joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4309b8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
test ebp, 0x54ac6acc
sbb ebp, 0x12c70d2c
not cl
mov ebp, esp
sub esp, 0x120
adc ax, 0x108d
mov eax, dword [0x51f620]
setno cl
xor eax, ebp
and cx, si
or ch, 0x6d
mov dword [ebp - 4], eax
bts cx, sp
ror ecx, cl
btc ecx, edi
mov ecx, dword [ebp + 8]
push esi
add esi, 0x331126f1
or esi, 0x4b5e1e34
mov esi, dword [ebp + 0xc]
cmp bp, si
jmp loc.017954b3
Function at 0x450470
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x45055b
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4504a7
cmp dword [esi + 0x40], edi
jae 0x4504a7
push eax
call fcn.004507e1
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x4504bf
lea eax, [edi + edi]
push eax
call fcn.004507ec
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.00475dd0
add esp, 0xc
xor ebx, ebx
test edi, edi
jbe 0x450558
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x50f670]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x50f670]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x4504d7
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x45059a
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x45057f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.00475dd0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4505bc
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call 0x744f61
ret
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5369c0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1806f51
push 0x9cc4af7c
call fcn.018b135d
push edx
jmp 0x1846e25
call fcn.0046f3b1
mov eax, dword [ebp - 0xfa4]
jmp loc.00420b4e

Function at 0x536c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x536d8c
test eax, eax
je 0x536d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x551ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x536d73
lea edi, [eax + 4]
jmp 0x536cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x536cec
mov dword [ebp - 4], 2
jmp 0x536d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x536d03
mov dword [ebp - 4], 1
jmp 0x536d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x536d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x536d46
mov byte [ecx], 0x3d
jmp 0x536d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x536d5d
mov byte [ecx], 0x3d
jmp 0x536d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x536cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64d900
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp esi, 2
jne 0x7385f2
mov ecx, dword [0x529908]
jmp fcn.00762b71
je 0x4022dc
push eax
jmp fcn.0043543a
mov eax, 0x2e
mov word [ebp - 0x10], ax
mov edx, 0x61
push 0x10
xchg al, ah
cwde
setge al
mov word [ebp - 0xc], dx
not ah
mov eax, 0x6b
push 0x8000
lea edx, [ebp - 0x1c]
mov word [ebp - 0xa], ax
push edx
lea eax, [ebp - 0x20]
jmp 0x17af9cb
push ebp
cdq
shr dh, 0xc5
mov ebp, esp
shl cl, cl
cwd
lea esp, [esp - 0x20]
cmc
mov eax, dword [0x51f620]
and ecx, esi
xchg ch, dh
xor eax, ebp
neg ch
bt edx, 0x75
btc dx, sp
mov dword [ebp - 4], eax
add ax, 0x32cb
mov ecx, 0x5c
rdtsc
rcr ah, cl
cdq
mov word [ebp - 0x1a], cx
mov ecx, 0x78
cwde
sar ax, 0xc2
mov word [ebp - 0x14], cx
bsf ecx, edx
xchg ch, dl
sar edx, 0x90
mov eax, 0x2e
mov cx, 0x1552
btc edx, 0xc1
mov word [ebp - 0x1c], ax
sar dl, cl
bt edx, esi
adc ax, bx
push esi
mov edx, 0x54
cbw
bts eax, esi
mov word [ebp - 0x18], dx
shl ax, cl
adc ax, 0x3c1d
and dx, 0x6f3f
mov ecx, 0x70
shld dx, dx, 0xc0
cmc
movsx dx, al
mov eax, 0x65
mov word [ebp - 0x16], ax
mov ax, bp
cmovl ax, ax
mov word [ebp - 0xe], cx
xor ecx, ecx
cwd
push ecx
mov edx, 0x74
mov word [ebp - 0x12], dx
mov ax, 0x3232
rdtsc
jmp 0x58c9c8
cmp esi, 0xd
pop esi
jmp 0x1799017
mov dword [0x529b54], 0
jmp 0x17b7d3c
mov word [ebp - 8], cx
call fcn.004700a8
mov esi, eax
sbb al, al
mov eax, ebx
mov eax, dword [ebp - 0x20]
jmp 0x17b1388
jne 0x179902d
mov dword [0x529b54], 1
inc cx
rcr cl, 0xb9
mov ecx, dword [ebp - 4]
xor ecx, ebp
jmp 0x185253d
push eax
jmp 0x74a1a0
add esp, 0x14
cmp eax, 0xffffffff
jmp 0x53206b
mov dword [ebp - 0x20], 0xffffffff
jmp 0x179289e
call fcn.0046df75
mov esp, ebp
cmovno bp, sp
movzx ebp, cx
pop ebp
jmp 0x1874f09
ret
Function at 0x7494bd
Capabilities:
Check for software breakpoints

Disassembly:
mov esp, ebp
mov ebp, 0x135f407d
bswap ebp
pop ebp
jmp 0x188e91d
pop ebx
jmp 0x570694
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
jmp 0x1795b21
push ebp
movsx ebp, di
btr bp, 0x13
rol ebp, 0x30
mov ebp, esp
bswap ax
sal eax, cl
cmp di, cx
push 0xffffffffffffffff
push 0x4e3da8
mov eax, dword fs:[0]
cmp esi, ebp
push eax
rcr al, 0x34
sub esp, 8
jmp 0x17c2136
cmp esi, ebx
jmp 0x17b0c8e
pop ecx
mov esi, 0x653e55c8
pop edi
mov bx, si
movsx ebx, sp
pop esi
jmp 0x6059ba
jae 0x6e0f35
jmp loc.0041d505
push ebx
test bx, 0x3501
push esi
btc si, si
push edi
movzx eax, ax
cwde
mov eax, dword [0x51f620]
xor eax, ebp
bsf ebx, edi
sbb si, 0x5a7c
push eax
inc ax
lea eax, [ebp - 0xc]
bts esi, edx
not si
mov dword fs:[0], eax
sub esi, esp
mov esi, ecx
mov eax, dword [ebp + 8]
lea ebx, [esi + eax]
clc
jmp 0x178305c
ret

Function at 0x753833
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x2bf14070
call fcn.005b3b37
Function at 0x75efda
Capabilities:
Execute anti-debugging instructions
Read file on windows
Resolve function by parsing pe exports

Disassembly:
jb 0x41b0ab
mov eax, dword [0x52afe0]
mov edi, eax
test di, 0xfca
stc
sub edi, dword [0x52afdc]
cmc
cmp cl, bh
test esp, 0x6753367f
mov byte [esp + 0x13], 0
sar edi, 2
jmp 0x18b9fdb
mov dword [esp + 0x780], eax
jmp 0x18d5a55
push edi
mov dword [esp + 0x20], esi
call dword [0x4e7360]
mov dword [esp + 0x14], eax
jmp 0x17779cf
push 0xa09d0bf9
call fcn.007113e0
push ebp
mov ebp, esp
add eax, 0x723844f3
and esp, 0xfffffff8
cbw
stc
shl al, 0xf0
sub esp, 0x784
btc ax, 0xb3
xor al, 0x21
jmp 0x17766b0
mov eax, dword [0x51f620]
test dx, 0x481a
cmp edi, ebp
stc
xor eax, esp
jmp 0x65ebf5
sub eax, dword [esi + 0x27c]
cmp ax, bp
cmp eax, 0x3e8
jmp 0x5b5eae
push esi
mov esi, ecx
jmp 0x66176a
test edi, edi
ja 0x18b9ff0
mov byte [esp + 0x13], 1
mov ebx, 0x598c1c9c
adc bl, 0xf1
sub esi, esi
lea ebx, [esi + 0x73]
test esi, eax
cmp ebp, 0x672d5d81
test edi, edi
jmp loc.0043a818
push ebx
jmp 0x1836303

Function at 0x76f6f4
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0xce14a0f9
call fcn.018e74d4

Function at 0x17711fa
Capabilities:
Execute anti-debugging instructions
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xc9fcb3f8
call fcn.018e74d4
Function at 0x17766b0
Capabilities:
Execute anti-debugging instructions
Read file on windows
Resolve function by parsing pe exports

Disassembly:
jb 0x41b0ab
mov eax, dword [0x52afe0]
mov edi, eax
test di, 0xfca
stc
sub edi, dword [0x52afdc]
cmc
cmp cl, bh
test esp, 0x6753367f
mov byte [esp + 0x13], 0
sar edi, 2
jmp 0x18b9fdb
mov dword [esp + 0x780], eax
jmp 0x18d5a55
push edi
mov dword [esp + 0x20], esi
call dword [0x4e7360]
mov dword [esp + 0x14], eax
jmp 0x17779cf
push 0xa09d0bf9
call fcn.007113e0
push ebp
mov ebp, esp
add eax, 0x723844f3
and esp, 0xfffffff8
cbw
stc
shl al, 0xf0
sub esp, 0x784
btc ax, 0xb3
xor al, 0x21
jmp 0x17766b0
mov eax, dword [0x51f620]
test dx, 0x481a
cmp edi, ebp
stc
xor eax, esp
jmp 0x65ebf5
sub eax, dword [esi + 0x27c]
cmp ax, bp
cmp eax, 0x3e8
jmp 0x5b5eae
push esi
mov esi, ecx
jmp 0x66176a
test edi, edi
ja 0x18b9ff0
mov byte [esp + 0x13], 1
mov ebx, 0x598c1c9c
adc bl, 0xf1
sub esi, esi
lea ebx, [esi + 0x73]
test esi, eax
cmp ebp, 0x672d5d81
test edi, edi
jmp loc.0043a818
push ebx
jmp 0x1836303
Function at 0x17883ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
ret
push 0x104
jmp 0x5fb517
call 0x5c0f09
test eax, eax
jmp 0x736acb
jl 0x18c473b
pop edi
rol bh, cl
bsf si, ax
or bx, sp
pop esi
dec ecx
sub al, al
cmovno bx, ax
shl ecx, cl
pop ebx
bsr cx, sp
movzx ecx, ax
mov ecx, dword [ebp - 4]
cmp cl, 0xab
xor ecx, ebp
call fcn.0046df75
mov esp, ebp
pop ebp
jmp 0x18e94d5
call fcn.00473d70
lea esp, [esp + 0xc]
cmp dx, 0x2691
stc
test ebx, ebx
je 0x179ad2b
test esi, esi
jmp 0x18c4723
mov word [ebp - 0x8c], cx
jmp 0x59f5ae
push edi
jmp 0x77c425
push edi
jmp 0x1802103
push edx
jmp 0x1887845
push 0x7e
cmp ah, 0x8b
xor dl, al
xor eax, eax
cmove edx, edx
mov dx, si
push ecx
lea edx, [ebp - 0x8a]
jmp 0x75891d
cmp di, 0x5b
jmp 0x5750af
mov word [ebp - 6], ax
jmp 0x5a4228
je 0x17c1e4c
inc edi
cmc
jmp 0x6cd28f
push eax
call fcn.0046ee70
add esp, 0xc
stc
test eax, eax
jmp 0x6db62d
je 0x6db633
lea eax, [ebp - 0x8c]
ror dh, 0xaf
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
clc
test dh, 0xbc
add eax, 2
test cx, cx
jmp 0x18e270e
push ebx
jmp 0x733a51
mov dword [ebp - 0xa], eax
jmp 0x6d62d5
push edx
mov dword [ebp - 0x90], esi
jmp 0x18e924c
call fcn.0046ef16
lea edx, [ebx + esi*2]
jmp 0x6774ef
push edx
jmp 0x177fd2d
pop ebp
jmp 0x45e85c
mov word [ebp - 0xc], di
jmp 0x1872838
push ebp
adc edx, 0x1f901695
mov ebp, esp
sbb ah, dh
sub esp, 0x90
mov eax, dword [0x51f620]
cdq
neg dl
xor eax, ebp
mov dword [ebp - 4], eax
bts dx, dx
ror dh, 0x62
push ebx
cmp edi, 0xd806871
bsr dx, cx
shld ebx, eax, 0xb6
mov ebx, dword [ebp + 8]
sal dh, cl
and edx, 0x5a02302b
jmp 0x1864201
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor al, al
not ebx
movzx ebx, di
jmp 0x1823e4c
call fcn.0046df75
mov esp, ebp
xchg ebp, ebp
movzx ebp, dx
cmovb bp, bp
pop ebp
jmp 0x53792e
mov edi, dword [ebp - 0x90]
mov cl, 0x5d
bswap cx
cmovnp cx, si
lea ecx, [ebp - 0xc]
jmp 0x18c8d94
call fcn.0046ef85
lea esp, [esp + 0x18]
pop edi
setno bl
pop esi
mov al, 1
sbb bl, cl
mov ebx, esp
pop ebx
dec cl
mov ecx, dword [ebp - 4]
cmp esp, eax
xor ecx, ebp
call fcn.0046df75
mov esp, ebp
jmp 0x176e871
pop ebx
jmp 0x17b79b8
push esi
rol si, 0x96
shld dx, bp, 0x71
btr esi, esi
mov esi, ecx
sar dh, cl
or dl, 0xd0
xadd edx, edx
sub ecx, ecx
rol edx, cl
jmp 0x6b5f50
mov word [ebp - 0xa], ax
jmp 0x574734
push 0x104
jmp 0x60d7af
je 0x179ad2b
push edi
movsx edx, dx
mov edi, 0x41
rdtsc
movsx ecx, cx
mov eax, ebp
mov edi, edi
push 0x40
cwde
movzx dx, ch
setns ah
lea ecx, [ebp - 0x8c]
push ecx
movzx dx, bl
cwde
rdtsc
lea edx, [ebp - 0xc]
mov eax, 0x3a
jmp 0x17695d1
push ecx
jmp 0x53f9ab
jne 0x736ae0
sub eax, edx
xor esi, 0x671a5deb
sar eax, 1
mov esi, eax
push esi
lea eax, [ebp - 0x8c]
jmp 0x73d4c3
mov word [ebp - 0xc], ax
jmp 0x73f5d8
ret
Function at 0x17c2136
Capabilities:
Check for software breakpoints

Disassembly:
mov esp, ebp
mov ebp, 0x135f407d
bswap ebp
pop ebp
jmp 0x188e91d
pop ebx
jmp 0x570694
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
jmp 0x1795b21
push ebp
movsx ebp, di
btr bp, 0x13
rol ebp, 0x30
mov ebp, esp
bswap ax
sal eax, cl
cmp di, cx
push 0xffffffffffffffff
push 0x4e3da8
mov eax, dword fs:[0]
cmp esi, ebp
push eax
rcr al, 0x34
sub esp, 8
jmp 0x17c2136
cmp esi, ebx
jmp 0x17b0c8e
pop ecx
mov esi, 0x653e55c8
pop edi
mov bx, si
movsx ebx, sp
pop esi
jmp 0x6059ba
jae 0x6e0f35
jmp loc.0041d505
push ebx
test bx, 0x3501
push esi
btc si, si
push edi
movzx eax, ax
cwde
mov eax, dword [0x51f620]
xor eax, ebp
bsf ebx, edi
sbb si, 0x5a7c
push eax
inc ax
lea eax, [ebp - 0xc]
bts esi, edx
not si
mov dword fs:[0], eax
sub esi, esp
mov esi, ecx
mov eax, dword [ebp + 8]
lea ebx, [esi + eax]
clc
jmp 0x178305c
ret

Function at 0x17cf22c
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebx
mov eax, 1
stc
cmovp ecx, edx
rcr edx, cl
cpuid
push esi
lea esi, [ebp - 0x18]
stc
mov dword [esi], eax
mov dword [esi + 4], ebx
test al, 0x8d
mov dword [esi + 8], ecx
add ecx, ebx
mov cx, bp
mov dword [esi + 0xc], edx
rol cl, 0x7f
stc
jmp loc.017f1194
mov byte [ebp - 0x3c], 0
call fcn.004030d0
lea eax, [ebp - 0x44]
jmp 0x17aec10
push 0x1f0001
call fcn.0043f80f
test eax, eax
je 0x42a604
push eax
jmp 0x17e32b9
mov byte [ebp - 0x3d], 0x79
jmp 0x541b74
mov byte [ebp - 0x43], 0x42
mov byte [ebp - 0x42], 0x6f
jmp 0x17f125d
mov dword [ebp - 4], eax
jmp 0x1853892
mov byte [ebp - 0x3f], 0x72
mov byte [ebp - 0x3e], 0x61
jmp 0x583bad
push eax
push 0
jmp 0x56d4a7
push ebp
mov ebp, esp
mov eax, edi
neg ah
cwde
lea esp, [esp - 0xa8]
shl al, 0x3d
mov eax, dword [0x51f620]
cmp cx, sp
xor eax, ebp
jmp 0x650e62
call dword [0x4e7448]
mov al, 1
rcr ecx, 0x4e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046df75
mov esp, ebp
movsx ebp, si
pop ebp
jmp loc.0046cb07
mov byte [ebp - 0x41], 0x78
jmp 0x187ddda
mov byte [ebp - 0x44], 0x56
jmp 0x617361
mov byte [ebp - 0x40], 0x54
jmp 0x177345f
Function at 0x17f88b1
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
imul ebp, dword [ecx - 0x7d], 0xffffffd6
bswap edx
add byte [eax - 7], ch
mov al, byte [0x19e8ce14]
in al, dx
push cs
add byte [ebx], dl
jp 0x17f8920
push 0xce14a0f9
call fcn.018e74d4
adc edi, dword [edx + 0x62]
add edx, ebx
je 0x17f8883
out 0x49, eax
dec ecx
pop ebx
out dx, eax
pop ss
das
xchg esi, eax
jo 0x17f886c
movsd dword es:[edi], dword [esi]
sbb dword [esi - 0x63478efe], edx
jns 0x17f88b0
cmpsd dword [esi], dword es:[edi]
out dx, eax
mov eax, 0x3bcf2221
out 0x81, al
aas
aad 0x55
xchg byte [edi + 0x65], dl
xor edx, dword [edi + edx]
cmp dword [esi + 0x7c], esi
scasd eax, dword es:[edi]
cdq
mov ch, 0xae
mov eax, ebx
enter 0x17ad, 0x77
push ss
push edi
aas
in eax, 0x9e
or bl, byte [edi - 0x3dde2671]
lahf
lds ebx, [esi + 0x34a789e1]
invalid
xchg esi, eax
pop ss
cmp esi, dword [eax + 0x66]
jmp 0x728d2e9
lds ecx, [ecx - 0x57]
add eax, 0x65769848
neg byte [edi + 0x1d850cb2]
pushal
xchg byte [esi], al
mul cl
sbb eax, 0xf6068660
loope 0x17f89a4
jo 0x17f88c3
mov ds, word [esi]
push ds
adc eax, dword [esi - 0x2321c077]
xor al, 0x15
or cl, byte [edx + 0x35]
jl 0x17f8964
fcompi st(3)
jl 0x17f892d
lahf
mov byte [0x265ff1fe], ah
adc eax, 0xf149baf8
jp 0x17f8933
popfd
pushal
dec edx
or ecx, dword [ebx]
fisttp qword [ecx - 0x18]
test eax, 0x225347a5
xchg byte [edi - 0x33], ah
xor edx, dword [edx - 0x39]
imul ebp, dword [ebx - 0x7f0b07fd], 0x2986d40a
punpcklwd mm3, dword [esi]
push eax
stc
jno 0x17f89db
int 0x33
push edx
invalid
dec ecx
ror ah, 1
movsb byte es:[edi], byte [esi]
test dword [ebx + 0x5f89210], 0xdbc1b691
out 0x32, eax
in al, 0x19
mov al, byte [0x4bb1521f]
dec edx
jmp 0x17f8919
mov ah, 0x7b
mov ecx, 0x7264e609
mov edx, 0x29133558
sbb eax, 0x85ac398e
xor eax, 0xf5376cb1
sar edx, 0xd3
call 0x17791763
sbb al, 0x86
aaa
mov ebp, 0x7c8aa86e
scasb al, byte es:[edi]
invalid
fcom dword [esi]
mov bh, 0xee
mov eax, 0xd6206836
sahf
mov al, byte [0x1ca11907]
cmpsb byte [esi], byte es:[edi]
pop ds
jbe 0x17f8a4f
ret
test al, 0x67
xchg byte [ebx + 0x7725ca23], cl
mov bl, 0xf8
rol byte [ecx + 0x75f30c11], cl
invalid
Function at 0x180f420
Capabilities:
Parse pe header

Disassembly:
push eax
mov byte [ebp - 0x18], 0x6e
jmp 0x75657c
mov byte [ebp - 0x1c], 0
jmp 0x187ae50
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x75df4c
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], bl
jmp 0x766d2a
mov byte [ebp - 0xf], 0
jmp 0x18e70b7
ret
push edx
jmp 0x18be66d
push edi
call 0x68ba46
lea eax, [ebp - 0x18]
jmp 0x5c58f0
mov byte [ebp - 0x17], 0x74
jmp 0x18e5af3
mov byte [ebp - 0x1d], 0x6c
jmp 0x618dbd
push ebx
jmp 0x1866292
xor ecx, ebp
jmp 0x77443a
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x32
jmp 0x773844
mov byte [ebp - 0x20], 0x2e
jmp 0x1772dd3
call fcn.0046df75
mov esp, ebp
pop ebp
jmp 0x6c53a7
mov byte [ebp - 0x27], bl
jmp 0x17bc7f0
mov byte [ebp - 0x1f], 0x64
jmp 0x17e9289
mov byte [ebp - 0x10], 0x6c
jmp 0x6891e6
jne 0x17ecbb8
pop edi
bsr si, si
not cl
pop esi
add bx, 0x4769
sub eax, eax
shrd ecx, esi, 0x14
sar bl, 0xdb
pop ebx
xor ecx, esi
dec cx
mov ecx, dword [ebp - 4]
jmp 0x75ff4e
mov byte [ebp - 0x14], 0x6c
jmp 0x1872e6a
mov byte [ebp - 0x26], 0x72
jmp 0x673cb5
mov byte [ebp - 0x1e], 0x6c
jmp 0x759083
test eax, eax
je 0x17b818c
call 0x185ebfe
lea edx, [ebp - 0xe8]
jmp 0x703b9f
mov byte [ebp - 0x11], 0x6c
jmp 0x1797df1
push ebp
bt ax, 0x7a
mov ebp, esp
ror ah, 0xc7
inc eax
sub esp, 0x16c
lahf
mov eax, dword [0x51f620]
cmc
clc
jmp 0x65cf75
push esi
jmp 0x7293b0
mov byte [ebp - 0x28], 0x6b
jmp 0x77eb80
mov byte [ebp - 0x13], 0x2e
jmp 0x187d518
call edi
test esi, esi
jmp 0x17b8186
mov byte [ebp - 0x12], 0x64
jmp 0x17ed5fd
push esi
jmp 0x4204a9
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x6c
jmp 0x17ba5bc
call edi
lea ecx, [ebp - 0x28]
mov si, 0x6c02
xchg si, si
mov bl, 0x65
push ecx
mov si, dx
mov si, 0x4842
bswap esi
mov esi, eax
jmp 0x186f3ad
Function at 0x186d0ef
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea eax, [edi - 0x10]
setge cl
stc
mov byte [esp + 0x1440], 5
test ax, sp
lea ecx, [eax + 0xc]
jmp 0x449972
or edx, 0xffffffff
clc
lock xadd dword [ecx], edx
jmp fcn.00764c07
push eax
cwd
cdq
mov edx, 0x5118b8
jmp 0x18a6268
call fcn.005f6c75
lea eax, [esi - 0x10]
shld ecx, edx, 0xe8
ror ch, 0x47
lea esp, [esp + 0x1c]
dec ecx
mov byte [esp + 0x1440], 8
xor ecx, ebp
cmp bl, 0x32
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x18e693f
push ecx
jmp 0x18c18c9
call fcn.00408a20
lea edx, [esp + 0x14]
push edx
jmp loc.0042c769
push ecx
jmp 0x6dd8ad
mov esi, dword [esp + 0x28]
not ecx
setns cl
mov ecx, dword [esp + 0x34]
jmp 0x5c4d9b
call fcn.004083b0
lea esp, [esp + 4]
cmp dword [esp + 0x20], ebx
jle 0x177a9da
lea eax, [esp + 0x18]
jmp 0x5a5657
lea ecx, [esp + 0x6d8]
jmp 0x182e975
push 0x4bb1c4df
call fcn.005d4d4d
push edx
setae ch
lea edi, [esp + 0x2c]
jmp 0x1866261
push eax
mov eax, dword [edx + 4]
jmp fcn.00405bf7
call fcn.00408900
mov esi, dword [esp + 0x28]
mov cx, cx
cwde
lahf
mov eax, dword [esi - 0xc]
mov cl, 0x20
movsx ecx, ax
bswap ecx
push esi
lea ecx, [esp + 0x1c]
jmp 0x7665ac
call dword [0x4e7448]
mov edx, dword [esp + 0x14]
setb al
mov edi, dword [esp + 0x18]
xchg cl, cl
push edx
cwde
push edi
setb cl
not al
movzx eax, dx
lea eax, [esp + 0xb14]
push eax
lea ecx, [esp + 0x950]
push ecx
cwd
push 0x38
lea edx, [esp + 0x2e0]
push 0x4d
push edx
jmp 0x5c0a56
jg 0x405bf9
mov ecx, dword [eax]
mov edx, dword [ecx]
jmp 0x188eb20

Function at 0x187b324
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x6e], 0x61
mov byte [esp + 0x6f], 0x64
jmp 0x178e798
mov byte [esp + 0x68], 0x6b
jmp 0x183dcf3
mov byte [esp + 0x72], 0x69
jmp 0x1804a07
mov byte [esp + 0x6c], 0x72
jmp 0x17978ca
mov byte [esp + 0x70], 0x20
mov byte [esp + 0x71], 0x4d
jmp 0x1771204
mov byte [esp + 0x6d], 0x65
jmp 0x5aca90
mov byte [esp + 0x67], 0x63
jmp 0x741c7e
mov byte [esp + 0x73], bl
jmp 0x1880736
mov byte [esp + 0x69], 0x20
mov byte [esp + 0x6a], 0x54
mov byte [esp + 0x6b], 0x68
jmp 0x177fe75
push 0xc9fcb3f8
call fcn.018e74d4
mov byte [esp + 0x65], 0x68
mov byte [esp + 0x66], 0x65
jmp 0x17c4378
mov byte [esp + 0x74], bl
jmp loc.0040b531
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x43176b56
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2aa30990
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401097
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4010cc
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4010c8
cmp edi, eax
jae 0x4010cc
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4010ba
cmp edi, eax
jb 0x4010d0
xor eax, eax
jmp 0x4010d9
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret