joyce8/EMBER2024-capa huggingface dataset:
Function at 0x891469
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x891392
mov cx, word [esp]
mov eax, 0xfc88963a
jmp 0x8913c2
lea eax, [edx + ebp]
stc
jo 0x89135c
mov cx, word [esp]
jmp 0x8913d8
lea ecx, [esi + 0x50]
jmp 0x89149f
mov eax, 0xfc88963a
call fcn.00891404
invalid
cmp edi, ecx
call fcn.00891a2c
movsd dword es:[edi], dword [esi]
stc
jl 0x891488
xchg dh, al
jmp 0x8914c1
xchg dh, al
cmc
lea eax, [esi*4]
lea edx, [ecx*4]
jmp 0x8914ab
mov ah, byte [esp]
and eax, 0xc38b03c0
jge 0x891461
jl 0x891461
bsr eax, ebp
jmp 0x8914ef
cmc
lea eax, [esi*4]
lea edx, [ecx*4]
bsr eax, ebp
jmp 0x8914ef
mov al, cl
lea edx, [esp + edx]
neg dx
jl 0x8914fd
jge 0x891580
sbb bl, byte [ebp + 0x13a7540d]
insb byte es:[edi], dx
jg 0x891534
inc esi
int1
add cl, bl
xchg dx, ax
mov al, byte [esp]
xchg dl, ah
mov dx, bp
jmp 0x8914d5
mov dl, 0x82
neg dx
mov edx, dword [esp]
call fcn.00891541
clc
jb 0x8914ed
xchg dword [edx - 0x3a], esi
ljmp 0x244c
invalid
dec esp
invalid
setle dl
mov dl, 0x45
jmp 0x891559
jmp 0x89168a
not al
not dx
xchg dl, dh
add dl, cl
js 0x891543
sub esp, 0x17
add edx, 0xd5ca3dc0
lea esp, [esp + 3]
jmp 0x8915a9
mov dl, 0x82
neg dx
mov edx, dword [esp]
jmp 0x891505
sub esp, 0x1c
mov edx, ecx
jmp 0x8915d9
lea esp, [esp + 0x14]
not al
mov edx, dword [esp]
mov dx, 0x28ca
add dx, ax
jmp 0x891621
jmp 0x8915f8
mov dh, 0x59
jmp 0x8915fc
jmp 0x891647
rol al, 0
mov dx, 0x4ce3
mov edx, ebp
mov dx, 0xef8f
add edx, 0x5aba162b
jo 0x8915bb
mov dh, ch
jmp 0x8915bd
mov dh, ch
mov dh, 0x59
rol al, 0
mov dl, al
inc dx
jnp 0x8915c1
mov dx, word [esp]
btr edx, eax
bswap edx
jmp 0x891631
jb 0x89158d
sub esp, 0x1c
mov edx, ecx
jmp 0x891592
add bl, al
jns 0x891668
pushfd
jmp 0x891652
mov dx, word [esp]
btr edx, eax
bswap edx
jmp 0x891631
btc dx, si
lea edx, [ecx + edx]
mov ax, 0x5542
jmp 0x891674
pushfd
btc dx, si
lea edx, [ecx + edx]
mov ax, 0x5542
jmp 0x891713
sub esp, 0x17
add edx, 0xd5ca3dc0
lea esp, [esp + 3]
jmp 0x8915a9
bsr ax, sp
call fcn.0089169c
rdtsc
jmp 0x891737
jmp 0x891721
jmp 0x89177b
inc ebp
rdtsc
sub esp, 6
jne 0x8916b2
bsr ax, sp
jmp 0x8916b6
lea eax, [edx + edi]
mov eax, dword [esp]
btr edx, ecx
call fcn.008923aa
ret 0x684
dec cl
mov dx, word [esp]
mov ah, byte [esp]
neg al
jg 0x8916ef
lea eax, [edx + edi]
mov eax, dword [esp]
btr edx, ecx
lea eax, [ecx + ebp]
sub esp, 0x10
jmp 0x8916f7
lea esp, [esp + 2]
lea esp, [esp + 4]
neg cl
jmp 0x89179e
lea esp, [esp + 0x10]
xor cl, 0xfa
mov eax, esp
mov edx, 0x94be935f
mov ax, 0x1ae1
sub esp, 6
jmp 0x891796
jns 0x891759
lea esp, [esp + 2]
jmp 0x89175d
mov dl, 0xba
mov ah, al
call fcn.00891765
add eax, 0x67128864
jmp 0x8919a5
add eax, 0x9aefcb03
jmp 0x891919
mov dx, 0x22c5
jmp 0x891932
dec dx
jl 0x8918de
mov dx, 0x22c5
jmp 0x891932
lea edx, [esi + edi]
mov edx, dword [esp]
jmp 0x8917c6
invalid
setge dh
jmp 0x8918fe
pushal
call fcn.00891961
clc
jne 0x891907
invalid
mov eax, dword [eax - reloc.KERNEL32.dll_GetProcAddress]
bsf edx, ebx
jne 0x891914
setge dh
lea edx, [esi + edi]
mov edx, dword [esp]
jmp 0x8917c6
mov edx, 0xc17e9ace
jmp 0x8918f4

Function at 0x891541
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
add al, 0x41
mov dh, byte [esp]
jmp 0x89152b
Function at 0x89169c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8916d1
lea esp, [esp + 2]
mov ax, word [esp]
mov al, byte [esp]
shr dl, 0
jge 0x8916bb
jl 0x8916eb
sub eax, 0xb04126b0
jne 0x891717
cmp al, 0xf
xor ebx, ebp
dec eax
rdtsc
jmp 0x891737
in al, dx
push es
Function at 0x89292e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x9aefcb03
jmp 0x89260c
mov edx, dword [edx + reloc.KERNEL32.dll_GetProcAddress]
mov al, bh
not ax
clc
jmp 0x892622
mov ah, byte [esp]
btr eax, ecx
jno 0x892645
push ebx
jmp 0x89265d
jg 0x892686
lea eax, [esi + 0xb2]
jmp 0x89185c
push ebx
jmp 0x89265d
jmp 0x89262f
jmp 0x8926e8
mov esp, esi
lea eax, [eax + esi]
bswap eax
bsr ax, cx
jo 0x892647
sete ah
jmp 0x8926eb
lea eax, [esi + 0xb2]
jmp 0x89185c
sete ah
push edx
ret
mov word [esp + 1], si
mov cl, 0x40
rdtsc
adc eax, edi
jmp 0x89298a
clc
mov dx, 0x8dee
jmp 0x892974
lea ecx, [eax*4]
xchg cx, ax
rdtsc
push bx
mov cx, 0x486f
mov edx, ebp
rol dh, cl
jmp 0x8929b7
inc edi
bts ax, ax
jo 0x892953
lea ecx, [eax*4]
jmp 0x8929af
je 0x89294c
clc
mov dx, 0x8dee
jmp 0x892951
mov cx, 0x486f
jmp 0x892964
lea esp, [esp + 2]
jmp 0x8929c3
xchg cx, ax
rdtsc
push bx
jmp 0x892993
jb 0x892999
lea esp, [esp + 2]
jmp 0x8929c3
xor edi, 0x12324ab2
mov eax, dword [esp]
pushal
mov byte [esp + 8], ah
xchg ecx, edx
jmp 0x892a72
jl 0x8925e1
jge 0x8925e1
mov dx, bp
bsr eax, ebp
jmp 0x892a2b
bsf ax, dx
ja 0x8929e7
mov dx, bp
bsr eax, ebp
neg cx
mov cl, dh
lea eax, reloc.KERNEL32.dll_GetProcAddress
jmp 0x892a52
neg cx
mov cl, dh
lea eax, reloc.KERNEL32.dll_GetProcAddress
jmp 0x892a52
xchg edx, eax
xchg ecx, eax
bts cx, bx
btc eax, ecx
jmp 0x892b13
mov ecx, 0x53c1ef9e
rol edi, 0
stc
jl 0x892a38
jge 0x892a84
das
mov bh, 0x27
inc edx
mov cl, 0x7d
aaa
test al, 0x3e
pop ecx
test al, 0x1f
pop ebx
lds edx, [ebp + 0x3c]
iretd
mov ax, word [esp + 3]
bswap eax
pop eax
lea esp, [esp + 0x1c]
dec edi
jmp 0x8929fd
xchg edx, eax
xchg ecx, eax
bts cx, bx
call fcn.00892ac0
clc
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
scasb al, byte es:[edi]
mov word cs:[edx], es
xchg esp, eax
adc ebx, dword [ecx + reloc.KERNEL32.dll_GetProcAddress]
bswap eax
bsr eax, ebx
jmp 0x8929db
rol edi, 0
mov ch, 0xf8
rcl dl, 6
jg 0x892c36
jle 0x892c36
aaa
push ds
imul ecx, dword [edi], reloc.KERNEL32.dll_GetProcAddress
movzx edx, byte [edi]
lea eax, reloc.KERNEL32.dll_GetProcAddress
jmp 0x892ba0
add edi, dword [ebp]
mov ax, word [esp]
lea eax, [esp + edx]
jmp 0x892b2f
setno ah
call 0x892b55
setl al
mov ax, word [esp]
lea ecx, reloc.KERNEL32.dll_GetProcAddress
sub esp, 3
jmp 0x892bc0
neg ax
jg 0x892b6b
setno ah
jmp 0x892b6e
jmp 0x892bd5
lea esp, [esp + 3]
add dl, bl
bt eax, edi
jg 0x892baa
jle 0x892c0a
add cl, byte [ecx + 0x378b7819]
test al, 0xcb
mov cx, 0x3011
mov al, dl
mov ecx, edi
cmp ecx, 0x6e2320d
jne 0x892c10
mov cx, word [esp]
jmp 0x892c5b
mov cx, 0x3011
jmp 0x892bd9
jmp 0x892c57
jmp 0x892b45
mov cx, word [esp]
call fcn.00892c12
add al, 0xa7
lea ecx, [ebx*4]
neg cx
jge 0x892c9c
bswap ecx
jmp 0x892cc5
mov cl, byte [esp]
mov cl, bh
jmp 0x892cd0
bswap ecx
jmp 0x892c86
mov cl, byte [esp]
mov cl, bh
jmp 0x892cd0
xor al, 0x6e
pushal
call fcn.0089350e
inc ebx
salc
inc esp
and ebx, esi
sbb al, 0xdf
dec ebx
fstp xword [esi + 0x796ef44d]
mov ecx, 0xebe38fbc
retf 0xe38f
Function at 0x89d070
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0089d03d
bswap eax
jmp 0x89d092
mov ebp, dword [edi]
xchg ah, dh
sub esp, 3
ja 0x89d18a
jbe 0x89d0f6
or al, 0x90
push es
popal
nop
push ecx
xchg edx, eax
or eax, 0xd017e49d
cmp al, 0x9e
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
and dword [edi - 0x75], ebp
retf 0xf3fc
lea esp, [esp + 3]
jmp 0x89d18e
lea esp, [esp + 3]
add edi, 4
call fcn.0089d0d1

Function at 0x89d0d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx*4]
jmp 0x89d14a
mov al, byte [0xd8101ae3]
adc al, bl
jbe 0x89d0bb
ja 0x89d0df
je 0x89d0ce
or al, 0xff
dec esp
xchg edi, eax
lea eax, [ecx*4]
jmp 0x89d14a
push esi
bswap esi
call fcn.0089d115

Function at 0x89d115
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x752c7ac
call fcn.0089d130
mov al, byte es:[0x12a05136]
pop ebp
lodsb al, byte [esi]
mov edi, 0xf6303186
not al
push ebp
jmp 0x89d0ff
mov si, word [esp]
not al
push ebp
jmp 0x89d0ff

Function at 0x89d130
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, word [esp]
rdtsc
mov esi, eax
bts dx, dx
jmp 0x89d152
mov dx, sp
lea ecx, [eax + edx]
push edi
lea ebp, [eax + edi]
jmp 0x89d11a
jp 0x89d168
mov ah, 0xc5
xchg bp, ax
jmp 0x89d16d
mov ah, 0xc5
xchg bp, ax
jmp 0x89d1ba
xchg byte [esp + 0xe], ah
lea esp, [esp + 1]
jmp 0x89d196
mov ebp, dword [esp + 0x10]
lea esp, [esp + 0x14]
not dx
jmp 0x89d1d8
jmp 0x89d21d
sub esp, 0x11
jno 0x89d16f
xchg byte [esp + 0xe], ah
lea esp, [esp + 1]
mov ebp, dword [esp + 0x10]
lea esp, [esp + 0x14]
not dx
jmp 0x89d1d8
sbb eax, 0xc84d4862
rdtsc
mov si, word [esp]
add esp, 4
jo 0x89d1a3
jno 0x89d21d
ret
pop esi

Function at 0x8a05ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebp
jmp fcn.00890328
mov edx, 0x16c7930
jmp 0x89f796
pop edi
neg ah
jns 0x89f7f9
mov edx, 0x16c7930
jmp 0x89f796
add ebx, 0xeb3ba94f
jmp 0x8a0625
jmp 0x89f903
lea ebp, [eax + ebx]
mov cl, dh
jmp 0x8a0d9c
mov ebx, dword [ebx + reloc.KERNEL32.dll_GetProcAddress]
pushfd
jmp 0x8a061e
pushfd
pushfd
jmp 0x89fa18
mov cx, word [esp]
rcr ecx, 0x1e
jnp 0x8a0cac
jp 0x8a06f1
ja 0x8a0698
test eax, 0x74f870f
add byte [eax], al
sub esp, 8
xchg byte [esp + 2], cl
jmp 0x89fbb5
mov ch, byte [esp]
sbb ch, ah
mov cx, ax
jmp 0x8a06b1
stc
or byte [edi + 0x5c35a53b], bh
scasd eax, dword es:[edi]
insb byte es:[edi], dx
dec ebx
salc
inc esp
and ebx, esi
sbb eax, edi
outsb dx, byte [esi]
mov ch, byte [esp]
sbb ch, ah
mov cx, ax
call fcn.008a0683
pop ecx
stc
imul ecx, dword [eax], reloc.KERNEL32.dll_GetProcAddress
dec eax
das
fisubr dword [edi - 0x45]
xchg edx, eax
invalid
pushfd
out dx, eax
Function at 0x8a0863
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, esi
sbb dx, 0xe55d
jge 0x88ed4b
jl 0x88e696
lodsb al, byte [esi]
mov edi, 0xec81def6
rol byte [eax], 0
add byte [ebx - 0x2a1704], cl
invalid
mov edx, 0x65e3745d
rcl ah, 6
mov edx, 0x65e3745d
rcl ah, 6
cmc
sub esp, 0xa
bsf ax, si
lea esp, [esp + 8]
mov ebx, 0xafcee3ea
mov dx, 0xae72
jmp 0x8a08ba
mov al, 0x92
neg ecx
jmp 0x8a08a4
jmp 0x8a088c
pop edi
jmp 0x88d5a7
xchg edx, ebx
mov cx, si
pop ebx
bsr edx, esp
jne 0x8a08a2
mov al, 0x92
neg ecx
jmp 0x8a08a4

Function at 0x8a0ffd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 1]
jmp 0x8a0fd3
mov dword [esp], esp
btc eax, esp
jne 0x8a0faa
mov ax, word [esp + 1]
jmp 0x8a0fd3
lea esp, [esp + 4]
not dl
push ecx
neg eax
jmp 0x8a1015
mov word [esp + 1], cx
lea esp, [esp + 4]
not dl
jmp 0x8a0fff
jmp 0x8a0fc0
pushfd
mov al, 0x51
mov eax, dword [esp + 1]
mov byte [esp], bh
mov word [esp + 1], dx
jmp 0x8a108b
jp 0x8a0fe2
mov word [esp + 1], cx
jmp 0x8a0fe7
push si
mov ax, word [esp + 1]
lea eax, [edi*4]
add esp, 1
jae 0x8a103c
jb 0x8a106f
rcr byte [edx - 0x38], cl
scasd eax, dword es:[edi]
pop edx
cwde
cmp edx, dword [edx]
lea esp, [esp + 1]
jmp 0x8a10a1
sete al
rol dl, 0
lea eax, [edi*4]
mov eax, 0xcffc5733
mov al, dh
jmp 0x8a1052
Function at 0x8a1183
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp]
push dword [esp + 3]
jmp 0x8a11ad
jo 0x8a11c3
mov ax, cx
mov dh, byte [esp]
jmp 0x8a11ee
mov ax, cx
mov dh, byte [esp]
bsr dx, sp
mov edx, dword [esp]
mov dl, byte [esp]
lea edx, reloc.KERNEL32.dll_GetProcAddress
jmp 0x8a11fa
bsr dx, sp
mov edx, dword [esp]
mov dl, byte [esp]
jmp 0x8a11d3
dec cl
not al
mov dx, ax
xchg dl, dh
inc ah
jmp 0x8a1277
or dx, 0xb750
jg 0x8a1247
mov edx, dword [esp]
xchg edx, eax
mov dx, word [esp]
jmp 0x8a124d
mov dx, word [esp]
mov ax, word [esp]
call fcn.008a1284
int3
mov edx, dword [esp]
xchg edx, eax
jmp 0x8a122d
mov ax, word [esp]
jmp 0x8a12a4
neg cl
lea eax, [ecx + edx]
bt dx, di
je 0x8a12fd
mov eax, ebx
lea edx, [eax + ecx]
mov dh, al
pushfd
jmp 0x8a1311
jo 0x8a1382
mov edx, edi
jmp 0x8a1384
jmp 0x8a1253
mov eax, ebx
jmp 0x8a1305
lea edx, [eax + ecx]
mov dh, al
pushfd
jmp 0x8a1311
lea esp, [esp + 4]
xor cl, 0x9b
lea edx, [esi + ebp]
sub esp, 0x19
jmp 0x8a133e
jno 0x8a1354
xchg word [esp + 0xe], ax
xchg dword [esp + 4], eax
jmp 0x8a1368
xchg word [esp + 0xe], ax
xchg dword [esp + 4], eax
mov dx, word [esp + 7]
jmp 0x8a13ab
mov dx, word [esp + 7]
xchg dword [esp + 0xd], eax
mov eax, dword [esp + 0x13]
jmp 0x8a13b3
mov edx, edi
xor cl, 0xfa
xchg dh, dl
jmp 0x8a1207
lea esp, [esp + 0x18]
xor cl, 0x56
rdtsc
dec dl
jnp 0x8a13cf
jp 0x8a13b9
dec eax
rcl dword [ecx + 0x30], 0xc3
add ecx, ecx
inc edi
xlatb
mov dl, 0x41
lea edi, [edx + 0x55]
xchg dword [esp + 0xd], eax
mov eax, dword [esp + 0x13]
lea esp, [esp + 1]
jmp 0x8a138e
shl ax, cl
rdtsc
jmp 0x8a13d4
shl ax, cl
rdtsc
mov eax, ecx
setbe dl
jmp 0x8a13df
mov dl, al
shl dx, cl
jo 0x8a160a
lea edx, reloc.KERNEL32.dll_GetProcAddress
jmp 0x8a1611
lea edx, reloc.KERNEL32.dll_GetProcAddress
call fcn.008a1418
lea edx, [esp + edi]
inc edx
jb 0x8a1670
jae 0x8a1670
xor esi, dword [ebx + reloc.KERNEL32.dll_GetProcAddress]
sub esi, dword [edx + ebp + reloc.KERNEL32.dll_GetProcAddress]
pushal
mov edx, 0xcaf53af8
bswap edx
mov esp, esi
setp dl
jmp 0x8a1616
push eax
ret

Function at 0x8b39ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr ebx, 0x19
clc
jno 0x8b3bb8
cmc
push bp
jmp 0x8b3ad1
lea esp, [esp + 2]
jmp 0x8b3b47
cmc
push bp
lea esp, [esp + 2]
or ecx, ebx
pushfd
xor cl, byte [eax]
call fcn.008b3a2d
mov dword [ecx], eax
not dh
and dx, 0xfc17
jle 0x8b3b81
jg 0x8b3b6b
jg 0x8b3b5a
push 0x5b4cfa0f
mov dl, 0xad
inc dx
jmp 0x8b3b51
mov dh, cl
jmp 0x8a0e4b
mov dh, cl
jmp 0x8a0e4b
jmp 0x8b3b40

Function at 0x8ccec5
Capabilities:
Decompress data using aplib

Disassembly:
sub esp, 5
cmc
lea esp, [esp + 1]
jmp 0x8ccff3
mov esi, eax
lea esp, [esp + 4]
jmp 0x87fabf
lea esp, [esp + 8]
push esi
lea esi, [edi*4]
pushfd
bts esi, ebx
jmp 0x8ccf28
Function at 0x8cf0af
Capabilities:
Execute anti-debugging instructions

Disassembly:
test cx, cx
jne 0x8ce78a
push edi
jmp 0x8cf0ee
call fcn.008cf01d
mov cl, 0xb7
jmp 0x8cf10b
fnstsw word [edx - 0x66]
not ebx
mov bl, 0xe5
mov cl, 0xb7
jmp 0x8cf10b
call fcn.008cf0f5
sbb byte [ebx + 0x52], bh
int 0x82
in al, 9
add al, 0x62
mov ebx, 0x5ce3b116
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x8cf111
sub eax, edx
call fcn.008cf0af
xchg edx, ecx
bt ebx, ebp
jle 0x8cf0d6
les edi, [edi - 0x3e]
jg 0x8cf0d6
or dword [eax - reloc.KERNEL32.dll_GetProcAddress], ebp
or al, byte [edx]
jnp fcn.008cf0f5
jg 0x8cf0cb
popfd
in al, dx
inc esi
jno 0x8cf197
mov dword [esp], esp
lea esp, [esp + 4]
inc eax
inc eax
jmp 0x8cef9b
push di
sub esp, 0xc
mov dword [esp], esi
jmp 0x8cf1b9
add esp, 9
lea esp, [esp + 1]
xchg dword [esp + 0x20], ecx
clc
push edi
lea esp, [esp + 2]
jmp 0x8cf236
lea esp, [esp + 2]
push dword [esp + 0x20]
ret 0x24

Function at 0x8cf0f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], bl
add esp, 0
jmp 0x8cf3a8
xchg ebx, eax
call 0x8cf13c
jae 0x8cf136
jmp 0x8cf297
pop eax
rdtsc
sub esp, 0x1f
jmp 0x8cf184
jae 0x8cf1d5
mov word [esp + 4], cx
lea esp, [esp + 3]
jmp 0x8cf1de
mov word [esp + 4], cx
lea esp, [esp + 3]
call fcn.008cf1a7
pop word [esp + 0x12]
jmp 0x8cf21f
lea esp, [esp + 1]
jmp 0x8cf25a
xchg edx, ecx
call fcn.008cf209
push word [esp + 3]
jo 0x8cf279
push word [esp + 3]
mov dword [esp + 1], edx
jmp 0x8cf2b9
push word [esp + 3]
mov dword [esp + 1], edx
jmp 0x8cf2b9
jae 0x8cf143
pop eax
jmp 0x8cf144
jae 0x8cf135
jb 0x8cf135
mov ecx, 0xf5e5a10a
mov ecx, 0x5d9b92d9
rcr dh, 2
jmp 0x8cf3cc
jb 0x8cf3e7
jae 0x8cf3e7
rdtsc
push ax
lea esp, [esp + 2]
jmp 0x8cf409
xchg ecx, eax
lea eax, [edx + esi]
lea eax, [esp - 0x4d]
mov ah, 0x8f
jmp 0x8cf3d0
sub esp, 0
jbe 0x8cf4a7
mov dx, sp
jmp 0x8cf4aa
sub edi, 8
mov dword [edi], edx
mov dl, 0x28
mov edx, 0x65c58588
jmp 0x8cf3f3
mov dword [edi + 4], ecx
jmp 0x8cf442
sub esp, 5
jns 0x8cf47f
xchg word [esp + 2], dx
mov dh, 0xc6
mov byte [esp + 3], bh
jmp 0x8cf51f
lea edx, [ebp*4]
mov dx, sp
btr edx, edx
jbe 0x8cf439
ja 0x8cf439
mov byte [esp + 3], bh
lea esp, [esp + 1]
call fcn.008cf53c
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
mov byte [ebx - 0x7899120e], bl
push esp
and al, 2
xchg word [esp + 2], dx
mov dh, 0xc6
call fcn.008cf48d
cld
iretd
mov dx, sp
xchg ecx, eax
jmp 0x8cf458
lea esp, [esp + 1]
jmp 0x89cd07
Function at 0x8cf209
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
jg 0x8cf241
jle 0x8cf241
adc dword [eax + reloc.KERNEL32.dll_GetProcAddress], edx
or al, byte [edx]
xor al, 0x1b
inc esi
adc esp, dword [reloc.KERNEL32.dll_GetProcAddress]
and al, 1
mov dword [esi], ecx
call fcn.008cf277
loope 0x8cf26a
arpl word [edx + 0x40bba38], bx
bound eax, qword [ecx]
call 0xe582c44c
pop ss
jle fcn.008cf2a3
je 0x8cf290
add ecx, dword [ecx - reloc.KERNEL32.dll_GetProcAddress]
inc esi
call 0xec6a9483
jmp 0x8cf261
push word [esp + 3]
mov dword [esp + 1], edx
jmp 0x8cf2b9
sub al, 0x3f
push es
mov cl, 0x14
sub cl, byte [ebx]
add al, 0x62
daa
push cs
popfd
popfd
mov al, 0xb3
stosb byte es:[edi], al
lds esi, [edi + 0xf]
and dword [esi + reloc.KERNEL32.dll_GetProcAddress], 0xffffffe9
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
btr ecx, esp

Function at 0x8cf2a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
jg 0x8cf241
jle 0x8cf241
adc dword [eax + reloc.KERNEL32.dll_GetProcAddress], edx
or al, byte [edx]
xor al, 0x1b
inc esi
adc esp, dword [reloc.KERNEL32.dll_GetProcAddress]
and al, 1
mov dword [esi], ecx
call fcn.008cf277
loope 0x8cf26a
arpl word [edx + 0x40bba38], bx
bound eax, qword [ecx]
call 0xe582c44c
pop ss
jle fcn.008cf2a3
je 0x8cf290
add ecx, dword [ecx - reloc.KERNEL32.dll_GetProcAddress]
inc esi
call 0xec6a9483
jmp 0x8cf261
push word [esp + 3]
mov dword [esp + 1], edx
jmp 0x8cf2b9
sub al, 0x3f
push es
mov cl, 0x14
sub cl, byte [ebx]
add al, 0x62
daa
push cs
popfd
popfd
mov al, 0xb3
stosb byte es:[edi], al
lds esi, [edi + 0xf]
and dword [esi + reloc.KERNEL32.dll_GetProcAddress], 0xffffffe9
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
btr ecx, esp

Function at 0x8cf4ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8cf511
add esp, 3
bsr cx, si
mov dl, 0x7b
call 0x8cf4f6

Function at 0x8df6eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edi, edi
jmp 0x8df707
test ecx, ecx
je 0x8df4ca
bswap edi
jmp 0x8df6b7
lea esp, [esp + 4]
jmp 0x8df6cd
mov esi, eax
jmp 0x8df716
call int.0089af51
mov si, word [esp]
mov dl, byte [esp]
push esi
jmp 0x8df6f1
add esi, 0x7c
mov edx, dword [esi]
pop esi
jmp 0x8df736
mov esi, dword [eax + 0x78]
add esi, ecx
clc
jmp 0x8e0692
lea esp, [esp + 0x1c]
test edx, edx
call fcn.008df9c3
push word [esp + 2]
mov byte [esp + 1], bh
lea esp, [esp + 2]
jmp 0x8dfbae
mov eax, dword [ebp - 4]
lea esp, [esp + 4]
cmp dword [ebp - 8], eax
call fcn.008dfb86
mov ecx, dword [esi + 0x1c]
bsr edi, edx
rcr di, 2
mov edi, dword [esp]
jmp 0x8dfc0f
mov edi, ebp
jmp 0x8dfc1c
lea ecx, [ecx + eax*4]
lea edi, [eax*4]
push edi
jmp 0x8dfbf9
add edi, 8
mov eax, dword [edi]
pop edi
mov edi, edx
jmp 0x8e030e
mov edi, dword [eax + ecx]
call fcn.008dfe3a
pushal
push word [esp + 0x19]
sub esp, 0x18
push bp
xchg dword [esp + 0x3c], ebx
lea ebx, [ebx - 0x45]
call fcn.008e0380
ret
mov dword [ebp - 0x14], edx
sub esp, 0x1e
mov word [esp + 0xc], sp
mov word [esp + 0x15], bx
lea esp, [esp + 2]
jmp 0x8dfb63
Function at 0x8df7c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esi
jmp 0x8df7c9
add ebx, 0x10
mov edx, dword [ebx]
pop ebx
jmp 0x8df7fb
cmp eax, edx
lea esp, [esp + 4]

Function at 0x8df8ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword fs:[0x18]
jmp 0x8e00a6
jmp 0x8dfde2
jmp 0x8e0092
jmp 0x8df972
add edi, ecx
lea esp, [esp + 8]
jmp 0x8df4e6
lea esp, [esp + 8]
lea eax, [edx + eax*4]
mov edi, dword [eax + ecx]
push esp
push dword [esp + 3]
jmp 0x8df8f3
mov eax, dword [ebp - 0x14]
jmp 0x8dfe07
cmp edi, esi
jb 0x8df5ef
mov ax, word [esp]
stc
jmp 0x8dfdcb
mov eax, 0xa8f05782
lea eax, [edx + ebx]
lea eax, [esp + edx]
mov ax, bx
jmp 0x8dfe13
add esi, eax
cmp edi, esi
jae 0x8df5ef
jb 0x8dfdf1
push 0x2e
mov eax, 0x54d9c196
setb ah
mov eax, edi
jmp 0x8e016e
mov ebx, eax
bsf cx, di
jmp 0x8dff24
pop ecx
jmp 0x8dfe9f
mov edx, edi
lea ecx, reloc.KERNEL32.dll_GetProcAddress
call fcn.0089af91
lea ecx, [ebp*4]
jmp 0x8dfe49
sub esi, edi
mov edx, dword [esp]
push esi
setg dl
jmp 0x8dfe5f
xchg edi, esp
lodsd eax, dword [esi]
and eax, 0x8237234a
scasd eax, dword es:[edi]
push 0x8d5d228b
test eax, ebp
invalid
lea eax, reloc.KERNEL32.dll_GetProcAddress
pushal
call 0x8dfe89
jge 0x8dfe92
fsubr qword [edi - 0x4e]
mov esi, 0x7dde014b
lodsb al, byte [esi]
mov edi, 0xf38b3186
mov esi, ebx
neg dx
not ch
mov ecx, ebx
jmp 0x8dfe7e
pop ecx
test ebx, ebx
je 0x8df4ca
jne 0x8dfeb9
lea esp, [esp + 0x20]
push ecx
call fcn.008dff54
lodsd eax, dword cs:[esi]
cmp eax, 0x3c07b744
setbe byte [ecx]
rol byte [ebx - 0x743e62f1], 0xc
and al, 0x8d
invalid
mov eax, edi
jmp 0x8e00bc
test edi, edi
je 0x8df4ca
mov ax, 0xc533
lea eax, reloc.KERNEL32.dll_GetProcAddress
jmp 0x8e007c
push ecx
jmp 0x8e0133
call 0x89afad
jmp 0x880f50
lea ebx, reloc.KERNEL32.dll_GetProcAddress
call fcn.008e00e1
mov ecx, eax
lea ecx, [ecx + 0x34]
push ebx
mov ebx, 0x6821035
jmp 0x8e00f8
call 0x89af8c
bsr cx, dx
xchg ecx, ebx
lea ebx, [eax - 0x86]
jmp 0x8dfe24

Function at 0x8df9c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
jmp 0x8df8a8
cmp esi, ecx
pushal
lea esp, [esp + 0x20]
jbe 0x8df4ca
mov al, ah
jmp 0x8df752
pushal
shl ecx, cl
lea ebx, [ebx + ebp]
mov esi, dword [esp]
mov dword [esp + 0x10], ebp
call fcn.008df81a
lea esp, [esp + 4]
je 0x8df4ca
jmp 0x8df768

Function at 0x8dfd91
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, ecx
lea esi, [eax + esi]
mov edi, dword [esi]
jmp 0x8dfd9f
pop esi
pushfd
add edi, eax
lea esp, [esp + 0x40]
jmp 0x8df4e6
sub esp, 0x1b
mov word [esp + 0xa], bx
lea esp, [esp + 3]
jmp 0x8dfd91

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x2dc3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02dc378f
jae 0x2dc370e
xor ecx, ecx
call fcn.02dc378f
jae 0x2dc373d
xor eax, eax
call fcn.02dc378f
jae 0x2dc374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02dc378f
adc al, al
jae 0x2dc372f
jne 0x2dc3779
stosb byte es:[edi], al
jmp 0x2dc3711
call fcn.02dc379b
sub ecx, ebx
jne 0x2dc3756
call fcn.02dc3799
jmp 0x2dc3775
lodsb al, byte [esi]
shr eax, 1
je 0x2dc3783
adc ecx, ecx
jmp 0x2dc3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02dc3799
cmp eax, 0x7d00
jae 0x2dc3772
cmp ah, 5
jae 0x2dc3773
cmp eax, 0x7f
ja 0x2dc3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2dc3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40e791
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x41279f
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x1000122e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x100012b6
lea ecx, [ebp + 8]
push 0
push ecx
lea ecx, [esi + 4]
push 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100012b6
xor eax, eax
cmp dword [ebp + 8], 4
sete al
test eax, eax
je 0x100012b6
lea eax, [esi + 8]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
je 0x100012b6
lea eax, [esi + 0x10]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
je 0x100012b6
lea eax, [esi + 0x18]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
je 0x100012b6
lea eax, [esi + 0x20]
mov ecx, esi
push eax
call fcn.100013b8
test eax, eax
jne 0x100012ba
xor eax, eax
jmp 0x100012cb
mov ecx, esi
call fcn.1000134f
mov ecx, esi
call fcn.100012d0
push 1
pop eax
pop esi
pop ebp
ret 4