joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7f30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5edb03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.005dfbd1
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x5f1090]
push eax
mov ecx, edi
call fcn.005e5270
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.005e6a2f
test eax, eax
je 0x4d804c
mov ecx, dword [esp + 0x3c]
call fcn.005e529d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x5f1638]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4d8010
push edi
mov ecx, esi
call fcn.005e2904
mov ecx, esi
call fcn.004d81f0
cmp dword [esp + 0x38], 1
jne 0x4d8045
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.005e2a3f
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4da240
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4da273
push esi
call fcn.004e8600
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4da26c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4da2f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4da2e2
mov eax, dword [esi + 8]
test eax, eax
je 0x4da297
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4da2de
cmp eax, 2
je 0x4da2e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4da28a
cmp eax, 3
je 0x4da2bd
cmp eax, 1
jne 0x4da28a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4da28a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4da28a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004da320
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4da308
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004da320
add esp, 4
pop esi
ret
Function at 0x54c549
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push SysStringLen
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersCookies
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x698
call fcn.00565100
add esp, 0x28
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x54c5b0
push ebx
call fcn.00563900
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
push str..txt
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.004f4ff8
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push dword [ebp - 0xc]
mov eax, 0
call fcn.00564990
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x54c5fe
push ebx
call fcn.00563900
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x54c612
push ebx
call fcn.00563900
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x723ace
push dword [ebp - 4]
call fcn.004f4f5b
add esp, 8
cmp eax, 0
je 0x54c75d
push reloc.oleaut32.dll_SysReAllocString
push 0
push 0
push 0x80000301
push 0
push 1
push SysStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x54c65c
mov eax, 0x723ace
push eax
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x54c670
mov eax, 0x723ace
push eax
push 4
mov ebx, 0x148
call fcn.00564880
add esp, 0x34
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x54c6af
push 0x723ace
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.004f4f5b
add esp, 8
cmp eax, 0
je 0x54c6af
xor eax, eax
jmp 0x54c6b4
mov eax, 1
test eax, eax
je 0x54c723
push dword [ebp - 4]
push 0x723acf
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 3
call fcn.004f4ff8
add esp, 0xc
mov dword [ebp - 0xc], eax
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x54c6ec
mov eax, 0x723ace
push eax
push 1
mov ebx, 0x244
call fcn.0056b120
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x54c712
push ebx
call fcn.00563900
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x54c723
mov dword [ebp - 8], 1
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push 0
mov eax, 0
call fcn.00564990
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x54c754
push ebx
call fcn.00563900
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x54c616
mov eax, dword [ebp - 8]
jmp 0x54c765
push eax
push dword [ebp - 0x20]
mov eax, 1
call fcn.00564ad0
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x54c786
push ebx
call fcn.00563900
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x570200
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f7c2c
push 0x572a9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00572c30
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x598510
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5eee90
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x5986b7
mov ecx, dword [0x760084]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x59860c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00597230
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.005de6d3
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.005de5e6
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x75a294
call fcn.005de654
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.005975f0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.005de6d3
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.005de5e6
lea ecx, [esp + 0xc]
call fcn.005deaae
mov ecx, dword [esp + 0xc]
push 0x75acd4
push ecx
call fcn.005c8944
add esp, 8
test eax, eax
je 0x598634
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x59856d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.005de5e6
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005de5e6
jmp 0x5986bb
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.005982b0
test eax, eax
push 0
je 0x59869f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00596950
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x598685
cmp eax, 0x64
jg 0x598673
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [0x5f12c0]
mov esi, eax
jmp 0x598610
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [0x5f12c0]
mov esi, eax
jmp 0x598610
cmp eax, 0x64
jge 0x59860c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [0x5f12c0]
mov esi, eax
jmp 0x598610
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00596950
mov esi, eax
jmp 0x598610
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x5986c5
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x5a3e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ef480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005a39b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.005a3a30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.005a3a30
lea ecx, [esi + 0xc]
call fcn.005de571
lea ecx, [esi + 0x10]
call fcn.005de571
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.005a4fc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.005a4fc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.005a4fc0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005de5e6
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005de5e6
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5a6390
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x75b904]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5a63a3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5a63e4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x75b9ac]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5a6416
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5a641a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5a640b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5a6438
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5a643c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5a642d
xor ecx, ecx
mov eax, 0x75b914
xor ebx, ebx
mov bl, byte [ecx + 0x75b9bc]
cmp byte [esp + ebx + 0x14], 0
je 0x5a6467
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x75b9d4]
cmp byte [esp + ebx + 0x14], 0
je 0x5a647e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x5a644e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5a63d7
lea edx, [esp + 0x84]
push edx
call fcn.005a64c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5ae410
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov al, byte [esi + 4]
mov dl, byte [esi + 5]
add eax, 0xfffffffc
and dl, 0xfc
cmp eax, 0x22
mov byte [esi + 5], dl
ja case.0x5ae443.12
mov edi, dword [ebp + 8]
mov bl, 4
xor ecx, ecx
mov cl, byte [eax + 0x5ae56c]
jmp dword [ecx*4 + 0x5ae548]
mov eax, dword [esi + 8]
test eax, eax
je 0x5ae461
test byte [eax + 5], 3
je 0x5ae461
push eax
push edi
call fcn.005ae410
add esp, 8
mov dl, byte [esi + 5]
or dl, bl
mov byte [esi + 5], dl
mov edx, dword [esi + 0xc]
mov eax, dword [edi + 0x10]
add edx, 0x18
add eax, edx
mov dword [edi + 0x10], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov cl, byte [esi + 6]
test cl, 0x40
je case.0x5ae443.12
mov cl, byte [eax + 5]
test cl, 3
je case.0x5ae443.12
mov dl, cl
mov esi, eax
and dl, 0xfc
mov byte [eax + 5], dl
xor edx, edx
mov dl, byte [eax + 4]
mov eax, edx
add eax, 0xfffffffc
cmp eax, 0x22
jbe 0x5ae43b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 5]
or al, bl
mov byte [esi + 5], al
mov ecx, dword [edi + 0x10]
xor eax, eax
mov al, byte [esi + 7]
add eax, 0x11
add ecx, eax
mov dword [edi + 0x10], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 5]
mov ecx, dword [esi + 0xc]
or al, bl
add ecx, 0x11
mov byte [esi + 5], al
mov eax, dword [edi + 0x10]
add eax, ecx
mov dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x4c]
mov dword [esi + 8], edx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x4c]
mov dword [esi + 8], eax
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x4c]
mov dword [esi + 0x1c], ecx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x28], edx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5afe40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov eax, ecx
shr esi, 5
xor eax, edx
inc esi
cmp ecx, esi
jb 0x5afe7b
push ebx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [edi + ecx - 1]
sub ecx, esi
shl ebx, 5
add edx, ebx
mov ebx, eax
shr ebx, 2
add edx, ebx
xor eax, edx
cmp ecx, esi
jae 0x5afe5d
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x7b8c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x7b8d1c
test eax, eax
je 0x7b8d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x7d3fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x7b8d03
lea edi, [eax + 4]
jmp 0x7b8c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x7b8c7c
mov dword [ebp - 4], 2
jmp 0x7b8c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x7b8c93
mov dword [ebp - 4], 1
jmp 0x7b8c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x7b8d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x7b8cd6
mov byte [ecx], 0x3d
jmp 0x7b8ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x7b8ced
mov byte [ecx], 0x3d
jmp 0x7b8cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x7b8c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x83eb22
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x43deb7
push ebp
mov ebp, esp
test dh, 0xdf
cmp sp, bx
sub esp, 0x14
jmp 0xe3e4ab
push dword [ebp - 4]
not bx
push 1
mov ebx, 0x48d210
jmp 0x93aad5
call fcn.0048b5f1
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x80000301
setl bl
push 0
sets bl
cmovae ebx, ebp
push dword [ebp - 8]
movzx bx, ah
push 1
mov ebx, 0x48d210
jmp 0xff874d
nop
cmp esp, 0x40265cc1
test ecx, 0x7b3e0216
cmp sp, bp
nop
clc
cmp bh, 0x2f
nop
cmp ax, 0x34ff
nop
nop
clc
jmp 0xd49e93
call fcn.0048b5eb
add esp, 4
sete ah
cbw
jmp 0xfb4572
nop
stc
clc
nop
test ebx, 0x24c468de
cmp edi, ebp
nop
nop
stc
test ebp, 0x403b669a
nop
cmp al, 0x7c
test esi, ebx
nop
cmp ax, bp
nop
cmp al, 0x3c
test sp, 0x75c4
clc
pushal
bt cx, bx
shrd edi, edx, 0x12
mov eax, 1
dec ebp
sal ah, cl
mov eax, 2
mov eax, 4
shrd si, dx, 0xdc
rcl ah, cl
sbb bl, 0x5a
mov eax, 2
sbb di, dx
or al, 0x96
rdtsc
mov eax, 5
cwde
jmp 0x1095aef
call fcn.0048b5eb
add esp, 4
stc
sar ebx, cl
mov ebx, dword [ebp - 0x10]
stc
test ebx, ebx
jmp 0xf7b452
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0xbd9db6
call fcn.00403749
lea esp, [esp + 8]
shl bh, 0xb0
sal bx, cl
mov dword [ebp - 0x14], eax
bt bx, cx
mov ebx, dword [ebp - 0xc]
cmc
test ebx, ebx
jmp 0xefd3f7
push 0
not ebx
jmp 0x858bbc
cpuid
shr ecx, 0x10
mov dword [ebp - 4], ecx
ror al, cl
pop edx
pop ecx
shrd ebx, esp, 0xf3
cbw
mov bx, cx
pop ebx
nop
dec eax
xor ax, dx
push ebx
rcl bx, 0xc7
and bx, cx
shl bx, cl
push ecx
push edx
shrd ecx, edi, 0xaf
shld ebx, edx, 0x88
sal ch, 0x33
mov eax, reloc.WS2_32.dll_getpeername
ror ecx, cl
cpuid
cmp ax, 0x6276
sbb bh, 0x7a
mov ebx, 0xdbb7a50
shr edx, 0x18
sar bx, 0x15
adc ebx, ebx
shr ecx, 0x18
btc ebx, edx
bsr bx, sp
add edx, ecx
movzx ecx, si
xchg bl, bh
mov dword [ebp - 8], edx
movsx cx, bh
pop edx
mov cl, dl
pop ecx
pop ebx
mov bx, sp
bswap bx
xchg bl, bl
push 0x80000301
mov bx, cx
jmp 0xe4ceb2
je 0xe2d231
push ebx
jmp 0xe2d226
je 0xfb4572
push ebx
jmp 0xc00199
mov eax, dword [ebp - 0x14]
jmp 0x8153d2
call fcn.0048b5f1
add esp, 0x10
seto cl
movzx ecx, cx
movsx ecx, dx
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
not cx
push dword [ebp - 0xc]
setne ch
not cl
mov ecx, 2
jmp 0xe445a6
mov eax, 4
mov eax, 2
bt edi, eax
btc edx, ebp
mov eax, 5
btr eax, 0xab
ror bl, 0x56
mov eax, 6
and ebx, ebp
popal
push edx
add edx, 0x2e681f9b
neg eax
rcl dh, 0xb0
mov edx, 1
add ah, 0x55
mov edx, 2
xchg dx, ax
mov edx, 4
test ebx, esp
add ah, 0xd9
mov edx, 2
ror eax, 0xf0
mov edx, 5
sal dh, cl
mov edx, 4
adc dh, 0x3b
bsf dx, bx
sbb eax, edi
mov edx, 2
and dl, 0xb6
sub ah, 0xe4
bswap eax
mov edx, 5
mov edx, 5
bt ax, 0xde
sar al, cl
pop edx
or eax, 0x4a254e0d
adc al, 0xd1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
rol ah, cl
add al, 0x71
push ebx
cmc
xor ebx, 0x74f73330
push ecx
push edx
sbb dl, ch
mov eax, reloc.oleaut32.dll_SysStringLen
jmp 0xe79895

Function at 0x8c5842
Capabilities:
Packed with generic packer

Disassembly:
push ebp
stc
sbb bp, bp
mov ebp, esp
sub esp, 4
jmp 0xbc1c69
nop
cmp ch, bh
nop
nop
cmc
nop
cmc
nop
jmp 0x1051171
mov dword [ebp - 4], 0
jmp 0xc8a145
jmp 0xa5ad97
nop
jmp 0x43b275
Function at 0x9220d3
Capabilities:
Packed with generic packer

Disassembly:
sub ebx, ebx
not bl
jmp 0xc31011
mov dword [ebp - 0xc], 0
jmp 0xda042f
push ebp
mov ebp, esp
test bp, ax
jmp 0x1158356
mov dword [ebp - 0xc], 0
push ecx
push edx
push ebx
xchg edx, eax
movzx dx, dl
shl cx, cl
mov eax, 1
cmovle cx, si
add dx, 0x52e5
cpuid
jmp 0x8b5bda
mov bl, al
jmp 0x108da58
nop
stc
pushal
mov eax, 1
bsf edi, ebx
mov eax, 2
movzx ebp, bx
mov eax, 4
mov al, 0xcc
mov eax, 2
adc ecx, edx
sub bh, 0x8c
btc ebx, esp
mov eax, 5
mov eax, 4
cmc
mov eax, 2
movsx eax, sp
movsx dx, al
xadd ch, bl
mov eax, 5
shr di, 0x44
add al, ch
mov eax, 6
cmp cx, ax
or al, 5
popal
shr eax, 0xff
push edx
xor ax, 0x2f9b
mov edx, 1
mov edx, 2
shr ax, 0xbd
btr eax, 0x18
ror ax, 0xfe
mov edx, 4
sal dh, cl
shr edx, 0x35
mov edx, 2
ror ah, 0x77
movsx edx, di
mov edx, 5
or ah, 0x74
and al, 0x1e
cbw
mov edx, 4
test esp, 0x74173f00
clc
cwd
mov edx, 2
sbb dl, 0x52
movzx eax, sp
mov edx, 5
test edx, edi
movzx edx, bx
mov ax, bp
mov edx, 5
adc dx, di
pop edx
rcl al, 0x68
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
nop
clc
jmp 0x94d1c0
jmp 0xe482c0
nop
cmp si, 0x4f94
test ax, di
cmc
nop
nop
cmp edx, 0x6f8f399a
test esp, ebp
nop
clc
cmc
nop
test dl, ch
nop
stc
nop
nop
stc
test ax, 0x473c
nop
nop
test si, 0x6992
nop
jmp 0xcd0e4d
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x9190f6
mov dword [ebp - 8], ebx
mov bl, dl
setle dl
movzx edx, bp
mov dword [ebp - 0xc], ebx
movzx bx, dl
bswap ebx
jmp 0x117f035
call fcn.0048b5f1
add esp, 0x10
xchg ebx, ebx
push 0x80000101
push 0
movsx ebx, bp
push eax
not bh
bswap ebx
push 1
mov ebx, 0x48d210
jmp loc.0043cbcd
push 0
push dword [ebp - 4]
cmovs bx, di
movsx bx, ch
movsx ebx, di
push 1
movzx ebx, bp
mov bx, di
mov ebx, 0x48c520
jmp 0xfdd88d
mov dword [ebp - 4], ebx
mov bl, cl
movsx cx, bl
jmp 0xf15c1b
sub esp, 0x2c
jmp 0xe810bc
pop ebx
pop edx
movsx cx, cl
mov bh, 0x18
bswap bx
pop ecx
xchg bl, bh
push 0x80000301
mov bh, 0xc5
jmp 0x102f8ea

Function at 0x9d0172
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
nop
setnp al
push ebx
jmp 0x10a413b
jmp ebp
push ecx
cdq
cwd
mov edi, dword [esp + 0x28]
dec si
bswap edi
rdtsc
bswap edx
dec edi
xchg bp, bx
cbw
rol edi, 1
seta dl
rdtsc
movzx esi, bx
inc edi
not edi
lea edi, [edi + ecx]
mov esi, esp
sub esp, 0xc0
rol al, cl
mov ebx, edi
bt ax, 0x8e
mov eax, 0
sub ebx, eax
cmp ebx, 0x6de84437
mov edx, esi
btr bp, 0x2c
lea ebp, [0xa9b1cc]
mov dh, bh
setno dh
lea edi, [edi - 4]
or edx, edx
mov edx, dword [edi]
xor edx, ebx
test eax, 0x740170f6
neg edx
ror edx, 1
test dx, bp
not edx
add edx, 0x2b74024
xor edx, 0x257343ff
xor ebx, edx
cmc
add ebp, edx
jmp 0x9e7368
push ebp
mov bp, cx
pushfd
movsx ecx, cx
jmp 0xbe0d23
push edi
mov ebp, 0x75131254
movsx ecx, cx
push edx
mov ecx, 0
cbw
mov dh, dl
jmp 0xa9b180
push ecx
jmp 0xb5336f
push esi
lahf
jmp 0xcc215c