joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001fb30
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push ecx
push esi
call fcn.1001f620
lea edi, [eax*4]
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0xc], eax
test edi, edi
jle 0x1001fba5
lea edx, [esi + edi*4 + 8]
lea ecx, [esi + 8]
push ebp
mov eax, dword [edx - 8]
mov ebp, dword [ecx - 8]
mov dword [ecx - 8], eax
mov dword [edx - 8], ebp
mov ebp, dword [edx - 4]
mov eax, dword [ecx - 4]
mov dword [ecx - 4], ebp
mov ebp, dword [edx]
mov dword [edx - 4], eax
mov eax, dword [ecx]
mov dword [ecx], ebp
mov ebp, dword [edx + 4]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 4], ebp
mov dword [edx + 4], eax
add ebx, 4
sub edi, 4
add ecx, 0x10
sub edx, 0x10
cmp ebx, edi
jl 0x1001fb64
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, 1
jle 0x1001fd60
lea edx, [eax - 1]
mov ecx, dword [esi + 0x10]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + str.ccccwwww]
add esi, 0x10
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x1003c450]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003cc50]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003c850]
movzx ebx, byte [esi + 5]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x1003d050]
mov ecx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x1003c450]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003cc50]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003c850]
movzx ebx, byte [esi + 9]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x1003d050]
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x1003c450]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003cc50]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003c850]
movzx ebx, byte [esi + 0xd]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x1003d050]
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x1003c450]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003cc50]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x1003c850]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x1003d050]
sub edx, 1
mov dword [esi + 0xc], edi
jne 0x1001fbb1
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10094376
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 8]
je 0x100a27cb
jmp 0x10094629
bt ax, 5
cmp eax, 0xd
push 0xa01429d4
mov byte [esp], 0x61
lea esp, [esp + 4]
je 0x100a27cb
clc
cmp ah, bh
pushal
cmp eax, 0x23
pushfd
call fcn.100a0f32

Function at 0x10094399
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esp + 0x58], 0xcdcdcdcd
jmp 0x100957a2
mov byte [esp], ah
lea esp, [esp + 4]
je fcn.100a2b88
cmp dx, bp
stc
push edi
add al, 0x8d
mov al, byte [esp + 0x5c]
cmc
jmp fcn.100a1da4

Function at 0x1009594b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushal
lea esp, [esp + 0x28]
je 0x100a27cb
call fcn.100af910

Function at 0x100966bb
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov word [esp], di
lea esp, [esp + 0x4c]
jle 0x1009a5d2
pushal
lea esp, [esp + 0x20]
call fcn.10013010
cwde
and cl, dl
or cl, ch
neg ch
mov eax, dword [ebp + 0x2c]
shl cx, cl
ror cx, 0xb
movzx ecx, word [eax]
bt cx, cx
pushal
mov eax, dword [eax]
cmc
cmp cl, 0x27
test ax, 0x3c20
add esp, 0x2c
push ebx
test sp, cx
jmp loc.100a1645

Function at 0x10096e16
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bh
pushal
add esp, 0x34
pushfd
pushfd
pushal
jmp loc.100b0027

Function at 0x10099098
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x48]
jne 0x1009fa52
call fcn.1009c602
Function at 0x1009abcc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp eax, 0x23
pushfd
lea esp, [esp + 8]
jne 0x1009fa52
mov eax, ebx
pushfd
lahf
push eax
mov eax, dword [esi + 0x17c]
bswap dx
mov dword [esp + 4], 0x7e1cd7b2
push esi
mov edx, dword [esi + 0xd8]
call fcn.1009fc16
cmc
test bh, bh
pushal
cmp al, cl
cmp eax, 0x24
pushfd
jmp 0x100ae73a
jmp 0x100a485c
setnp cl
mov ecx, dword [ebp + 0x2c]
setnp al
mov eax, dword [ecx]
stc
pushfd
bt esi, 0xf
cmp eax, 0xffffff27
mov byte [esp], al
add al, 0x24
pushfd
push dword [esp]
call fcn.10094f09
jno 0x100a27f3
invalid
push 0x4a9f098a
pushfd
mov byte [esp + 4], 0xf0
lea esp, [esp + 8]
jne 0x100a6784
pushfd
mov dword [esp], ebx
push esp
pushal
pushfd
mov dword [esp + 0x24], ebx
push 0xd05fde50
lea esp, [esp + 0x28]
jmp 0x100aede5
mov byte [esp], 0xbd
lea esp, [esp + 0x20]
jne 0x100adf4e
lahf
pushal
setne ah
mov ecx, dword [esi + 0xd8]
lahf
lea eax, [edi + 1]
push dword [esp + 0xc]
push ecx
push dword [esp + 4]
mov dword [esp + 0x28], eax
call fcn.100b3f1c
pushal
cmp eax, 0x27
jmp 0x100a524b
pushfd
stc
mov byte [esp], ah
cmp eax, 0x25
push 0x4430c981
mov byte [esp], bl
push ebx
lea esp, [esp + 0xc]
jne 0x100a27dc
pushal
lahf
mov eax, dword [ebp + 0x1c]
setle dl
push dword [esp + 0x10]
mov edx, 0x985f2709
lea edx, [eax - 1]
mov byte [esp + 0xc], 0xbd
mov dword [esp], 0x9840c44e
call fcn.1009d57d
lea esp, [esp + 0x24]
ja 0x100a03ee
jne 0x100a6784
pushal
pushfd
mov dword [esp + 0x20], ebx
mov word [esp + 8], 0xbf45
mov word [esp + 4], 0x5ff6
mov byte [esp], dh
mov dword [esp + 0x1c], ebx
pushfd
pushal
push 0xad6d7056
push 0x77c88150
lea esp, [esp + 0x48]
jmp 0x100aede5
lea eax, [esi + 0x2c531ff2]
push 0xd017e85b
cwde
push ebp
mov eax, dword [esi + 0xd8]
call fcn.100ab19e

Function at 0x1009d0d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x764e656b
pushal
lea esp, [esp + 0x2c]
jne fcn.100a2b88
push ecx
pushal
mov word [esp + 4], bp
mov dword [esp + 0x20], eax
push ebx
pushfd
jmp 0x1009fd3a
mov dword [esp], ebx
mov dword [esp + 0x24], str.IOCTL_MATRIXCD_READ_dwRelen_is__d___n
pushal
lea esp, [esp + 0x44]
call fcn.10013010
rol dh, cl
pushal
sub eax, eax
rcr dh, cl
bsf edx, edx
inc dx
mov dword [esp + 0x54], eax
rcr dh, cl
not dl
cmc
neg dh
mov dword [esp + 0x58], eax
movzx dx, cl
jmp 0x100a7698

Function at 0x1009dcb7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
bt dx, si
cmp eax, dword [esi + 0x17c]
mov word [esp + 8], cx
lea esp, [esp + 0x18]
jb 0x100a4a60
pushfd
pushfd
push 0xc59fe480
pushfd
lea esp, [esp + 0x10]
jmp fcn.100a9acb
cmc
dec dx
movzx dx, byte [0x1004b5d8]
cmp bh, 5
test dx, 0x3593
call fcn.100a11dc
jnp 0x100a0276
neg dh
dec dl
shl dh, 4
movzx dx, byte [0x1004b5d8]
clc
call fcn.100b240e
lea esp, [esp + 8]
jb 0x100aa31e
call fcn.10094399
mov word [esp + 4], si
jmp 0x10093ac9
stc
push 0xd51d4cfb
stc
xor byte [esp + eax + 0x50], 0x9b
pushfd
call fcn.1009ae3d
Function at 0x1009f4e0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x44]
je 0x100a27cb
cmc
call fcn.100a0337
add byte [eax], al
jno 0x1009abab
mov eax, dword [0x610dfdc1]
mov dword [ecx - 0x222e565b], ecx
jecxz 0x1009abab
rol esp, 0x87
sbb eax, 0x958785f9
sbb ecx, dword [0x49fcfaaf]
scasb al, byte es:[di]
and byte [edx - 0x1e4cc77a], ah
and ecx, dword [0x4d2f2513]
arpl word [ebp + 0x4923ddc3], dx
push cs
push ebp
imul eax, dword [ecx - 0xd], 0xffffffcf
or dword [ecx], edx
inc edi
rol byte [esi + 0x69], 1
ror dh, cl
adc eax, dword [edi]
inc edi
xor edx, dword [edi + 0x57]
jae 0x1009ab42
pop ds
jmp dword [ebx]
invalid
pushal
lea esp, [esp + 0x28]
jne 0x100af294
cmc
jmp 0x100aef35
mov byte [esp], 0x99
cmp eax, 8
jmp 0x1009e784
pushal
cmp dword [ebp + 0x14], ebx
push 0x19b764e6
pushal
jmp 0x1009ab34

Function at 0x100a07fc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [ebp + 0x24], ecx
stc
cmp eax, 8
push edx
lea esp, [esp + 8]
jne 0x100af294
cmp al, 0x5a
jmp 0x100b3a8e

Function at 0x100a08a2
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x50]
je 0x100a27cb
pushal
jmp 0x100ae8e9

Function at 0x100a0d60
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 4]
jne 0x1009fa52
pushfd
push eax
bswap ax
pushfd
mov eax, dword [esi + 0x17c]
jmp 0x100a52ca
mov edx, dword [esi + 0xd8]
push ebp
jmp 0x1009b86f

Function at 0x100a0fe4
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushal
mov word [esp + 4], 0xf64f
lea esp, [esp + 0x28]
je 0x100a27cb
pushal
cmp eax, 0x23
push ebx
push 0x6fa103b7
mov dword [esp + 4], edi
push 0xb0ef2b26
lea esp, [esp + 0x2c]
jne 0x1009fa52
not dl
mov eax, dword [esi + 0x17c]
pushfd
jmp fcn.10093b09

Function at 0x100a174f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jmp 0x100a2afe
lea esp, [esp + 8]
je 0x100a27cb
cmc
pushfd
clc
test edi, esp
cmp eax, 0xd
pushal
jmp 0x100a94ba

Function at 0x100a308e
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x24]
je 0x100a27cb
call fcn.100a6954
bt bx, 0xb
pushfd
cmc
mov dword [esi + 0x1a4], ecx
call fcn.100b2593
neg ax
lahf
not ah
bt bx, dx
mov dword [ebp + 0x38], 1
lea esp, [esp + 8]
je 0x100a27cb
bt di, 6
cmp eax, 0xd
jge 0x100acbdc
push 0xeb5d1ddd
pushal
lea esp, [esp + 0x24]
je 0x100a27cb
pushal
pushfd
call fcn.100aec05
call fcn.1009f925
push edi
pushal
jmp 0x10099b9d
Function at 0x100a348b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rcl edx, 0xf
sub ecx, ecx
bsr dx, ax
not si
cmc
neg dl
mov dword [esp + 0x1c], ecx
xadd dx, si
mov dword [esp + 0x20], ecx
mov dl, 0xe0
mov dword [esp + 0x24], ecx
bswap di
mov edx, eax
bsf cx, cx
lea edi, [ecx*2 - 0x75ee548c]
xor cl, 0x4c
test bl, 0x24
mov ecx, eax
bswap di
pushal
xor edx, 0x3842feab
sub si, bx
or ecx, 0xfecd8269
btc si, 1
dec di
mov dword [esp + 0x58], eax
btc di, 1
bts si, 0xd
xadd edi, esi
and eax, 0x1589adef
call fcn.100a2b3c
mov edi, 0xf004ecb4
add al, 0x1c
pushal
cmp al, 0xe8
adc byte [esi + ebp*2 - 0x49], dl
leave
add dword [ecx - 0x527c7479], eax
mov byte [0x76704347], al
push edi
fbld tbyte [ebx - 0x79173553]
add ebp, ebp
in eax, dx
fisttp dword [ebp + 0x74]
nop
fcomp dword [eax - 0x2d]
in eax, dx
sti
sub dword [edi + 0x66], edx
adc al, 0x6f
out 0x4f, al
aad 0xe5
mov dh, 0xba
call 0xd9ac19ee
adc cl, dh
or byte [ebx], bl
das
inc ebx
inc ebp
aas
popal
ja 0x10095e6c
mov edi, 0x3f4127d1
dec ecx
push cs
push ebp
popfd
sub eax, 0xf666397
movsx ax, bl
lea eax, [ebp]
mov al, 1
add cl, ch
invalid
ja 0x10095ee5
add dword [eax], eax
std
ret 0x22f6
inc ah
push ecx
jmp 0x100a719e
lea esp, [esp + 8]
call fcn.1002483e
xadd dx, si
jno 0x10095d37
xor ecx, ecx
clc
mov dword [esp + 0x1c], ecx
test bp, sp
mov dword [esp + 0x20], ecx
neg dx
mov dword [esp + 0x24], ecx
neg dh
bsf ecx, eax
mov edx, eax
add cx, 0x9d30
mov ecx, eax
adc si, 0x1a88
sar si, 4
xor edx, 0x3842feab
not edi
xor si, ax
bt dx, 5
neg si
or ecx, 0xfecd8269
dec si
sub si, si
xchg di, si
mov dword [esp + 0x38], eax
movzx si, dl
push ebp
and eax, 0x1589adef
bswap si
jmp 0x100adbca
mov dword [esp + 0x40], 0x11111111
lea edi, [esi + 0x1520c687]
push dword [esp]
not si
mov dword [esp + 0x48], 0x22222222
push dword [esp + 4]
pushal
mov dword [esp + 0x70], 0x33333333
pop esi
xchg di, si
xchg di, si
mov dword [esp + 0x70], 0x44444444
movsx esi, bl
mov dword [esp + 0x40], edx
lea esi, [esi + 0x7844deda]
bswap dx
mov dword [esp + 0x44], ecx
mov word [esp], cx
lea edx, [esi + 0x2c6e8b35]
mov dword [esp + 0x48], eax
movsx si, bl
jmp 0x100b076f
xchg di, dx
xchg dx, di
mov dword [esp + 0x4c], ebx
xchg si, dx
pushfd
lea esi, [esp + 0x68]
mov dh, bh
mov edi, 2
not dh
nop
bswap dx
lea edx, [ebp - 0x414e835f]
lea edx, [esp + 0x44]
call fcn.100a3ea2

Function at 0x100a4d57
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x20]
je 0x100a27cb
push esi
jmp 0x100a7f1e
lea esp, [esp + 0x30]
jne 0x100af294
pushal
cmc
cmp dword [ebp + 0x14], ebx
jmp 0x100a1fb5
cmp eax, 0xd
pushfd
pushal
mov word [esp], 0x28b5
lea esp, [esp + 0x28]
je 0x100a27cb
jmp loc.10093813

Function at 0x100a6954
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 8]
jne 0x1009fa52
pushfd
cwde
pushfd
call fcn.100a05d9
pushfd
cmp eax, 0x23
jmp 0x1009f25f

Function at 0x100a7600
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushal
lea esp, [esp + 0x28]
je 0x100a27cb
jmp loc.10095250

Function at 0x100a7d25
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 8]
je 0x100a27cb
stc
call fcn.100a6e51
Function at 0x100ac988
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100b4389
jmp 0x1009c53b
mov dword [esp + 0x1c], 0x4950959f
pushfd
push dword [esp + 0xc]
mov byte [esp + 8], al
lea esp, [esp + 0x24]
jmp fcn.1001ad95
movzx dx, al
mov dword [ebp - 0x40], ebx
push ebp
mov dword [ebp - 0x3c], ebx
lahf
mov byte [esp], 0x80
mov byte [ebp - 0x38], 0
lea edx, [0x5e8e9c64]
cdq
pushfd
not eax
mov dword [ebp - 0x34], ebx
pushal
mov dword [ebp - 0x30], ebx
movzx ecx, dl
rdtsc
cwde
lahf
mov dword [ebp - 0x2c], ebx
mov al, 0x49
jmp 0x1009aee1
lea ecx, [esp - 0x4bb9fc6d]
not cl
mov dword [esp + 0x20], eax
push dword [esp + 8]
lea ecx, [ebp - 0x7c]
movzx dx, cl
pushfd
call fcn.100a6b80
pushal
pushfd
mov byte [esp + 0xc], 0x28
mov dword [esp + 0x20], 0x4c4c501
jmp 0x1009be06
mov byte [esp + 4], ch
mov ax, bx
mov dword [ebp - 0x44], ebx
lea esp, [esp + 0x24]
jne 0x100a7d78
mov dword [ebp - 0x40], ebx
setbe cl
pushfd
cdq
mov dword [ebp - 0x3c], ebx
cdq
mov byte [ebp - 0x38], 0
push 0x4d753993
pushfd
xchg ah, dl
movsx dx, bl
mov dword [ebp - 0x34], ebx
movzx ax, al
pushfd
pop eax
mov dword [ebp - 0x30], ebx
call fcn.100b3ae9
mov byte [ebp - 0x24], 0
pop eax
rdtsc
movzx eax, dl
mov dword [esp + 0x24], ebx
mov al, 0xd1
lea eax, [ebp - 0x20]
setle cl
jmp 0x100ab549
mov dword [ebp - 0x28], ebx
lahf
push 0x1eec3db5
jmp 0x100b3a48

Function at 0x100adc5c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc eax
push esi
cmp eax, dword [esi + 0x17c]
jmp 0x100a1fe9
lea esp, [esp + 0x2c]
jb 0x100a4a60
pushal
lea esp, [esp + 0x20]
jmp fcn.100a9acb
jmp 0x1009c59a

Function at 0x100ae583
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
lea esp, [esp + 0x30]
je 0x100a27cb
push esp
cmp ax, sp
cmp eax, 0x23
call fcn.100b27da
bt bx, 2
cmp eax, 0xd
pushal
pushfd
jmp 0x100ab4d0

Function at 0x100ae949
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp eax, 0xd
pushfd
jmp 0x100a4a8a

Function at 0x100ae9cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xfd32e9cd
setge ch
lea ecx, [ebp + 0x18]
mov word [esp + 4], bx
pushfd
push dword [esp]
lea esp, [esp + 0x50]
call fcn.1001cc50
lea ecx, [edi*8 - 0x5c221402]
rdtsc
lea edx, [edx - 0x5848f3be]
pushal
mov dword [esp + 0x1c], ebx
rdtsc
lea edx, [ebp + 0x18]
lea esp, [esp + 0x1c]
js 0x100a07f7
setg al
lahf
push edx
pushfd
lea ecx, [ebp + 0x4fa1b748]
movsx ax, al
lea eax, [ebp - 0x6c]
push edi
jmp 0x100b0ffe
movzx cx, cl
mov dword [esp + 4], eax
bswap ecx
movzx cx, dl
lea ecx, [ebp + 0x3c]
call fcn.100b2db3

Function at 0x100aec05
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushfd
mov byte [esp], al
lea esp, [esp + 0x2c]
jne 0x1009fa52
lea eax, [edi*4 + 0x5f63efe9]
mov eax, dword [esi + 0x17c]
push ecx
mov edx, dword [esi + 0xd8]
call fcn.100a29de
cmp eax, 0x23
jmp 0x100ae056
Function at 0x100af28a
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x28]
je 0x100a27cb
stc
call fcn.100b3baf
push ecx
mov dword [esp], edi
pushal
mov dword [esp + 0x20], 0x84fb9201
pushal
push ecx
pushfd
push esp
mov dword [esp + 0x48], 0xaf02b211
push edx
mov word [esp], bx
lea esp, [esp + 0x4c]
jmp fcn.1001da25

Function at 0x100af3ab
Capabilities:
Check for vm using instruction vpcext

Disassembly:
bsr cx, bp
cmp dword [eax - 8], edi
pushfd
movzx cx, al
lea ecx, [ecx - 0x5ef774b5]
movsx cx, bl
lea ecx, [ebx + 0x184]
pushal
pushfd
mov byte [ebp - 4], 2
push ebp
push dword [esp + 8]
jmp 0x100ae402
lea esp, [esp + 0x38]
jle 0x100ad429
push ebx
pushfd
mov word [esp], 0xce7
mov dword [esp + 4], edi
call fcn.100a0b10
push dword [esp]
mov dword [ebp + 0x30], ebx
pushfd
lea esp, [esp + 0x24]
jge 0x1009abc7
pushfd
lea esp, [esp + 4]
call fcn.10013010
seta ah
mov eax, dword [ebp + 0x2c]
shrd cx, bp, 0xa
bt dx, 8
call fcn.100b13a1
cmp si, 0xe120
pushfd
push esi
mov dword [ebp - 0x34], edi
rcl cl, cl
stc
xor ch, dl
mov dword [ebp - 0x30], edi
neg ax
test dl, dl
sub ecx, 0xebea0c14
sub ah, dl
mov dword [ebp - 0x2c], edi
xadd ch, ah
cmp ch, 0xc6
inc al
mov byte [ebp - 0x28], 0
movsx ecx, bl
mov dword [ebp - 0x24], edi
cmp dh, 0xba
shr cl, cl
xchg ah, cl
xchg cl, ah
mov dword [ebp - 0x20], edi
shr cx, cl
aad 0x45
mov dword [ebp - 0x1c], edi
xchg ch, ah
mov dword [ebp - 0x18], edi
shl al, 5
cmc
mov byte [ebp - 0x14], 0
ror ah, 1
aam 0x9a
seto al
lahf
mov eax, dword [ebx + 0x184]
jmp 0x100aa75a

Function at 0x100af910
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 4]
je 0x100a27cb
test ebp, edx
cmp eax, 0x23
pushfd
pushfd
pushal
lea esp, [esp + 0x28]
jne 0x1009fa52
movsx edx, al
mov eax, dword [esi + 0x17c]
call fcn.100b3bca
stc
cmp eax, 0xd
jmp 0x100a5b01

Function at 0x100afe0e
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jmp 0x100b25e9
cmc
cmp eax, 0x23
pushfd
mov word [esp], bp
jmp 0x100a0fd0

Function at 0x100b0eeb
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push 0xa3de724a
lea esp, [esp + 4]
jne 0x1009fa52
movsx eax, bl
lea edx, [esi - 0x5adcd01a]
cwde
pushal
mov eax, dword [esi + 0x17c]
lea edx, [edx - 0x51197dea]
mov byte [esp], 0xae
jmp fcn.1009a626
jmp loc.100956af
push 0x6f6ba3fc
cmp eax, 0xd
jmp 0x100b305a
pushal
pushfd
lea esp, [esp + 0x30]
je 0x100a27cb
test al, 2
cmp eax, 0x23
jae 0x1009e94e
push ebp
mov dword [esp], esi
push 0x1677afe4
lea esp, [esp + 8]
jne 0x1009fa52
call fcn.100a5601
jmp 0x100a8b4e

Function at 0x100b2395
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov dword [esp + 0x44], eax
sal si, 1
lea esi, [esi - 0x907aedb]
dec di
and eax, 0x1589adef
pushal
mov di, 0x99d1
pushfd
push ecx
mov dword [esp + 0x70], 0x11111111
not si
pop esi
mov dword [esp + 0x70], 0x22222222
pushfd
lea edi, [esi - 0x458008f8]
push dword [esp + 8]
bswap si
mov dword [esp + 0x7c], 0x33333333
pushfd
mov word [esp + 4], cx
mov dword [esp + 0x84], 0x44444444
bswap di
call fcn.10099f85
call fcn.10099f4d
Function at 0x100b27da
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + 0x3c], eax
mov word [esp + 4], 0x65c8
mov dword [esp + 0x38], 0xb1
pushfd
mov dword [esp + 0x38], edx
mov byte [esp + 4], 0x6a
lea esp, [esp + 0x38]
jmp fcn.100961f0
lea esp, [esp + 8]
jne 0x1009fa52
pushal
cwde
mov eax, dword [esi + 0x17c]
movzx dx, bl
lea edx, [ebp - 0x7ddd16b9]
mov edx, dword [esi + 0xd8]
pushfd
mov dword [esp + 0x20], eax
pushal
jmp 0x100aa8b8

Function at 0x100b2de6
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add esp, 0x10
cmc
pushfd
test cl, 0x44
pushal
mov dword [ebp + 0x24], ecx
pushfd
test bl, 0xc0
cmp eax, 8
pushfd
lea esp, [esp + 0x2c]
jne 0x100af294
clc
cmp dword [ebp + 0x14], ebx
jmp 0x100b0bd9
pushfd
lea esp, [esp + 4]
je 0x100a27cb
stc
clc
cmp eax, 0xd
push 0x9b8b3482
push dword [esp]
mov byte [esp], 6
lea esp, [esp + 8]
je 0x100a27cb
bt cx, cx
call fcn.100afe0e
cmp cl, bl
mov eax, dword [eax]
jmp 0x100a25b3

Function at 0x100b470b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc eax
push dword [esp]
mov byte [esp], 0x69
cmc
cmp eax, dword [esi + 0x17c]
push esi
push dword [esp]
mov byte [esp], 0x49
pushfd
lea esp, [esp + 0x20]
jb 0x100a4a60
pushfd
lea esp, [esp + 4]
jmp fcn.100a9acb

Function at 0x100b47cc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp al, ch
pushal
test si, si
test edi, edi
push 0xdaa9d29a
pushfd
lea esp, [esp + 0x30]
jne fcn.100a9acb
pushal
cmc
push edi
cmp dword [esi + 0x17c], ebx
jmp 0x100b29fc
pushal
inc eax
bt ax, 4
test bh, 0xf
jmp fcn.1009e985
push ebx
lea esp, [esp + 0x28]
jbe fcn.100a9acb
jne 0x100ae454
rcl dh, cl
rol dh, cl
mov edi, edi
sbb dl, dh
movzx dx, byte [0x1004b5d8]
stc
stc
xor word [ecx + eax*2], dx
pushfd
jmp fcn.1009398e
inc dl
shrd dx, bp, cl
rcl dh, 5
mov edi, edi
clc
shl dl, 5
movzx dx, byte [0x1004b5d8]
bt bp, cx
test al, dh
xor word [ecx + eax*2], dx
jmp 0x100a2e31
jmp 0x100adb42
inc edx
clc
mov dword [0x1004ba74], edx
jmp 0x1009aa34

Function at 0x100b4f8c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x14]
je 0x100a27cb
call fcn.1009abcc
Function at 0x100b8f0e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x48]
je 0x100b8f14
test dh, ah
stc
cmp al, dl
bt ebp, 1
sub al, 0x30
jmp 0x100bc503
pushal
jmp 0x100b89d4
cmp ah, 0x42
call fcn.100b9429
push ss
shr ah, 1
add byte [esi], cl
sub eax, 0x448d844c
invalid
bt bp, 8
cmc
cmp al, 9
pushfd
lea esp, [esp + 4]
ja 0x100bff19
call 0x100bf94e
add byte [eax], al
inc ebx
jb 0x100bc585
popal
je 0x100bc588
inc esp
popal
je 0x100bc588
inc ecx
jbe 0x100bc594
jae 0x100bc592
dec eax
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x100bc534
push eax
invalid
inc esi
push es
in eax, 0xa3
in al, dx
xchg esp, eax
push ds
inc esi
cmpsb byte [esi], byte es:[edi]
adc al, 0x25
dec eax
cmpsd dword [esi], dword es:[edi]
shl byte [esi - 0x71], 0xcb
cwde
mov al, 0x62
sbb al, 0
enter 0x6ceb, 0x1d
ror dword [ebp], cl
add byte [edi + 0x6c], cl
push edx
inc edi
je 0x100bc603
invalid
jae 0x100bc615
jb 0x100bc606
jns 0x100bc624
add dl, dl
int3
inc eax
je 0x100b95f6
in al, dx
iretd
bswap esi
xor si, dx
lea edx, [edx - 0x2e5cb871]
adc esi, esp
mov esi, dword [eax + 0x3c]
pushal
add dx, 0x1b
add esi, eax
or dl, bh
setp dh
add dx, 0x1b5f
mov edx, dword [esi + 0x78]
jmp 0x100b9808

Function at 0x100bc5b6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x48]
je 0x100b8f14
test dh, ah
stc
cmp al, dl
bt ebp, 1
sub al, 0x30
jmp 0x100bc503
pushal
jmp 0x100b89d4
cmp ah, 0x42
call fcn.100b9429
push ss
shr ah, 1
add byte [esi], cl
sub eax, 0x448d844c
invalid
bt bp, 8
cmc
cmp al, 9
pushfd
lea esp, [esp + 4]
ja 0x100bff19
call 0x100bf94e
add byte [eax], al
inc ebx
jb 0x100bc585
popal
je 0x100bc588
inc esp
popal
je 0x100bc588
inc ecx
jbe 0x100bc594
jae 0x100bc592
dec eax
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x100bc534
push eax
invalid
inc esi
push es
in eax, 0xa3
in al, dx
xchg esp, eax
push ds
inc esi
cmpsb byte [esi], byte es:[edi]
adc al, 0x25
dec eax
cmpsd dword [esi], dword es:[edi]
shl byte [esi - 0x71], 0xcb
cwde
mov al, 0x62
sbb al, 0
enter 0x6ceb, 0x1d
ror dword [ebp], cl
add byte [edi + 0x6c], cl
push edx
inc edi
je 0x100bc603
invalid
jae 0x100bc615
jb 0x100bc606
jns 0x100bc624
add dl, dl
int3
inc eax
je 0x100b95f6
in al, dx
iretd
bswap esi
xor si, dx
lea edx, [edx - 0x2e5cb871]
adc esi, esp
mov esi, dword [eax + 0x3c]
pushal
add dx, 0x1b
add esi, eax
or dl, bh
setp dh
add dx, 0x1b5f
mov edx, dword [esi + 0x78]
jmp 0x100b9808