joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48dfc0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x48dff3
push esi
call fcn.00491120
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x48dfec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x48e079
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x48e062
mov eax, dword [esi + 8]
test eax, eax
je 0x48e017
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x48e05e
cmp eax, 2
je 0x48e062
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x48e00a
cmp eax, 3
je 0x48e03d
cmp eax, 1
jne 0x48e00a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x48e00a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x48e00a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0048e0a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x48e088
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0048e0a0
add esp, 4
pop esi
ret

Function at 0x49a160
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax

Function at 0x49a196
Capabilities:
Check for time delay via gettickcount

Disassembly:
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x49a1c6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x49a1c6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x49a1a7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x49a550
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x49a588
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x49b210
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x49b259
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x49b6d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ddba0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0049b280
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0049b300
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0049b300
lea ecx, [esi + 0xc]
call fcn.004ce706
lea ecx, [esi + 0x10]
call fcn.004ce706
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0049c890
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0049c890
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0049c890
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004ce77b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004ce77b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a01a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4de278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4a01e3
mov eax, dword [esi]
jmp 0x4a01e5
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x4a0206
push 0x615dd0
push edi
push eax
call fcn.004cb771
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x4a0266
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4a0266
mov eax, dword [esi]
test eax, eax
je 0x4a024d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x4a025d
push eax
call fcn.004ce4e5
add esp, 4
push esi
call fcn.004ce4e5
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc

Function at 0x4a5ef0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4a5f93
test eax, eax
jbe 0x4a5f93
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4a5f93
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4a5f3e
xor esi, esi
jmp 0x4a5f44
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4a5f6f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004aa4b0
add esi, eax
push esi
mov ebx, esi
call fcn.004aa4b0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4a5f50
pop ebp
test edi, edi
pop edi
jne 0x4a5f93
test ebx, ebx
je 0x4a5f93
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004bdcd0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4a60d5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4a61ed
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a61ed
mov eax, dword [esi + 0x3c]
push eax
call fcn.004d01a5
mov esi, eax
test esi, esi
je 0x4a61ed
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4a61ed
mov ecx, esi
call fcn.004a6040
cmp edi, eax
jge 0x4a61ed
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4a6173
mov dword [esp + 0x34], 1
jmp 0x4a61ce
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4a61ed
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004a48b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4d0b49
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d0b81
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004cebd6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004cebae
jmp 0x4d0b8d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d2237
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d2279
call fcn.004d7ff2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d2279
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d2270
xor eax, eax
jmp 0x4d2281
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d2287
pop edi
pop esi
pop ebx
ret 4
Function at 0x4d8522
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d8550
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d856e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d8488
jmp 0x4d856e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d856e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d8488
test edi, edi
mov eax, edi
jne 0x4d8558
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4df5f9
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
pop esi
jmp 0x4df613
add esi, 0xffffff73
jmp 0x4df633
cmp dword [esi], 0
clc
jae 0x4df65c
pop ebp
test eax, 0x4497282b
ret
je 0x4df823
jae 0x4df670
sbb dh, byte [ebx - 0x53]
pop esi
sahf
cwde
imul esp, ebx, 0x42311023
mov edi, esi
jmp 0x4df690
add esi, 4
jmp 0x4df6b9
mov edx, dword [esi]
jmp 0x4df6db
add edx, esi
clc
jmp 0x4df705
mov eax, dword [esi + 4]
jmp 0x4df734
sub dword [edx], 0xa3180d6c
jmp 0x4df761
add edx, 4
jmp 0x4df768
sub eax, 1
jmp 0x4df78b
jne 0x4df708
jmp 0x4df796
add esi, 8
jmp 0x4df7c5
in al, 0x98
sub eax, 0x54427690
pop es
mov dword [0x28f98335], eax
fnstcw word [ecx]
xor ch, byte [edx - 0x609836f8]
mov dl, 0x77
lcall 0x1c5, 0xe12c8e8d
leave
push 0x4d
sub dword [edi], 1
clc
jae 0x4df7f7
mov edx, 0xb18f3fd0
dec eax
call dword [edx]
daa
xor byte [ebp - 0x1814ffe2], ch
insb byte es:[edi], dx
lodsd eax, dword [esi]
push ds
add bl, ch
out 0x6c, eax
adc bh, byte fs:[eax + 0x637e6666]
fucom st(3)
mov byte [0x1eadfa5c], al
cwde
ja 0x4df7d5
xchg edx, eax
push es
push cs
mov dh, 0xb0
pop esi
xor dl, byte [eax]
xchg esi, eax
sbb esi, edi
jne 0x4df693
jae 0x4df80a
imul eax, ebx, 0xffffffe6
push 0xffffffffffffffc5
jmp 0x4df80c
mov ebx, esi
stc
jb 0x4df81e
jecxz 0x4df7a3
mov ch, 0xaa
loop 0x4df87a
or byte [ebp + 0x5bf29de3], cl
adc edi, dword [edi + 0x32]
call fcn.004df85a
jmp 0x4df841
popal
stc
jmp 0x4df855
jmp fcn.004bc5b7
or eax, 0x74c08500
push cs
add eax, ebx
push ebx
push eax
push eax
call fcn.004df8de
add esp, 8
pop ebx
pop eax
mov esi, ebx
sub esi, 0x400000
je 0x4df8dd
mov edx, dword [eax + 4]
add edx, ebx
mov ecx, dword [eax + 8]
cmp ecx, 0
jle 0x4df8dd
mov eax, dword [edx]
add eax, ebx
mov edi, dword [edx + 4]
sub ecx, edi
push ecx
sub edi, 8
shr edi, 1
add edx, 8
xor ecx, ecx
cmp edi, 0
je 0x4df8da
mov cx, word [edx]
add edx, 2
test ecx, 0xf000
je 0x4df8d7
and ecx, 0xfff
add ecx, eax
add dword [ecx], esi
dec edi
jmp 0x4df8ba
pop ecx
jmp 0x4df8a1
ret
Function at 0x708791
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x28], edx
mov dword [esp + 4], esi
jmp 0x7fa735

Function at 0x792fb0
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7a38e9
mov byte [esp + 0x10], ch
lea esp, [esp + 0x44]
call fcn.0092b911
btc di, sp
stc
shrd di, cx, 1
mov edi, eax
bt ebp, 0x15
bt edx, ebx
cmp al, 0x36
mov dword [ebp - 4], edi
push 0x760d0830
test ebx, 0xffff0000
mov byte [esp], bl
pushfd
pushfd
jmp 0x88ebee
lea esp, [esp + 0xc]
je 0x857e36
pushfd
call 0x95ed63
Function at 0x79d7f4
Capabilities:
Encode data using xor

Disassembly:
dec esi
ljmp 0x3024
xchg dword [esp + 0x30], esi
xchg dword [esp + 0x30], esi
bswap esi
xor byte [edi], cl
into
mov dword [esp + 4], eax
movsx si, dl
pushfd
mov esi, 0x409f2a
push dword [esp + 4]
push 0xa522ecfa
mov esi, dword [esi + 0x109747]
inc eax
add bh, bh
je 0x79d82f
add al, 0x68
cli
in al, dx
and ah, byte [ebp - 0x68b84975]
adc byte [eax], al
call fcn.008e977c
das
jbe 0x79d7f7
mov dword [0xd8bd89c7], eax
jle 0x79d84b
xor eax, 0xe59592dc
fsubr qword [edx + 0x16]
dec esp
wait
mov bh, 0x62
or al, 0xa4
sal byte [edi], cl
out dx, eax
outsd dx, dword [esi]
invalid
xor ebx, dword [ebx - 0xd]
inc ebx
and eax, esi
jp 0x79d86e
dec esi
stosd dword es:[edi], eax
aas
popal
and dword [eax + 0x2a], ebx
sub eax, 0xa5e84d51
scasb al, byte es:[edi]
jo 0x79d7f0
dec ebp
call 0x9fea86f6
mov edi, 0x52fa90b9
aam 0xae
add dh, byte [eax - 0x6b]
xchg ebp, eax
jge 0x79d85a
std
sbb byte [esi + edx*8 - 0x6a169674], ah
inc esp
clc
push cs
push ds
fnstcw word [ecx]
mov eax, 0xb3c7c447
sbb eax, dword [ebx]
ja 0x79d806
invalid
pushal
push ss
mov esi, 0x65e55f21
jnp 0x79d85c
mov al, byte [0xb0e7eb36]
pop edx
sub dword [0xd7870660], ebp
xor bl, byte [ebx + 0x4e283edb]
out 0x5e, al
push edx
adc byte [eax + 0x57160229], bh
jno 0x79d883
lcall 0xe6fd, 0xc3caebd7
pop es
je 0x79d83a
in eax, 0
outsd dx, dword [esi]
or al, 0x25
pop edx
and al, 0x84
int 0xb2
shl byte [0xee82c363], 0xc
cmpsd dword [esi], dword es:[edi]
fisttp dword [edx]
adc bh, byte [ebx - 5]
pop ebx
cmpsb byte [esi], byte es:[edi]
pop edx
mov eax, dword [0x9ef48576]
jae 0x79d8cc
out 0x60, al
and ah, byte [eax + ecx + 3]
or byte fs:[ebx], al
pop esp
adc byte [esi + eax*8 - 0x8890762], 0x77
xchg esi, eax
dec ecx
imul esp, dword [ecx + 1], 0xffffffe4
dec esi
sub al, 0xc9
insd dword es:[edi], dx
sub dword [ecx - 0x54], ecx
cmpsb byte [esi], byte es:[edi]
fsub dword [ebp + ecx*2 - 0x71]
sbb dword [edi - 0x40], eax
xor ah, bh
mov ah, 0xd0
mov dword [0x75ed52b3], eax
xchg esp, eax
and esi, dword [ebx]
salc
push 0x44
sub al, byte [edx - 0x4727017c]
add al, 0x8a
salc
inc edx
mov ds, word [ecx + edx*4 + 0x68353d7e]
out dx, al
inc esi
test al, 0xd6
xor ecx, dword [edi - 0x58ed0889]
sbb eax, 0xe77c2ca3
wait
cmp bh, bh
pop esi
and eax, 0x2dcc8ec7
mov ah, 0xc2
mov cl, 0xc1
fisttp word [ebx - 0xb7decb9]
push ebp
sbb eax, 0xcc64e6b5
mul byte [ecx + eax*4 + 0x3d]
adc dword gs:[ecx + 0x7b4cdcd8], edi
xlatb
out dx, al
nop
outsb dx, byte [esi]
xchg esp, eax
jae 0x79d9bf
aas
xchg esp, eax
mov ebx, 0x69c181ba
inc esi
or dword [edx - 0x4ca1ff0f], ecx
cmpsd dword [esi], dword es:[edi]
or eax, 0x60e19da5
lea ebx, [ebx]
push edi
mov bh, 0x5f
cmp ebp, dword [esi + 0x40]
xor dl, bl
call 0xab87c796
retf
mov ecx, 0x6d376179
jle 0x79d9dc
xor cl, 0xc8
mov esi, 0x2129f22e
mov dword [ecx + 0x356d61f5], ecx
cmpsb byte [esi], byte es:[edi]
fdivrp st(2)
test dword [esi], ebp
dec esp
pushal
sbb eax, 0xe7874433
xor eax, dword [edi + eax*4 - 0x19]
cli
daa
push edi
mov edx, 0x9e7bdfa2
popal
mov esp, 0x61427a17
sbb eax, 0x7a3b4139
clc
sbb eax, 0xc0c868fe
aad 0x99
jl 0x79d9f3
mov byte [edx + 1], ah
inc ebx
or ecx, edx
pop ebp
add al, 0xb
push esi
xor al, 0x32
invalid
Function at 0x7ca04c
Capabilities:
Encode data using xor

Disassembly:
pushal
bswap bx
setbe bh
lea esp, [esp + 0x20]
jbe 0x876ee8
nop
movzx bx, bl
setle bl
pop ebx
jae 0x95127f
pushfd
pushal
xchg dword [esp + 0x24], ebx
mov byte [esp + 4], 0xd0
mov dword [esp + 0x20], ebx
mov bl, cl
mov bl, byte [esp + 4]
pop ebx
seta bl
mov ebx, 0x424b41
push dword [esp + 4]
jmp 0x88cb23
jmp fcn.0070ce52
push 0x92392890
pushfd
mov ebx, dword [ebx + 0xc0800]
call fcn.008d35d4

Function at 0x7d5fbd
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x34], edi
jmp 0x7ca814

Function at 0x85bf0f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8db407
xchg dword [esp + 0x10], esi
mov dword [esp], 0xa9e668ee
pushfd
call fcn.007f2cc0

Function at 0x865f29
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
pushfd
not ecx
test ah, 0x88
clc
call 0x94ed21
cwde
ror dword [ebp + 0x451d630b], 0xd0
jbe 0x865f1c
insb byte es:[edi], dx
pop ss
inc edi
imul ecx, dword [0xcd85db9b], 0xe46af658
fdivr qword [edx - 0x3991f3ee]
jp 0x865f93
pop esi
mul byte [eax]
invalid
xor dword [ecx - 0x54], ecx
or byte [esi - 0x6739f35c], dh
or al, 0xc6
cwde
out dx, eax
sub eax, 0x971165d1
adc dword [edi - 0x51433639], ebp
jns 0x865f8d
inc ebp
cmp eax, 0x41a4b695
mov eax, dword [0x56882cc9]
xor al, 0x9c
push esi
or byte [edi], ah
xchg edi, eax
salc
push eax
and byte [0x372c1b2e], cl
xor al, 0x49
xchg esp, eax
fidivr dword [ebx]
fistp word [ecx + 0x31395f1d]
xchg ecx, eax
enter 0xffffffffffffa5c5, 0x40
sbb ah, 0x1e
cli
pop eax
mov ah, 0x74
push ss
jl 0x86603e
add byte [esi - 0x45], bl
stosd dword es:[edi], eax
dec ebp
test dword [ecx], 0xb34ee688
cmp byte [esi - 2], dl
cmp byte [edx], ch
pop ds
xor dword [edi], ebx
xor al, 0xd8
adc al, 0xce
invalid
arpl word [ebx], ax
stosd dword es:[edi], eax
mov dword [0xf39dc9c7], eax
imul esp, dword [edi - 0x36bfc54d], 0xffffff89
insb byte es:[edi], dx
adc esp, esi
inc eax
leave
mov dword [ebp + 0x11], ebp
hlt
xor al, 0x9c
cmp byte [esi - 0x4f518b24], dl
popfd
cmc
arpl word [edi], si
out 0xe1, eax
mov bh, 0x48
mov esi, dword [ebp - 0x6e453a4e]
leave
popal
sub dword fs:[eax + 0x67cf97f9], eax
xchg edx, eax
stosd dword es:[edi], eax
mov bl, 0x1b
or cl, byte [ebx + ecx - 0x6b]
inc ebp
and byte [edx - 0x21], al
dec ebx
inc edi
movsd dword es:[edi], dword [esi]
mov ch, 0x50
xlatb
jecxz 0x8660a0
sahf
fdiv dword [0xe500522d]
sbb eax, 0x68d0a41
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
invalid
les esp, [edx - 0x30501cb9]
or cl, dh
or al, ch
jge 0x866051
mov esi, 0x91f4838a
push esp
dec dword [ebx - 0xa]
xchg esp, eax
cmp al, 0x51
cdq
leave
sub al, 0xe6
js 0x86604a
and byte [ebp + 0x79fe99db], dl
lcall 0x2121, 0x913941a8
invalid

Function at 0x88e2e5
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0xc], ecx
and al, 0xc
call fcn.007cdd69
imul esp, edi, 0xffffffb1
mov ecx, 0x5c0eb797
jae 0x88e2cc
shr byte [eax + 0x7cf6aaa0], cl
das
xor ebp, dword [0x76e29825]
les ebp, [esi + esi*4 - 0x4c]
push ecx
in eax, dx
insd dword es:[edi], dx
std
push ebp
test ecx, ecx
popal
fld st(7)
xchg ebx, eax
jbe 0x88e2e7
mov byte [0xb8a50945], al
retf
Function at 0x894e45
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov byte [esp], ch
xchg dword [esp + 0x38], eax
call fcn.007d98b6
inc eax
stc
clc
call fcn.007ab03d
sbb edi, dword [eax]
sbb al, byte [esi + 0xc]
invalid

Function at 0x89576e
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
js 0x9581b8
xchg dword [esp], eax
jmp 0x8c0d0e
movsx ax, bl
movzx ax, dl
pop eax
push ebx
xchg dword [esp + 4], eax
pushal
pushfd
mov dword [esp + 0x24], eax
call 0x94cc36
mov edi, dword [esp + 0xc]
jmp 0x896d35
pushfd
cwde
movzx ax, bl
nop
lea eax, [ebp - 0x67f6c4ac]
lea esp, [esp + 4]
jo 0x889b53
sete al
pop eax
pushal
push dword [esp]
jmp 0x7d8ba1
pushal
push 0x2e4a358a
lea edi, [edi + 1]
jmp 0x8962c7
call 0x9462cb
push dword [esp + 8]
popfd
pushfd
pushfd
push dword [esp + 0x14]
ret 0x18

Function at 0x8c3b80
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], al
xchg dword [esp + 8], edi
bswap edi
movzx di, bl
mov edi, dword [esp + 0xc]
call fcn.00878fb9

Function at 0x8c3b96
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
pushal
lea ecx, [ecx + 1]
call fcn.0088a17b
mov byte [esp], ch
xchg dword [esp + 0x60], eax
mov byte [esp + 0x1c], ah
push dword [esp + 0x60]
ret 0x64
lea esp, [esp + 0x48]
jle 0x87f5b7
push 0x27eb0743
lea ecx, [ecx + 1]
mov byte [esp], ch
mov byte [esp], 0x82
mov dword [esp + 8], ecx
lea ecx, [edx - 0x242be33]
movsx ecx, dl
pushal
call fcn.0087c821

Function at 0x8c4951
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov word [esp + 0xc], bx
mov ebp, dword [ebp + 0x130fa4]
pushfd
call fcn.0091883a
xchg edi, eax
xlatb
jae 0x89cbb2
or bh, dh
outsd dx, dword [esi]
mov bh, byte [edx - 0x1d]
xchg ecx, eax
bound edi, qword [esi + 0xb]
outsd dx, dword [esi]
xor byte ds:[edi - 0x7624e51], ah
jle 0x89cb46
hlt
insb byte es:[edi], dx
out 0x4e, al
fdiv qword [edx]
push ebx
mov al, 0x30
pop ds
pop edi
das
sbb edi, 0x3d
sub eax, 0x1a886df1
sub al, 0x6c
push ds
mov dh, 0xa
invalid
push esp
nop
push ecx
pushal
xchg dword [esp + 0x24], ebp
mov dword [esp], 0x376ee485
movzx bp, al
pushfd
mov ebp, 0x4149da
mov byte [esp], bl
jmp 0x89cb2a

Function at 0x8d2612
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jne 0x7c7c4b
rdtsc
rdtsc
not dx
movzx dx, al
movzx edx, word [edi + 8]
not al
movsx cx, al
xchg ah, ch
setg ah
mov eax, dword [edi + 4]
bswap cx
mov cx, 0x1daa
mov ecx, dword [edi]
call fcn.00876ac0

Function at 0x8ee0a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lahf
call fcn.00927f87
not ax
cwde
movzx edi, dl
jnp 0x85bedf
nop
setnp al
jne 0x8a8f94
xchg di, ax
lea edi, [esi - 0x5891c300]
pop eax
pushfd
xchg dword [esp + 4], eax
bswap di
xchg dword [esp], eax
mov eax, 0x3b759e7a
lea eax, [edi + 0x652e4e92]
mov eax, 0x410115
call fcn.009113a9
out 0x47, eax
add esp, dword [ebp + 0x2acf87d1]
hlt

Function at 0x911cbf
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.007a1fb4
push ebx
xchg dword [esp + 0x30], edx
pushfd
lea esp, [esp + 0x34]
jne 0x7d3633
pushfd
xchg dword [esp], edx
push 0x42a0757a
bswap edx
movzx dx, dl
mov edx, 0x408197
call 0x956777
Function at 0x919af0
Capabilities:
Encode data using xor

Disassembly:
mov ax, si
setbe al
mov ah, 0x5a
not ah
mov eax, dword [esi + 0x2c]
push 0x6440175e
push dword [esp]
pushfd
mov dword [esp + 8], eax
push 0xb8966b6d
jmp 0x9533a8
mov byte [esp], ch
lea esp, [esp + 8]
je 0x88faa3
pushfd
pop edx
mov eax, dword [ecx]
pushal
movsx edx, bl
not dl
mov edx, dword [eax]
pushal
call fcn.007a6cfe
cmp ch, 0x81
pop ss
pop ebx
cmc
push ecx
mov ah, 0xa6
aam 0x8e
jge 0x919b1d
pop ss
test dword [esi + 0x61aebcd4], 0xaafe7c01
enter 0xffffffffffffd39b, 0xffffffffffffff85
leave
xlatb
lahf
leave
mov dword [eax - 0x6cd2c622], edx
jmp 0x919b7b
rol byte [ecx - 0xc], cl
push edx
mov bl, 0x6c
push cs
test byte [eax - 0x57], 0xcb
rol dword [ebp + 0x37239fc3], 0xb3
mov esp, dword [edi]
dec ebp
loope 0x919ba9
popal
cmc
pop ecx
aas
or ebp, edx
sbb eax, 0x25259931
and eax, 0xc5a055c0
push ebp
outsd dx, dword [esi]
dec eax
aaa
mov eax, 0x98f55ee3
into
jp 0x919b49
and dword [eax - 0x1b], ebp
inc ecx
jmp 0xd52bfd46
invalid