joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008a3c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1008a3cb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1008a4ce
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x100f6078]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x100f6078]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x100f6078]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x100f6078]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x100f6078]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x100f6078]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x100f6078]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x100f6078]
xor eax, edx
inc ecx
dec edi
jne 0x1008a3e6
pop edi
test esi, esi
je 0x1008a4f0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x100f6078]
xor eax, edx
inc ecx
dec esi
jne 0x1008a4d2
pop esi
pop ebx
not eax
ret
Function at 0x10092800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100c9250
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 8], al
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.10092910
test al, al
jne 0x10092897
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x10092882
mov al, byte [ecx - 1]
cmp al, bl
je 0x10092878
cmp al, 0xff
je 0x10092878
dec al
pop esi
mov byte [ecx - 1], al
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
dec ecx
push ecx
call fcn.100b8f85
add esp, 4
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
call fcn.1008bf20
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
push ecx
mov ecx, esi
call fcn.10093690
mov ecx, eax
call fcn.1008c440
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.1008c270
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x100928ee
mov al, byte [ecx - 1]
cmp al, bl
je 0x100928e4
cmp al, 0xff
je 0x100928e4
dec al
mov byte [ecx - 1], al
jmp 0x100928ee
dec ecx
push ecx
call fcn.100b8f85
add esp, 4
mov ecx, dword [esp + 0x28]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x10093470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100c933b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x34]
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov byte [esp + 0x18], al
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x34], ebx
mov edx, dword [ecx]
mov dword [esp + 0xc], edx
mov edx, dword [0x100f64c4]
mov eax, dword [ecx + 4]
push edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [ecx + 8]
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x24]
call fcn.1008dbe0
mov eax, dword [esi + 0x5c]
mov ecx, dword [esp + 0x44]
add esi, 0x30
cmp eax, ebx
mov dword [esp + 0x28], ecx
je 0x10093565
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
cmp eax, edx
je 0x10093565
lea ecx, [eax + 0x20]
cmp ecx, edx
jne 0x10093525
mov dword [esp + 0x40], eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x3c], eax
cmp eax, ebx
mov byte [esp + 0x34], 2
je 0x10093518
lea edx, [esp + 0xc]
mov ecx, eax
push edx
call fcn.100965e0
mov ecx, esi
mov byte [esp + 0x34], bl
call fcn.10095400
jmp 0x10093590
mov edi, eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
cmp edi, ebx
mov byte [esp + 0x34], 3
je 0x10093590
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov edx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov dword [eax + 8], ecx
push edx
lea ecx, [edi + 0xc]
call fcn.10093b50
mov eax, dword [esp + 0x28]
mov dword [edi + 0x1c], eax
jmp 0x10093590
mov ecx, esi
call fcn.10095400
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], ecx
lea edx, [ecx + 0x20]
mov dword [esi + 0x1c], edx
cmp ecx, ebx
mov byte [esp + 0x34], 1
je 0x10093590
lea eax, [esp + 0xc]
push eax
call fcn.100965e0
mov edx, dword [esi + 0x2c]
mov eax, dword [esp + 0x1c]
inc edx
cmp eax, ebx
mov dword [esi + 0x2c], edx
je 0x100935bc
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x100935b3
cmp al, 0xff
je 0x100935b3
dec al
mov byte [ecx], al
jmp 0x100935bc
push ecx
call fcn.100b8f85
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x10098730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100c9583
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.100b5421
lea ecx, [esp + 0xc]
mov dword [esi + 0x34], eax
call fcn.100b4fda
mov edi, dword [0x1013b710]
lea ecx, [esp + 8]
call fcn.100b4fda
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x1009877c
inc eax
mov dword [edi + 4], eax
lea ecx, [esp + 8]
call fcn.100b5076
lea ecx, [esp + 0xc]
call fcn.100b5076
lea eax, [esi + 4]
lea ecx, [esi + 0x14]
lea edx, [esi + 0x18]
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
lea eax, [esi + 8]
lea ecx, [esi + 0x24]
lea edx, [esi + 0x28]
xor edi, edi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
mov dword [eax], edi
mov eax, dword [esi + 0x20]
push edi
push edi
mov dword [eax], edi
mov ecx, dword [esi + 0x30]
push edi
mov dword [esp + 0x28], edi
mov dword [ecx], edi
mov ecx, esi
call fcn.10098840
mov cl, byte [esp + 0x24]
xor eax, eax
test cl, 1
mov dword [esi], 0x100f65f8
jne 0x100987ea
mov eax, 4
test cl, 2
jne 0x100987f1
or al, 2
mov edx, dword [esi + 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x20
mov dword [esi + 0x44], eax
mov dword [edx], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov ecx, dword [esi + 0x2c]
mov dword [ecx], edi
mov edx, dword [esi + 0x10]
mov dword [edx], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov ecx, dword [esi + 0x30]
mov eax, esi
mov dword [ecx], edi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x10141162
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp si, word [ecx + 2]
jmp 0x1023db02
lea esp, [esp + 4]
jne 0x1018c143
call fcn.101f6faf
pushfd
mov byte [esp], 0x7c
mov dword [esp], 0xa0fc791c
push eax
push 0xaa2f4a3b
push dword [esp + 4]
lea esp, [esp + 0xc]
jmp fcn.1013de47

Function at 0x1014323b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt bx, di
test eax, eax
lea esp, [esp + 8]
jns 0x1021f4fe
push edx
pushal
push 0xb1f85e09
lea esp, [esp + 0x28]
je 0x101de8cf
lea eax, [edi*4 + 0x475f96b6]
rdtsc
rdtsc
mov ecx, dword [ebp + 0x14]
movzx ax, cl
cdq
pushal
mov edx, dword [ebp - 8]
movsx ax, bl
xchg dword [esp + 0x1c], ecx
lea ecx, [esi + 0x41c0b66b]
cwde
bswap ax
not cl
mov ecx, dword [ebp + 8]
not ax
mov dword [esp + 0x18], esi
movzx ax, al
pushal
movzx ax, bl
mov dword [esp + 0x34], edx
push dword [esp + 4]
lahf
mov eax, edi
push dword [esp]
pushfd
lea esp, [esp + 0x40]
call fcn.1024f7f4
sete bl
mov ebx, eax
pushal
pushal
mov word [esp + 4], dx
lea esp, [esp + 0x40]
jmp 0x1018e122

Function at 0x1015e368
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ecx, ecx
push eax
mov byte [esp], 0xc4
push dword [esp + 4]
lea esp, [esp + 0x2c]
jmp 0x102118a6

Function at 0x10160d91
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp ax, 0xf49a
push ebp
bts bp, bp
btc ecx, 0x13
bsr bp, dx
mov ebp, esp
bsf cx, si
bsr eax, eax
sbb cx, 0x38
movzx ecx, word [edi]
lea eax, [eax*8 - 0x57f5d9d2]
movzx eax, word [edi + 2]
pushal
mov dword [esp + 0x1c], esi
shrd si, bp, cl
add si, 0xcf98
lea esi, [eax + ecx - 1]
clc
cmp cx, ax
clc
cmp ecx, esi
pushfd
jmp 0x101ee4f9
mov byte [esp], dl
lea esp, [esp + 0x20]
jg 0x102625dc

Function at 0x10169a18
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov ebx, 0x1007d773
jmp 0x10245ea9
mov ebx, dword [ebx + 0x1d4ada]
pushfd
push 0xb418da4d
lea ebx, [ebx - 0x152c6bd5]
mov dword [esp + 8], 0xb34b464a
call fcn.1026dd4f

Function at 0x10171ef7
Capabilities:
Execute anti-debugging instructions

Disassembly:
js 0x1025acce
pushal
nop
call fcn.102588ef
jmp 0x102310a6
nop
jp 0x102708ee
push ebx
jmp 0x1025aa69
pushal
pushal
xchg dword [esp + 0x40], ebp
pushfd
push dword [esp + 0x44]
ret 0x48
mov ebx, dword [esp + 4]
jmp 0x1021371f
pushal
mov dword [esp + 0x1c], ebx
setnp bl
lea ebx, [ecx + 0x6338a43b]
mov ebx, dword [esp + 0x20]
pushfd
lea ebx, [ebx + 1]
call fcn.1016d6d4

Function at 0x101745c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.10218891
push edi
xchg dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jl 0x10144901
bswap edi
not di
lea edi, [esi*4 + 0x10c7bdad]
mov edi, 0x100404ad
jmp 0x10210e25
push 0x67f13d2a
push eax
mov edi, dword [edi + 0x11c985]
call fcn.101e4b6a

Function at 0x1017d765
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea ecx, [ecx + 1]
pushfd
pushfd
mov dword [esp + 0x44], ecx
push ebx
jmp 0x101fed66
movsx ecx, bl
movzx cx, bl
mov ecx, 0x1009ba22
pushfd
mov byte [esp + 0xc], dh
mov ecx, dword [ecx + 0xc940e]
push dword [esp + 8]
jmp 0x102625c7
lea ecx, [ecx - 0x36120906]
call fcn.101d8b2b
Function at 0x101e169a
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x14]
call fcn.102060df
mov edx, dword [esp + 4]
jmp 0x10244052
push dword [esp + 4]
xchg dword [esp + 0xc], edx
push 0xe01fddeb
push eax
push ebx
push 0xc6cc4c24
xchg dword [esp + 0x18], edx
mov byte [esp], 0xba
mov edx, 0x1001e2ea
jmp 0x101809ea

Function at 0x1020242d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [ebx + 0xecc65]
mov byte [esp + 4], 0xf7
mov word [esp + 4], si
lea ebx, [ebx - 0x70044f98]
push dword [esp + 4]
call fcn.10263edf
mov es, ebx
pop ebx
scasd eax, dword es:[edi]
dec edi
sub al, 0x73
invalid
jg 0x102465e9
mov ebx, 0x648c458e
nop
bswap bx
call fcn.10246dfe
pushfd
movzx bx, dl
pop ebx
nop
pushfd
movzx bx, bl
bswap ebx
mov ebx, dword [esp + 4]
push ebp
xchg dword [esp + 0xc], ebx
pushfd
mov byte [esp], bl
pushal
mov dword [esp + 0x2c], ebx
pushfd
mov ebx, 0x10098eb5
push edx
jmp 0x10187f02

Function at 0x102046af
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 4], di
nop
mov byte [esp], 0x5c
push 0xd5cdf409
push esp
push dword [esp + 4]
xchg dword [esp + 0x10], eax
pushal
movsx eax, dl
bswap ax
mov eax, dword [esp + 0x34]
pushfd
call fcn.10227cdb

Function at 0x102188a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x60]
jb 0x10210cd0
seto al
not al
movsx dx, cl
dec dword [esi + 0x28]
rdtsc
rdtsc
movsx cx, bl
mov byte [ebp - 1], 1
cwde
mov bl, 0xa1
pop ebx
setns ah
mov edx, dword [esi]
pushal
mov eax, dword [edx + 8]
jmp 0x10258810
jmp 0x101edc27

Function at 0x10224fd2
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
mov bl, 0x68
call fcn.1020878b
xchg edx, eax
jecxz 0x1018d34d
aam 0x4b
call 0xdb53cc70
test edx, ecx
jb 0xa58b5fc7
dec edx
pushfd
inc edx
pop ecx
js 0x1018d32e
adc byte [esi - 0x18], ch
jbe 0x1018d2a5
xchg byte [0x1c2436a], dl
ficom word [edx + ebp*8 + 0x4b]
add al, 0xcd
rcl byte [ebx], cl
push edx
in eax, dx
adc byte [edx + 0x2f6b6e0f], dh
invalid
push esp
ljmp 0x13d2
das
adc byte [ebx - 4], al
or eax, 0x87380622
sbb byte [edx], dh
sub eax, 0xbdb966d8
xor ch, byte [0xbdb966d8]
mov byte [0x3a293683], al
stc
inc ebp
push esi
imul byte [ecx + 0x1bdcffd]
adc al, byte [esi + 0x43b4b14a]
xchg byte [edx - 0x4f], cl
mov ah, 0x43
fld qword [edx - 0x13]
jo 0x1018d393
jne 0x1018d338
jnp 0x1018d3bf
adc al, 0x2a
cmp ecx, dword [ecx + 0x4d]
jno 0x1018d314
mov fs, esi
aad 0x2b
cmc
sub al, bh
and ebp, esp
jb 0x1018d3b1
pop esp
insd dword es:[edi], dx
jo 0x1018d337
dec ecx
xchg esi, eax
jmp 0xca44e3d
invalid
retf
add esp, dword [esi]
invalid
mov byte [esp], 0x99
xchg dword [esp], ecx
not cl
pushal
movsx ecx, cl
movsx cx, cl
mov ecx, dword [esp + 0x24]
pushal
jmp 0x1018d2ea
jmp 0x102469dd
pushfd
nop
jmp 0x101fe7c2
Function at 0x10234e3d
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x83
in eax, 0xc2
sbb eax, 0x37d0af2e
test al, 0xb9
sbb dword [edi + 0x4f], ecx
pushal
or al, byte [ecx - 0x1a]
leave
or al, 0xe2
popfd
sahf
in eax, 0x81
inc edi
cdq
xchg ebp, eax
leave
sbb eax, 0xb53bfc0
sbb al, 0xee
js 0x10234e30
js 0x10234e30
sbb al, byte [ecx]
pushal
inc eax
invalid
xchg ecx, eax
in eax, dx
inc ecx
mov eax, dword [0x437b4a14]
push esp
pop esp
bound esi, qword [ebp - 0x5828a020]
mov eax, 0x10bc028a
inc esi
pop ss
dec ecx
mov bl, byte [edi + 0x14]
imul ebp, dword [ecx + edi*2 - 0x74], 0x63
sbb al, 0x3f
sahf
loope 0x10234da3
sbb byte [0x687c9533], al
rcr byte [ecx + 0x3949358d], cl
test ebp, esi
push 0xffffffffffffff98
xchg edi, ecx
jo 0x10234e97
dec ecx
xchg ecx, eax
dec esi
ret
cdq
insb byte es:[edi], dx
leave
jne 0x10234e78
push edx
ja 0x10234de8
in eax, 0x39
jno 0x10234e8b
cmp dword [ecx + 0x58], esi
xchg esp, eax
fnsave dword [edx + 0x5fe8a5da]
into
add dword [eax], eax
push dword [esp]
call fcn.101e8d58
xor dword [esi - 0x68], eax
adc edi, dword [edi]
sti
push dword [ecx]
inc esi
cwde
fild word [eax + 0x58a6641b]
xchg esi, eax
test al, 0x49
mov esp, 0xc724e91
add edi, dword [edi]
sbb byte [edi + 0x29e837f8], ah
jno 0x10234ece
jle 0x10234e41
ror byte [ebx - 0x4113243d], cl
stosb byte es:[edi], al
hlt
mov byte [edx - 0x55], bl
stosd dword es:[edi], eax
add edi, ebp
mov eax, dword [0xc36c52b2]
pop esp
insd dword es:[edi], dx
jbe 0x10234e2f
pop edi
xor dword [edi - 0x7bc53589], esp
adc ah, cl
std
cmpsw word [esi], word es:[edi]
cmp al, byte [eax + edx - 0x58990234]
int3
inc edx
pop ds
or al, 0x83
jg 0x10234e9b
add ebx, dword [ebx*2 + 0x3e6c2bf3]
sub dh, byte [ebp + eax*4 - 0xf]
sbb al, 0x5d
sub ebp, dword [esi + edi + 0x2a]
sub ebp, dword [esi + edi + 0x2a]
je 0x10234e26
int1
int 0xe9
cmp cl, byte [edx]
jmp 0xe1502398
jge 0x10234e98
push ss
imul ebx, dword [ebx - 0x1df134dd], 0x51eb9146
cli
xchg ch, ch
mov byte [0x8ed03dfc], al
push cs
push eax
fild word [eax + 0x51]
jnp 0x10234e8e
mov ah, 0x59
and byte [esi], ch
jo 0x10234f35
jnp 0x10234e83
jl 0x10234e7a
pushal
invalid
push es
rcr ebx, cl
xchg ebp, eax
dec esp
invalid

Function at 0x10238b09
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x17
lea eax, [eax + 1]
mov dword [esp], ecx
mov dword [esp + 0x4c], eax
lea eax, [ebx*4 + 0x56357289]
mov eax, 0x1008b457
push dword [esp]
mov eax, dword [eax + 0x1d9c7a]
push dword [esp + 4]
call fcn.1023ce9d
Function at 0x10238b4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.10265c1e
lea esp, [esp + 0x2c]
js 0x1023761a
bts edx, edi
neg dl
btc edx, eax
mov edx, dword [ecx + 0x2c]
lea eax, [ebx*2 - 0x4d96802c]
shld eax, edx, 0x19
shr cx, cl
xadd al, cl
mov dword [ebp - 4], edx
sal dx, cl
pushfd
lea ebx, [ebx]
add esp, 4
rdtsc
lahf
inc ch
mov ecx, dword [ebp + 8]
pushal
rdtsc
lea eax, [edi + ebx]
push ecx
cmp bl, 0x73
shld edx, ebp, cl
btc edx, 0x1a
cdq
pushal
sub eax, edx
movzx dx, bl
bsf dx, sp
mov edx, dword [ebp + 0xc]
pushfd
stc
cmc
sar eax, 1
mov byte [esp + 4], dl
mov ecx, dword [ecx + eax*8 + 4]
bt dx, sp
pushfd
and ecx, 0x7fffffff
jmp 0x10201bef
bts si, 3
sbb edi, 0xdddc618c
inc bx
cmp al, 0x3c
pop edi
sar bh, 5
xor bh, 0xd7
bsf bx, si
neg bh
pop esi
shld bx, di, 0xa
adc ebx, ecx
stc
sub eax, eax
mov ebx, ecx
setae bh
mov bl, 0xf8
pop ebx
push 0x633b67ee
call fcn.10202458
pushfd
jmp 0x1021b226

Function at 0x102395a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x1020d444
lea esp, [esp + 8]
jne 0x102399de
je 0x1022a653
pushal
mov byte [esp], 5
push 0xedefe9bd
pushal
lea esp, [esp + 0x44]
jge 0x102375fb
pushal
pop edi
movzx di, dl
lea edi, [eax - 1]
pushal
pushfd
pushfd
mov word [esp], cx
lea esp, [esp + 0x44]
jmp 0x10237605
bt di, bp
pushal
jmp 0x101e7738
test si, si
mov byte [esp], 0x10
lea esp, [esp + 0x20]
je 0x101f6fca
stc
mov si, word [edx + 2]
bt esp, 0x14
call fcn.10141162
pushfd
nop
mov di, 0xd8cf
mov word [esp], ax
not di
mov edi, dword [esp + 4]
pushal
push dword [esp + 8]
jmp 0x10239343
lea esp, [esp + 0x24]
jge 0x102375fb
push edi
lea edi, [0x7c5c5335]
push 0x4502a627
movzx edi, cl
lea edi, [eax - 1]
pushfd
lea esp, [esp + 0xc]
jmp 0x10237605
sbb ecx, ecx
jmp 0x102118a0
sbb ecx, 0xffffffff
add esp, 0x20
test ah, 0xba
test ecx, ecx
push eax
pushfd
jmp 0x101da708
btr dx, 0xe
setns ch
mov edx, dword [ebp + 8]
cmc
call fcn.10177ace
bt dx, 1
shl bh, 1
lea ebx, [eax + 1]
test cl, 0x39
stc
clc
cmp ebx, edi
pushfd
push edi
pushal
push esp
lea esp, [esp + 0x2c]
jle 0x1021b25c
xchg dword [esp + 0x2c], edi
call fcn.10270f9a
lea esp, [esp + 4]
jne 0x1018c143
jmp 0x101e56d7
push 0x3681c544
lea esp, [esp + 4]
je 0x1022a653
pushal
pushfd
jmp 0x101f6eff

Function at 0x10245e8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xdb
mov byte [esp + 8], dl
xchg dword [esp + 0x10], esi
pushfd
pushal
mov dword [esp + 0x30], esi
lea esi, [eax + 0x1a5599dd]
not esi
call fcn.102247e2
Function at 0x10245ec8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov word [esp], bp
mov dword [esp + 0x24], ebp
pushal
call fcn.1020831a
pushal
xchg dword [esp + 0x1c], edx
pushal
call fcn.10191f9c
jmp 0x101dcee6
mov ebp, 0x100842ab
mov byte [esp], al
jmp 0x102130e5
mov dword [esp], 0x42bed15
mov ebp, dword [ebp + 0x1c3e0a]
mov byte [esp], 6
pushal
push dword [esp]
pushfd
lea ebp, [ebp - 0x441464fd]
call fcn.1018ddc9
movzx esi, dl
jmp 0x10257a7a
lea esp, [esp + 0x24]
je 0x10250a73
push edi
rdtsc
rdtsc
mov eax, dword [ecx]
not edx
push 0x98eec685
not dl
mov edx, dword [eax]
pushal
pushfd
mov dword [esp + 0x28], 1
call fcn.102251cd
mov al, 0x29
mov eax, dword [esi + 0x2c]
call fcn.1025c6ad
jle 0x1017304a
pushfd
push ebx
mov dword [esp + 0xc], ebp
push dword [esp + 4]
jmp 0x10175af2
mov ebx, dword [esp + 4]
pop esi
mov edi, dword [esp + 4]
pushal
mov esi, dword [esp + 0x28]
pushfd
mov byte [esp + 4], dh
push ebp
push dword [esp + 8]
push dword [esp + 0x38]
ret 0x3c

Function at 0x10251987
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x7ebb1829
call fcn.1025a7fc
jmp fcn.10160d91

Function at 0x1025ac42
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xb3
lea esi, [esi + 1]
pushfd
lea esp, [esp + 0x14]
ja 0x101da703
push ebp
pushal
mov dword [esp + 0x28], esi
mov si, 0xcfb0
mov esi, 0x100a1b7a
pushal
mov esi, dword [esi + 0x199b0f]
jmp 0x1016cd70
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0xe4c3b4], 1
mov dword [0xe4c3b8], 1
mov dword [0xe4c3bc], 1
mov dword [0xe4c3a8], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401415
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401438
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x40145a
cmp eax, 0x20b
je 0x40147f
jmp 0x4014aa
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x40146c
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401497
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, 0
leave
ret