 0xc2a771
pop eax
sub eax, 0xd139840e
jmp 0xc2a66e
add ebx, 0x41f4e888
cmp ebx, 0x41f4e954
je 0xc2a7db
jne 0xc29853
sub eax, 0x3e1b1245
jmp 0xc2ad17
cmp dword [esp + 4], 0
jne 0xc2a61f
pushal
jmp 0xc2980e
ret
add byte [eax], al
stc
jg 0xc2a7cf
mov bh, byte [ecx + 0x37]
ror byte [ebp - 0x24], cl
das
and dword ss:[ecx - 0x7f], ebx
jmp 0x18540bb
fsubr st(3)
jecxz 0xc2ad36
pop ecx
jmp 0xc2acfa
sub ecx, 0xc29aff
push esi
mov esi, ecx
jmp 0xc2ad8d
call 0xc2ad29
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
jae 0xc2acd9
push es
notrack jmp 0xc2a97e
add byte [eax], al
add al, ch
out 0xd8, al
test byte [edi], bh
dec ebp
ror byte [ecx + 4], cl
bound edx, qword [esi - 0x28a201c3]
mov byte [0x443dad2b], al
mov bh, 4
cmp al, 0x50
push eax
call fcn.00af9ecb
jmp 0xc29afa
lea esi, [esi + 0xc2ac74]
mov dword [esi], eax
pop esi
jmp 0xc2aed6
je 0xc2af43
jne 0xc29b25
call fcn.00c2ae6b
xchg esi, eax
mov dl, 0x8c
sar byte [ecx], cl
iretd
movzx ebx, byte [eax]
add ebx, 0xead4361a
cmp ebx, 0xead436e6
jmp 0xc2ae41
arpl bx, si
xchg esi, eax
shl dword gs:[esi], cl
push ecx
invalid

Function at 0xcb91fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 6
jmp 0xcb92cd
lea ecx, [esi + ebp]
inc al
ror dl, cl
xchg esi, eax
xor eax, ecx
xchg bp, si
push eax
mov edi, dword [esp + 1]
mov dword [esp], edi
mov ebp, 0xdf1302a2
jmp 0xcb9256
lea esp, [esp + 2]
pushal
lea edx, [ebp*4]
rcr dx, cl
lea ecx, [edi*4]
xchg di, cx
jmp 0xcb927a