joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8d2c30
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx*4], 0x9513143d
bts edx, edx
xor ax, bx
pop ecx
or dl, 0x2c
rol ax, 1
bswap edx
imul edx, ecx
neg ax
btr edx, 0xb9
or ecx, ecx
xor ax, 0x3ebe
shr ecx, cl
sbb ax, dx
xor bx, ax
sal cl, cl
shr cl, 0xc6
ja 0x9a569b
sub ebp, 4
mov ecx, 0x559ab42e
movsx eax, cx
push eax
mov ecx, dword [ebp + ecx - 0x559ab42e]
xor ecx, ebx
rol eax, 0x2d
xor ecx, 0xf822c30b
rol ecx, 2
rol al, 0x27
inc ecx
or ax, ax
bswap eax
not dword [esp]
bswap ecx
rol ecx, 3
dec al
je 0x9514fe
mov edx, dword [esp]
inc ecx
xchg byte [esp + edx - 0x4bcf], al
ror ecx, 3
neg byte [esp + edx*8 - 0x25e86]
idiv dword [esp + edx*2 - 0x97a2]
inc ecx
xor ebx, ecx
xchg byte [esp + eax - 0x6b64886], dl
cbw
add esi, ecx
jmp 0x8dd365
idiv dword [esp + edx*4 - 0x7052c]
lea ecx, [edx*4 + 0x7abcfd0a]
mov ecx, dword [edi + eax*2 - 0x4c3a061c]
cwd
shr edx, 0x30
bswap edx
mov eax, dword [eax + ecx - 0x261d030e]
mov dword [edi + edx*2 - 0xe000000], eax
mov dword [esp + edx*2 - 0xe000000], esi
ret

Function at 0x8d3b54
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror eax, 3
xor ebx, eax
pop edx
add edi, eax
or word [esp + ecx - 0x4f62c14c], cx
movzx edx, cx
mov eax, ecx
pop edx
pop edx
jae fcn.009338ec

Function at 0x8d3fee
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dword [esp + 4], 0xca
pop eax
pop edx
jnp fcn.0084da17
or byte [esp + 4], 0x32
mov word [edi], cx
jae 0x88e583
test eax, 0x8a81b1a7
sbb bh, bl
in al, 0x3f
xchg ecx, eax
sbb eax, 0x7b378ef5
test bh, bh
int3

Function at 0x8da84b
Capabilities:
Encode data using xor

Disassembly:
not eax
lea eax, [eax + ecx - 0x4887a2dc]
imul ecx, edx
xor word [esp + 6], cx
xor ebx, eax
inc edx
inc dword [esp + 4]
add ebp, eax
not dword [esp + 4]
mov eax, dword [edi]
sar dword [esp + 4], cl
xadd byte [esp + 5], ch
btc dx, 0x2e
mov cl, byte [edi + 4]
mov dword [esp], edx
jb 0x974b75
adc edx, edx
adc edi, 5
inc dl
shr dl, 0x42
bt edx, 0x99
mov byte ss:[eax], cl
lea ecx, [edx*4 - 0x6b4e016d]
push edx
xchg edx, ecx
pop eax
pop ecx
pop eax
jmp ebp

Function at 0x8dc2be
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x6a58228a], 0x1a8a0c92
not ecx
movzx ecx, byte [edi + eax - 0x6a58228a]
cwde
and eax, 0x852bb9
xor cl, bl
sub cl, 0x9c
call fcn.008a52fe
mov ecx, edi
mov edx, 0xe00605ba
sub edi, 4
Function at 0x8e13f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc dword [esp + ecx - 0x7d0b073f], ecx
xor edx, ebx
neg edx
mov eax, ecx
rol edx, 1
push ecx
xor word [esp + ecx - 0x7d0b073b], cx
cmovne ax, word [esp + ecx - 0x7d0b073b]
inc edx
imul eax, eax
neg edx
inc edx
xor ebx, edx
sar ax, 0xc7
add edi, edx
movsx edx, word [esp + ecx - 0x7d0b073d]
shl eax, 0x6c
adc word [esp + edx - 0x7d0b], dx
mov ax, word [ebp + edx*2 - 0xfa16]
xor ecx, edx
jnp 0x85c084
mov edi, 0xf8c30c94
hlt
pop edi
or dword [ebp + 0x3936b0f0], edi
jmp 0x8d1722
mov ecx, 0x7d0b073f
movsx edx, cl
mov edx, dword [edx + esi - 0x3f]
mov dword [esp + ecx - 0x7d0b073f], ecx
lea esi, [esi + ecx - 0x7d0b073b]
xor byte [esp + ecx - 0x7d0b073f], 0x31
jns 0x8d16f1
dec ecx
not ecx
lea edx, [edx - 0x35dea4cb]
cdq
not dword [esp]
sub ecx, 0xffa83805
xor ebx, ecx
xchg edx, eax
lea eax, [eax + edx*2 + 0x11846899]
add ebp, ecx
movzx edx, byte [esi]
add esi, 1
dec eax
xor dl, bl
neg ax
inc dl
inc eax
neg dword [esp]
ror dl, 1
bt eax, 0x87
movzx ecx, ax
not dl
cwde
and ecx, ecx
adc dl, 0x97
div cl
sub dword [esp + eax - 0xd03e], ecx
xor dl, 0xa
dec ax
or dword [esp + eax - 0xd03d], eax
xor bl, dl
sal cx, 0x21
dec dword [esp + eax - 0xd03d]
lea edx, [esp + edx + 4]
jns 0x98f6c0

Function at 0x8e41b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, byte [esi + edx*2 - 0x7b8660]
or al, ah
mov dword [esp + edx - 0x3dc330], edx
lea esi, [esi + edx - 0x3dc32f]
adc ax, 0x3308
xor cl, bl
not dx
rol cl, 1
lea edx, [edx + edx*4 + 0x6c1de400]
dec cl
shl ax, 0x61
neg cl
rol cl, 1
sal eax, 0xbe
xor bl, cl
mul byte [esp + eax - 0x7ffffffe]
add dword [esp + eax - 0x80000000], 0x663a9cb7
lea ecx, [esp + ecx + 4]
xor eax, edx
lea edx, [eax*4 - 0x73d1a45e]
mov edx, dword [ecx + edx - 0x416eabce]
setnp byte [esp]
sbb ebp, 4
neg eax
mov dword [eax + ebp - 0x12afebf5], edx
pop ecx
jb fcn.009338ec
mov ecx, dword fs:[eax + edx]
mov dword [edx + ebp], ecx
add edx, edi
jmp edx

Function at 0x8e51a3
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sbb cl, 0x1b
rol cl, 1
inc eax
neg cl
not eax
shl dword [esp + eax*2 - 0x19fe0740], 0x45
sbb cl, 0x94
shl al, 0x83
shr byte [esp + eax - 0xcff02fd], 0xe1
add byte [esp + eax - 0xcff02ff], ah
ror cl, 1
shr eax, 0x16
inc al
div al
sub cl, 0x36
xor cl, 0x26
add ax, ax
dec cl
xor bl, cl
neg dword [esp + eax - 2]
lea ecx, [esp + ecx + 4]
push eax
adc eax, eax
or eax, eax
shl al, 1
adc ebp, 1
cbw
mov dword [esp], 0x6dbaf085
sub esi, 1
movzx ecx, byte [esi]
ror al, 0x66
bts ax, 0xaa
not al
xor cl, bl
bswap eax
neg eax
jle 0x8cdf2a

Function at 0x8e54e4
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea edi, [edi + edx - 0x439c9c7c]
shr dl, 1
mov esi, ecx
pop edx
jns 0x861710
mov eax, 0x489e8ea1
mov dx, word [edi + eax - 0x489e8ea1]
movzx ecx, al
rol al, 0x86
mov ax, word [eax + edi - 0x489e8e66]
sbb ecx, ecx
adc cl, byte [edi + ecx*4 + 4]
call fcn.00899790
Function at 0x8ea621
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb esi, 4
mov edx, 0xef1b9217
sub eax, 0xdc182889
mov edx, dword [esi]
mov dword [esp], eax
ror dword [esp], 0xa
xor edx, ebx
lea ecx, [eax + eax*4 + 0x640dc5a5]
cwde
cwde
rol edx, 3
sar cl, 0xa2
sal ax, 0xcf
pop eax
lea edx, [edx + ecx - 0xc749877]
btr ax, ax
setb al
rol edx, 3
bt eax, 0x9d
add eax, ecx
jnp 0x98af40
neg edx
btr cx, ax

Function at 0x8efcbd
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 2
mov dword [esp + eax*4 - 0xaa199e4], 0xf50f3320
bswap eax
xor edx, 0x9ea52791
cwde
lea edx, [edx + ecx - 0x7bab92a1]
or word [esp + 2], cx
jl 0x8471f3

Function at 0x8f0fe9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
mov ecx, dword [ebp + eax + 4]
call fcn.00938c3b
jmp 0x8bf0b6
not eax
mov byte [ecx], dl
mov dword [esp], eax
mov ecx, eax
ror dword [esp], cl
mov eax, dword [esi]
movzx edx, word [esp]
lea esi, [esi + edx*4 - 0x396dc]
jb 0x98eff0
xor al, bl
inc al
add dword [esp + edx*4], ecx
sbb ecx, edx
ror al, 1
call fcn.008933b5
mov eax, 0x6a3243b7
mov edx, dword [eax + ebp - 0x6a3243b7]
btc eax, eax
jae 0x8c0ab0
mov edx, 0x1b62434
movsx eax, dx
mov edx, dword [esi + edx - 0x1b62434]
movzx ecx, al
neg cl
lea esi, [eax + esi - 0x2430]
jbe 0x8aa274

Function at 0x8f39a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edx
dec ax
bswap edx
cwde
lea edx, [edx + ecx*2 - 0x54597c54]
jp 0x984b01
mov dword [esp + ecx - 0x48350000], eax
xor edx, 0x2308af1c
not eax
xor cx, word [esp + ecx - 0x4834fffe]
xor ebx, edx
add dword [esp + ecx - 0x48350000], eax
adc esi, edx
mov edx, dword [edi + ecx - 0x48350000]
neg cx
add cl, byte [edi + ecx - 0x4834fffc]
neg dword [esp]
lea eax, [eax*4 + 0x589b8c35]
cbw
lea edi, [edi + eax - 0x589bff7f]
call fcn.00904c70

Function at 0x8fdc7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal word [esp + edx*2 + 1], 0x6d
lea esi, [esi + edx*8 + 4]
shl ax, 0x63
xor dl, byte [esp + edx*2]
setge byte [esp + edx*2]
xor ecx, ebx
cdq
sal dx, 0xc1
adc ecx, edx
bswap ecx
not al
xadd word [esp + 1], dx
lea ecx, [eax + ecx - 0x4c767fbd]
neg ecx
lea ecx, [ecx + edx - 0x7a69ffef]
ror dword [esp], 0x57
inc byte [esp + 2]
xor ebx, ecx
neg dx
jl 0x99e8c0
adc dl, 0xa1
adc ebp, ecx
pop eax
jmp fcn.0084da17
dec dx
ror al, 1
mov dword [esp + ecx - 4], 0x4104491e
neg dword [esp + ecx*2 - 8]
xor word [esp + ecx - 3], cx
xor al, 0x21
rol al, 1
and dword [esp + ecx - 4], ecx
xor bl, al
lea eax, [esp + eax + 4]
sar dx, cl
mov ecx, dword [eax + ecx*4 - 0x10]
ja 0x907805
btc dx, 0x89
mov eax, 0xb382fd28
sbb edi, 4
mov dword [edi], ecx
sub edx, edx
mov ecx, dword [edx + esi]
jae 0x8cf88f

Function at 0x8fdf57
Capabilities:
Execute anti-debugging instructions

Disassembly:
cdq
not ecx
neg dl
neg ecx
ror ecx, 2
shr edx, 0x1d
lea ecx, [ecx + eax*2 - 0x3b1e0a97]
bt eax, edx
adc eax, 0xbfb9ff9f
xor ebx, ecx
add ebp, ecx
lea ecx, [edx*4 - 0x2dd86876]
movzx cx, byte [esi + edx*8]
cdq
bts edx, 0x27
push eax
mov al, byte [esi + 2]
adc esi, 1
call fcn.0083aed8
mov ecx, dword [edi + edx*2 - 0x50500648]
mov dword [esp + edx*2 - 0x50500648], edx
xor ecx, ebx
pop edx
jmp 0x84f2b0
Function at 0x8ffa29
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x93d7a2
jmp 0x9185ff
mov cl, byte [edi + ecx - 0x4a9b59ab]
jbe 0x8c0537
push eax
lea eax, [edx*4 + 0x178fd10f]
mov edi, dword [esp + eax*2 - 0x2f24f606]
lea eax, [edx*4 + 0x7087fb1c]
call fcn.0089938d
mov eax, 0xff64484e
out dx, al
or eax, 0x9a532fbe
sbb eax, 0xd16dad54
jmp 0x8ffab3
out 0xeb, al
fcomi st(1)
inc edx
mov dh, bh
xchg ebp, eax
fcom dword [edi - 0x4b]
ljmp 0xc4e2
mov eax, 0xb034601e
mov edx, dword [esi]
add esi, 4
shr eax, 0xa1
movzx ecx, ax
add cx, 0x35b8
xor edx, ebx
add cl, ah
inc cl
bswap edx
xor al, al
call fcn.008acefc
mov edx, 0x46ab6217
lea ecx, [edx + 0x44892f87]
mov edx, dword [ebp + edx - 0x46ab6217]
lea eax, [ecx + ecx*2 + 0x4ea2a1b0]
add ebp, 4
call fcn.00858ef6
sbb edx, edx
mov edx, dword [edi + ecx*8 - 0x420]
call fcn.00984d45
mov dword [esp], 0x1105571b
adc edi, 3
call fcn.009412a8

Function at 0x9008ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
inc cx
not eax
lea eax, [eax + ecx*2 + 0x511d8463]
inc cx
shr dx, cl
mov dword [esp + edx - 0x2b01884], edx
not eax
xor ebx, eax
add ecx, 0x47b8db0f
sbb dx, cx
jbe 0x859a8d
mov edx, 0x880c491f
mov edx, ebp
push 0x9707d181
or byte [esp], 0xa
sbb ebp, 2
mov ecx, dword [esp]
shl dword [esp], 0x7c
mov word [ebp], dx
push ecx
inc cl
mov edx, dword [esi]
push ecx
adc esi, 4
mov byte [esp + 5], ch
shl ecx, cl
xor edx, ebx
lea eax, [ecx + 0x763b5cb1]
neg cx
pop eax
sbb edx, 0x618e4014
ror edx, 1
cbw
lea edx, [edx + ecx*2 - 0x5d286862]
and cx, 0x6031
xor edx, 0xce0190b4
ror edx, 3
sal dword [esp + ecx - 0x7d183ffc], 0x27
sub cl, ch
xor ebx, edx
add edi, edx
pop ecx
pop ecx
jmp fcn.009338ec
Function at 0x90519c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [ebp + ecx - 0x53b60054], ax
and edx, 0x32f7421
lea ecx, [ecx + ecx*4 + 0x2b3c620f]
ja 0x8b7717
pop ecx
jp fcn.008f8c19
mov ecx, 0x7c9e8c2e
movsx edx, cl
movzx ax, byte [ecx + edi - 0x7c9e8c2e]
shr ecx, 0xf6
mov dl, byte [ecx + edi - 0x1f0]
lea edi, [edi + ecx - 0x1f0]
shl cx, 0xa2
adc al, dl
mov edx, 0xa5b090a7
shr edx, 0xf
mov word [edi + ecx*4 - 0x1f20], ax
movzx eax, cx
mov eax, dword [esi + ecx*2 - 0xf90]
xor edx, 0xacb5fe2c
btr dx, cx
lea esi, [esi + ecx - 0x7c4]
not ecx
shl ecx, cl
xor eax, ebx
not eax
shr cx, 0x81
sbb eax, 0xfab2bd93
jmp 0x863a19
xor eax, 0xb02911b2
rol eax, 1
mov edx, 0xf232f30
mov ecx, edx
mov edx, dword [edi + edx - 0xf232f30]
add ecx, 0x58b4aba6
movzx eax, cl
sar cx, 0xe2
mov eax, dword [edx + ecx - 0x67d7f6b5]
lea edx, [ecx*2 - 0x3efe46e0]
push ecx
mov dword [edi + ecx - 0x67d7f6b5], eax
mov ecx, dword [esi + ecx - 0x67d7f6b5]
adc esi, 3
lea eax, [edx + edx + 0x54a974b0]
and dl, al
xor ecx, ebx
bswap ecx
xadd dx, ax
cdq
neg ecx
bswap ecx
rol al, 0xe2
add eax, 0xf2b96e1b
sar eax, 0x41
adc ecx, edx
xor ecx, 0xb481961e
push eax
imul al
ror ax, 0x29
lea ecx, [ecx + edx + 0x213a071e]
and dl, byte [esp + edx + 5]
and dword [esp + edx + 4], eax
mov word [esp + edx + 6], dx
xor ebx, ecx
add ebp, ecx
sal word [esp + edx + 3], 0xab
shl edx, 0x61
mov dword [esp + edx*2], ebp
ret 4
mov dword [esp + edx*2 - 0x12], edx
add cx, 0xd8ad
rol ax, 1
xor ax, 0x691d
shr dl, 0xa5
imul ecx, dword [esp + edx*8]
sar word [esp + edx*4 + 2], 0xc1
xor bx, ax
lea ebp, [ebp + ecx - 0x53b62a68]
inc ecx
sar cx, cl
jbe 0x8537af
mov eax, dword [esi]
mov edx, 0x441c76a9
lea esi, [esi + edx - 0x441c76a5]
movzx ecx, dl
btc dx, 4
or dx, 0xf737
xor eax, ebx
not cl
btc edx, edx
not eax
shr cl, 0xe1
dec cl
xor eax, 0xdc85c69d
rol eax, 1
neg cl
shr dx, 0xe5
not cl
dec eax
xor ebx, eax
inc edx
sal edx, 0x53
sar ecx, cl
adc ebp, eax
mov eax, 0xb617ab28
add dx, word [edi + edx*2 - 0x7be00000]
push ecx
or eax, dword [esp + ecx]
xchg byte [esp + ecx + 3], ah
xor cx, word [edi + ecx + 2]
add edi, 2
div al
inc word [esp]
and dx, cx
rol eax, 0x9e
not dx
movsx ecx, ax
mov word [edi + eax - 0x6d85c000], dx
mov edx, ecx
mov dword [esp + eax - 0x6d85c000], ebp
ret
Function at 0x906995
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov ebp, dword [ebp + eax - 0x44d8]
shr dx, 0x88
js 0x9c391a
or ax, 0x8980
pop edx
jae fcn.009338ec
xor eax, 0x5737f61a
not eax
xor eax, 0x60b0d6bc
inc dx
not eax
or dword [esp + edx + 0x256f0c74], ecx
sar cl, 0x63
add edx, ecx
xor ebx, eax
dec edx
add ebp, eax
mov word [esp + edx*2 + 0x67ae8edb], dx
dec edx
btc ecx, edx
mov dword [esp + edx + 0x33d7476c], ebp
ret 4
xor ebx, ecx
ror edx, 0xe7
add esi, ecx
mov ax, word [edi]
movzx ecx, dl
call fcn.00949203
xor eax, ebx
not eax
lea ecx, [ecx*2 + 0x4a8d39a5]
sub eax, 0x4d074fb0
movsx edx, byte [esp + ecx - 0x4a8d39a5]
rol edx, 0x5f
inc dword [esp + ecx - 0x4a8d39a5]
not eax
neg eax
add byte [esp + ecx - 0x4a8d39a2], ch
not eax
xadd dword [esp + ecx - 0x4a8d39a5], edx
bt ecx, 0x11
pop edx
neg eax
sub eax, 0x8d07a52b
rol eax, 1
imul ecx, edx
sub ecx, edx
btr cx, 0x87
xor ebx, eax
call fcn.009bc5ed

Function at 0x90b5de
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
mov ecx, dword [esp + 8]
mov eax, 0x94122c3d
push eax
lea edx, [edx + ecx - 0x62d25b85]
or ecx, 0xe9123c3b
xor ebx, edx
call fcn.00907823

Function at 0x90c3a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ecx
bts dx, 0xbd
shr dword [esp + edx*4 - 0x8000], 0x34
adc ebp, ecx
lea eax, [eax + eax + 0x3514fdbc]
pop edx
jmp fcn.00943216
xor dl, bl
mov dword [esp + ecx - 0xba01], ecx
ror dl, cl
shr cx, 0x2a
sar eax, 0x24
shl eax, cl
adc dl, 0xa5
xor dl, 0x9c
dec al
shl ecx, cl
rol ax, 0xcb
adc dl, 0x83
sar ecx, 0xf6
bts eax, 0x11
rol dl, 1
sal dword [esp + eax*2 - 0x5f00e], 0xf8
xor bl, dl
lea ebp, [ebp + eax*2 - 0x5f010]
inc cx
ror word [esp + eax - 0x2f806], cl
mov word [ebp + eax*2 - 0x5f00e], dx
movsx edx, word [esp + eax*2 - 0x5f00e]
pop edx
jae fcn.009338ec
lea ecx, [ecx + eax + 0x7bbd091d]
bswap ecx
shl word [esp + eax], 0x43
dec dword [esp + eax]
xchg byte [esp + eax*2 + 2], al
ror ecx, 1
movzx edx, ax
rol eax, 0xf0
jae 0x8a1a40

Function at 0x90d641
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ecx
or dword [esp + edx - 0x30], eax
adc edi, ecx
imul eax
pop ecx
movzx ecx, word [esp + edx*4 + 2]
pop eax
pop edx
jae fcn.009338ec
push ebp
pushfd
mov ebp, 0x9e055b13
xor bp, 0x1819
mov ebp, 0xce9a2e1d
mov ebp, dword [esp + ebp + 0x3165d1e7]
mov dword [esp + 4], 0x997f7d
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.0086d8fc
Function at 0x91290c
Capabilities:
Encode data using base64

Disassembly:
jo 0x93cb52
mov dword [esp + edx], edx
not eax
xchg word [esp + edx + 1], dx
jbe 0x9895f7
xor cx, cx
xor ebx, eax
lea edx, [edx + ecx*8 - 0x17635a5e]
and cx, cx
xadd dl, ch
adc ebp, eax
jmp 0x97c291
add byte [eax], al
add cl, al
je 0x9372a7
add byte [esi - 1], cl
dec esp
and al, 2
push 0x38bf45be
shld eax, edx, cl
jmp 0x97b062
cwde
btc edx, 0x9e
xor ecx, ebx
bswap ecx
cwd
sar ax, 0x63
sal ax, 0xc8
inc ecx
cwde
rol ecx, 1
sub ecx, 0x4ae2fba
btc eax, eax
jae 0x87e391
mov ebp, 0x9bdb1eeb
jl 0x9372d7
lodsb al, byte [esi]
cdq
loopne 0x93727d
invalid
mov cx, word [edi + edx - 0x372f8d99]
lea eax, [edx + edx*8 - 0x7b6ec879]
push edx
rol eax, 0x81
mov ax, word [edi + edx - 0x372f8d97]
lea edx, [edx*4 - 0x2ff14e49]
jae 0x8c7539
mov ecx, dword [ebp]
mov eax, 0xe3b30310
lea edx, [eax + eax*4 - 0x76d26976]
mov ax, word ss:[ecx]
bt dx, dx
movzx ecx, dl
lea ebp, [ebp + ecx - 0xd8]
mov word [ecx + ebp - 0xda], ax
movzx eax, dl
lea esi, [esi + ecx - 0xde]
adc ecx, eax
lea eax, [eax*8 + 0x8adc894]
mov ecx, dword [ecx + esi - 0x1b5]
jnp 0x9372c3
and edx, 0xab8ab4be
not ecx
not byte [esp + edx]
jle 0x8b99bb

Function at 0x913abc
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ebp, 4
mov dword [ebp], ecx
mov ecx, edx
sub eax, edx
pop ecx
pop edx
pop edx
pop ecx
pop eax
pop ecx
pop ecx
pop edx
pop edx
jne fcn.009338ec
mov eax, 0x7101890e
bts eax, 0x90
movsx edx, ax
lea edi, [edi + eax - 0x71018910]
movzx eax, word [edi + eax - 0x7101890e]
movsx ecx, dx
xor ax, bx
not cx
add ax, 0x603f
not ax
sub ax, 0xef1f
bswap ecx
not cl
rol ax, 1
jmp 0x86983f
Function at 0x9229cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
or cx, ax
sar al, 0xa6
xor edx, ebx
shr ecx, 0xf5
neg edx
xor cx, 0x5a09
xor ax, 0x2105
rol edx, 1
lea edx, [edx + eax*2 - 0x1d022b32]
dec cx
and cl, 0xaf
not edx
bt ax, ax
sub ax, cx
add al, ch
xor ebx, edx
cwde
add edi, edx
jmp fcn.009338ec
neg ecx
not edx
sal al, 0xe6
btr eax, ecx
inc edx
btr ecx, 0x11
call fcn.008426fc
add dl, 0x12
sub ecx, ecx
jle 0x97e070
sar ecx, 0xc3
not edx
xor ebx, edx
add esi, edx
cbw
jmp esi
not dl
btr eax, 0x99
adc dl, cl
xor bl, dl
lea ebp, [ecx + ebp - 4]
or cx, ax
shr cl, 0xa1
mov dword [ecx + ebp - 0x9446], edx
movzx edx, ax
div eax
mov edx, dword [esi + eax - 0x95d4]
lea esi, [esi + eax - 0x95d0]
jmp 0x87a42d
Function at 0x925981
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + edx*4 + 0x4638a013]
movsx eax, dl
xor cl, ch
jmp ebp
sbb eax, 0x623b2438
sal edx, 0x5b
sar cx, 0xe2
jae 0x976c7c
mov ecx, 0x3c30fb9a
lea edx, [ecx + ecx*8 - 0x2b7e88cb]
movsx eax, dx
mov eax, ebp
lea ebp, [ebp + ecx - 0x3c30fb9c]
inc edx
mov word [ebp + ecx*2 - 0x7861f734], ax
lea esi, [esi + ecx*2 - 0x7861f738]
mov eax, dword [ecx + esi - 0x3c30fb9a]
shl dx, 0x81
xor eax, ebx
btr ecx, edx
lea eax, [ecx + eax + 0x4f60b922]
sub cx, 0x9687
bswap eax
jp 0x97dfe1
setnp cl
push edx
xor eax, 0x4f2c1723
inc eax
xor ebx, eax
add edi, eax
pop edx
jmp fcn.008f8cf2
xor cl, 0x96
xchg ecx, edx
ror eax, 1
bswap eax
rol ecx, cl
rol dl, 0xa4
xor ebx, eax
sar dx, cl
adc ebp, eax
mov eax, dword [edi + edx*8 - 0x30]
call fcn.0085e3bf
shr cx, 0x22
bswap eax
dec edx
xchg word [esp + eax - 0xaa7fffe], ax
xadd cx, ax
je 0x40742c
bswap edx
xor ecx, 0x489c78c
sbb edx, 0xe2be7a2c
push eax
ror edx, 1
dec word [esp + eax - 0xaa7fffd]
not edx
rol ax, 0xc4
xor ebx, edx
xchg ah, al
sub ecx, ecx
adc ebp, edx
movsx edx, word [esp + ecx*2 + 1]
add dword [esp + ecx + 4], 0xef323820
pop edx
pop edx
ja fcn.00942899
mov dword [esp], ecx
adc edi, 1
push ecx
xchg dword [esp], ecx
movzx ecx, byte [esi]
shr word [esp + 2], 0x2b
setne byte [esp + 3]
adc esi, 1
mov eax, dword [esp + 1]
xor dword [esp + 2], eax
xor cl, bl
dec cl
sar ax, 0xa7
div al
dec ax
not cl
setle al
sar eax, 0x35
adc cl, 0xab
neg cl
push eax
shr dword [esp], 0x38
xadd dword [esp + 8], eax
xor bl, cl
ror al, 0x83
lea ecx, [esp + ecx + 0xc]
mov word [ecx], dx
push eax
mov eax, dword [esi]
mov ecx, 0x543bcd33
lea esi, [esi + ecx - 0x543bcd2f]
xor eax, ebx
sub cx, cx
lea eax, [ecx + eax + 0x54f84fb4]
js 0x8e2888
ror word [esp + ecx - 0x543b0000], 0xce
mov dword [esp + ecx - 0x543afffb], 0xc856a11
neg eax
movzx edx, cx
xadd dword [esp + ecx - 0x543afff6], edx
lea ecx, [edx + ecx - 0x684b36cd]
bswap eax
call fcn.0097804e
neg ax
mov eax, dword [esi + edx*2 - 0x6f221a1a]
xor eax, ebx
inc edx
sal cl, 0xc6
js 0x83f864
xor edx, dword [esp]
xor al, 8
xor bl, al
bts dx, dx
lea eax, [esp + eax + 4]
ror edx, cl
lea edx, [edx + edx - 0x6fe1b73]
ror ecx, cl
mov cx, word [eax]
sbb ebp, 1
push edx
mov word [ebp], cx
pop eax
pop ecx
jmp fcn.009338ec
not eax
adc ecx, 0xf1ae51aa
dec eax
add edx, 0x35966a10
xor eax, 0x3806c39d
inc eax
bts edx, edx
xor ebx, eax
xor ecx, ecx
adc ebp, eax
movsx eax, cx
xor cx, ax
jl 0x8dcb3c
adc ecx, ebp
jmp ecx
inc edx
setle dl
sar dx, 2
adc cl, 0x19
sub dx, 0x440d
not edx
imul edx, edx
ror cl, 1
xor byte [esp + 1], dh
setb byte [esp]
pop edx
xor bl, cl
rol dl, 0xc6
adc ecx, esp
bt dx, 0x30
sub dl, 0x18
mov word [ecx + edx*2 - 0x261dd0], ax
movzx ecx, dl
lea esi, [edx + esi - 0x130eec]
movsx eax, cx
sar cl, 0x83
bt ax, dx
mov eax, dword [edx + esi - 0x130ee8]
xor eax, ebx
xadd dl, dh
xor ecx, edx
ror eax, 2
bswap eax
ror ecx, cl
sbb edx, ecx
sbb eax, 0xa3125534
inc edx
add edx, edx
ror eax, 1
shl edx, 0xb8
dec eax
xor cx, cx
sbb dl, dh
xor ebx, eax
add ebp, eax
or ecx, edx
lea eax, [ecx*8 - 0x597eed53]
jmp ebp
Function at 0x92ae4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + eax*8 - 0x7fff8], eax
shr byte [esp + eax - 0xfffd], 0x83
mov bp, word [ebp + eax*4 - 0x3fffc]
sal word [esp + eax - 0xfffd], 0x2d
and ax, 0x258f
rol eax, cl
pop ecx
jnp fcn.009338ec

Function at 0x92cf4a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx*2 - 0x7710274c], 0x892a584
mov eax, dword [edi + edx*2 - 0x7710274c]
mov edx, dword [edx + edi - 0x3b8813a2]
mov cl, byte [edi + 8]
add edi, 6
shld eax, edx, cl
mov ecx, dword [esp]
mov edx, dword [esp + ecx - 0x892a584]
mov dword [ecx + edi - 0x892a584], eax
add dword [esp + ecx - 0x892a584], edx
not ecx
mov edx, dword [esi + edx*2 - 0x11254b08]
adc esi, 4
xor edx, ebx
jmp 0x9468a0

Function at 0x932cf3
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc eax, ebp
jmp eax
adc ebp, edx
mov si, word [esi + eax*4 - 0x5ffc]
lea edx, [ecx*4 - 0x627b2557]
and dword [esp + eax - 0x17ff], ecx
pop ecx
jle fcn.00942899
mov ecx, 0x5fb82890
inc cl
mov edx, dword [esi + ecx - 0x5fb82891]
lea eax, [ecx*4 + 0x34856792]
neg ecx
adc esi, 3
add ax, 0x6706
sub eax, ecx
xor edx, ebx
and cl, ch
lea edx, [ecx + edx - 0x63b2662a]
xadd ecx, eax
rol ecx, cl
xor edx, 0x421d759a
shr ecx, cl
lea edx, [eax + edx + 0x3c6479c4]
adc eax, 0xdbbcd83a
sub al, al
xor edx, 0x3bb509c
xor ebx, edx
add ebp, edx
movzx edx, ax
and ax, dx
mov edx, dword [edi + ecx*2 - 0x2d2cd8]
shl ax, cl
sub cx, ax
cbw
mov cx, word [edi + ecx - 0x169668]
and al, 0x11
lea edi, [edi + eax - 0x7c03fffa]
ror al, 0xa5
xor eax, eax
mov word ss:[edx + eax*8], cx
jbe 0x406973
inc edx
pop edx
pop ecx
jle fcn.009338ec
mov ecx, 0x7fb11814
mov edx, edi
shr cl, 0x66
movzx eax, cx
bt ax, ax
lea edi, [edi + eax - 0x1804]
shl al, 0x67
mov dword [edi + ecx - 0x7fb11800], edx
xadd ax, cx
or al, 0x87
lea esi, [esi + ecx - 0x7fb11804]
mov ecx, dword [esi + ecx - 0x7fb11800]
sar eax, 0x7e
xor ecx, ebx
call fcn.009b7169
sub edi, 4
push 0x470ff828
pop eax
mov edx, dword [eax + edi - 0x470ff828]
movzx ecx, ax
idiv cl
xchg ah, cl
xor edx, ebx
and cx, 0x190f
xor edx, 0xe1343216
dec edx
lea eax, [ecx - 0x3077ec56]
and cl, al
xor edx, 0x5008b6b8
or cx, cx
neg edx
push ecx
xchg ecx, eax
inc edx
dec eax
shl cx, 0x65
xor ebx, edx
sal cx, 0xc8
sete byte [esp + eax - 0x17ff]
jns 0x8a645c
mov eax, 0x2f9c7613
mov eax, dword [ebp + eax*2 - 0x5f38ec26]
mov edx, 0x24ac352d
push edx
inc byte [esp + edx*2 - 0x49586a57]
lea ebp, [ebp + edx - 0x24ac3529]
movzx ecx, byte [esp + edx - 0x24ac352d]
xor eax, ebx
btr cx, 0xe
bswap edx
or ecx, edx
lea eax, [eax + edx*4 - 0x5e3f9ff2]
bts cx, 0xaa
rol cx, cl
btr edx, ecx
not eax
rol ecx, cl
sbb dword [esp + edx*2 - 0x5a6b5808], 0x2d102439
xor eax, 0xcc0611af
and dword [esp + edx*2 - 0x5a6b5808], 0x4bb8e12d
mov byte [esp + edx - 0x2d35ac04], dh
ror eax, 1
xor ebx, eax
imul edx, ecx
add esi, eax
btr ecx, ecx
sal dword [esp], cl
mov edx, dword [edi]
not ecx
lea edi, [edi + ecx - 0x59494f76]
call fcn.0090bfd4

Function at 0x9334e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
movzx edx, ax
pop ecx
pop ecx
pop eax
pop ecx
jmp fcn.009338ec