joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018040
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x800
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
nop
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea esi, [eax + eax]
xor edx, esi
xor edx, eax
mov dword [esp + ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], eax
mov dword [esp + eax*4 + 0x10], ecx
and edx, 0xff
inc ecx
cmp ecx, 0x100
mov eax, edx
jl 0x10018050
mov eax, 1
mov ecx, 0x4577d31a
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, 0xff
add ecx, 4
cmp ecx, 0x4577d372
mov eax, edx
jl 0x10018090
mov byte [0x4577ea1a], 0x63
mov byte [0x4577cb91], 0
mov ebx, 1
jmp 0x100180d0
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x4577ea1a], al
mov byte [eax + 0x4577cb72], bl
inc ebx
cmp ebx, 0x100
jl 0x100180d0
xor ecx, ecx
movzx esi, byte [ecx + 0x4577ea1a]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], eax
rol eax, 8
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], eax
rol eax, 8
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], eax
rol eax, 8
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], eax
movzx eax, byte [ecx + 0x4577cb72]
test eax, eax
je 0x100181f8
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
cdq
idiv esi
mov edx, dword [esp + edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0x10018200
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], edx
rol edx, 8
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], edx
rol edx, 8
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], edx
rol edx, 8
mov dword [ecx*4 + reloc.PSAPI.DLL_GetMappedFileNameW], edx
inc ecx
cmp ecx, 0x100
jl 0x10018142
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x100187c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
push edi
push 0x118
mov edi, eax
lea eax, [esp + 0x14]
push 0
push eax
call fcn.1001a0a0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
lea esi, [edi + 8]
lea ecx, [esp + 0x20]
mov dword [edi + 4], esi
call fcn.10018250
mov ebx, eax
add esp, 0x10
mov dword [esp + 0xc], ebx
test ebx, ebx
jne 0x100188d6
mov eax, dword [esp + 0x10]
mov dword [edi], eax
shl eax, 4
add eax, dword [esp + 0x14]
add esi, 4
mov edx, dword [eax]
mov dword [esi - 4], edx
mov ecx, dword [eax + 4]
add eax, 4
mov dword [esi], ecx
mov edx, dword [eax + 4]
add eax, 4
add esi, 4
mov dword [esi], edx
mov ecx, dword [eax + 4]
add eax, 4
add esi, 4
mov dword [esi], ecx
mov ecx, dword [edi]
dec ecx
add esi, 4
sub eax, 0x1c
test ecx, ecx
jle 0x100188b6
mov edx, 4
mov edi, edi
movzx edi, byte [eax + 3]
movzx edi, byte [edi + 0x4577ea1a]
movzx ebx, byte [eax + 2]
movzx ebx, byte [ebx + 0x4577ea1a]
mov edi, dword [edi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
movzx ebx, byte [eax + 1]
movzx ebx, byte [ebx + 0x4577ea1a]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov ebx, dword [eax]
and ebx, 0xff
movzx ebx, byte [ebx + 0x4577ea1a]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
add esi, 4
mov dword [esi - 4], edi
add eax, 4
sub edx, 1
jne 0x10018850
dec ecx
sub eax, 0x20
test ecx, ecx
jg 0x10018849
mov ebx, dword [esp + 0xc]
mov edx, dword [eax]
mov dword [esi], edx
mov ecx, dword [eax + 4]
add eax, 4
add esi, 4
mov dword [esi], ecx
mov edx, dword [eax + 4]
add esi, 4
add eax, 4
mov dword [esi], edx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov edx, dword [reloc.PSAPI.DLL_GetMappedFileNameW]
push 0x118
lea ecx, [esp + 0x14]
push 0
push ecx
call edx
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047b0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10047ad5
lea esp, [esp + 4]
inc ebp
not ebx
sub esp, 9
jns 0x10047a92
lea esp, [esp + 1]
jmp 0x10047ad9
lea esp, [esp + 1]
add ebp, dword [edi]
xchg bx, ax
inc dx
jmp 0x10047ae5
mov dword [esp], ebx
xchg edx, eax
mov dx, 0x9f3b
jmp 0x10047aa8
Function at 0x10060f14
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edi
bsr edx, edx
mov dx, 0x8106
pushal
jmp 0x10060f23
inc edx
bswap edx
mov edx, ecx
mov edx, 0xfb90727f
not dx
jmp 0x10060efe
lea edx, [esi*4]
shr dx, cl
lea edi, [edi + 0x16]
mov dx, word [esp]
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
mov edx, 0x250f59ce
jmp 0x10060f78
mov dh, ch
mov edx, 0x50ff7160
xchg dword [esp + 0x20], edi
call fcn.10060f62

Function at 0x10061d47
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub eax, 0xc2960f3c
mov eax, ebp
mov edx, dword [eax]
setbe ah
mov eax, dword [esp]
mov ah, 0xe3
jmp 0x10061d4e
not eax
setp ah
jmp 0x10061d31
mov dword [ecx + esi], edx
cmc
jmp 0x10061dab
mov dl, ah
clc
rcr dx, cl
rcr edx, cl
jmp 0x10061d95
rcr dx, cl
call 0x10061ec4
sti
jge 0x10061d5c
je 0x10061cf8
add cl, ah
dec esi
fdivr qword [ebx - 0x59a068aa]
add ebp, 4
dec ax
js 0x10061e2d
rdtsc
mov dl, 0x91
jmp 0x10061e47
jbe 0x10061d58
mov dl, ah
clc
jmp 0x10061d64
mov dl, 0x91
mov eax, esp
jmp fcn.10060d3d
rdtsc
jmp 0x10061e17
mov eax, esp
jmp fcn.10060d3d

Function at 0x1009eba3
Capabilities:
Encode data using base64

Disassembly:
mov edi, eax
jmp 0x1009ebaa
lea esp, [esp + 4]
push edi
jmp 0x1009eb8c
mov al, byte [ecx]
call fcn.1009ebb2
dec esi

Function at 0x1009ebb2
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
dec ebx
jne 0x1009df77
je 0x1009e618
lea esp, [esp + 4]
cmp al, 0x41
jmp 0x1009ebed
jb 0x1004bbd9
jae 0x1009ebd7
push edi
aad 0x45
sub al, 0xdf
mov dword ss:[esi - 0x2c], 0x73a64eb3
sti
imul ecx, dword [esi], reloc.PSAPI.DLL_GetMappedFileNameW
or bl, byte [esi - 0x77]
and al, 0x24
shl edi, 2
jmp 0x1009e759
Function at 0x100b3dd5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop edi
call 0x100b3c13
push esi
lea esp, [esp + 4]
jmp 0x100b4032
jmp 0x100b3ea4
sub esp, 0x17
add esp, 4
lea esp, [esp + 3]
jmp 0x100b3e74
test edi, edi
jmp 0x100b3ff8
mov ecx, 0x7ab338e
mov ecx, 0xa35aff36
mov cx, word [esp]
cmc
jmp 0x100b3dad
lea ecx, [ecx + ebp]
jmp 0x100b3dc3
test edi, edi
pushfd
lea esp, [esp + 4]
je 0x100b3c0c
jne 0x100b3d88
mov ecx, dword [ebp + 8]
sub esp, 4
pushal
push sp
lea esp, [esp + 2]
jmp 0x100b3dc9
push ebx
jmp 0x100b3c8f
lea esp, [esp + 0x24]
mov cl, byte [ecx]
call 0x100b3dd5
imul ecx, dword [ecx + reloc.PSAPI.DLL_GetMappedFileNameW], 0x34eb0124
lea esp, [esp + 4]
mov byte [eax + esi + 0x18], cl
jmp 0x100b3dfc
push edi
mov edi, esi
mov dword [edi], edx
pop edi
jmp 0x100b3d9e
inc eax
jmp 0x100b3e65
sub esp, 0x12
add esp, 0xc
lea esp, [esp + 2]
lea esp, [esp + 0x18]
add dword [esi + 4], ecx
jmp 0x100b3df4
jne 0x100b3c63
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
xor ecx, ecx
mov dx, 0x24fc
jmp 0x100b3e8a
inc dword [ebp + 8]
sub esp, 8
lea esp, [esp + 8]
cmp eax, 0x40
jmp 0x100b3e3f
movzx edx, byte [eax + 1]
seto bl
jmp 0x100b3ecb
neg edx
lea eax, [esi + 0x1a]
jmp 0x100b3c3f
mov ecx, edi
sub esp, 0x15
lea esp, [esp + 1]
shr ecx, 0x1d
jmp 0x100b3e2c
push eax
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x100b3eed
movzx ebx, byte [eax]
push di
push ax
shl edx, 8
jmp 0x100b3eb5
shl edx, 8
jmp 0x100b3fe1
or edx, ebx
bswap ebx
movzx ebx, byte [eax - 1]
stc
jmp 0x100b3ed7
cmp edx, ecx
lea esp, [esp + 4]
jae 0x100b3c29
inc dword [esi + 4]
jmp 0x100b3c29
push bx
add esp, 1
lea esp, [esp + 1]
jmp 0x100b3f62
shl edx, 8
or edx, ebx
sub esp, 0
mov dword [ebp + ecx*4 - 0x40], edx
jmp 0x100b3f1c
lea esp, [esp + 0x24]
add eax, 4
cmp ecx, 0x10
jb 0x100b3c3f
jae 0x100b3f81
push edi
aad 0x45
sub al, 0xdf
mov dword ss:[esi - 0x2c], 0x77a64eb3
pop esi
test eax, 0x24648dc8
xor byte [ecx + 0x50], al
lea esp, [esp + 0x30]
inc ecx
push eax
pushal
jmp 0x100b3f40
lea ecx, [esi + 8]
jmp 0x100b3fc1
mov cl, al
mov ax, 0xc003
mov cx, word [esp]
jmp 0x100b3f6b
movzx ebx, byte [eax - 2]
sub esp, 0x1d
mov dword [esp + 0x18], ebp
stc
lea esp, [esp + 1]
jmp 0x100b3f32
bsr eax, ecx
jmp 0x100b3ff1
lea eax, [ebp - 0x40]
call fcn.100750c0
mov eax, ebp
setae al
jmp 0x100b3fab
or edx, ebx
lea ebx, [edi*4]
dec bx
sbb bl, 0x92
jmp 0x100b3f99
xor eax, eax
jmp 0x100b3c63
jne 0x100b3c8f
je 0x100b404c
adc ebx, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
jnp 0x100b4004
popfd
push 0x7b
cld
xchg edx, eax
cmc
add al, 0xe6
dec ecx
call 0x3ce8e21d
cmc
mov byte [esp + 2], ch
jmp 0x100b3f08
pop ebx
jmp 0x100b3c0c
Function at 0x100b4012
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop edi
call 0x100b3c13
push esi
lea esp, [esp + 4]
jmp 0x100b4032
jmp 0x100b3ea4
sub esp, 0x17
add esp, 4
lea esp, [esp + 3]
jmp 0x100b3e74
test edi, edi
jmp 0x100b3ff8
mov ecx, 0x7ab338e
mov ecx, 0xa35aff36
mov cx, word [esp]
cmc
jmp 0x100b3dad
lea ecx, [ecx + ebp]
jmp 0x100b3dc3
test edi, edi
pushfd
lea esp, [esp + 4]
je 0x100b3c0c
jne 0x100b3d88
mov ecx, dword [ebp + 8]
sub esp, 4
pushal
push sp
lea esp, [esp + 2]
jmp 0x100b3dc9
push ebx
jmp 0x100b3c8f
lea esp, [esp + 0x24]
mov cl, byte [ecx]
call 0x100b3dd5
imul ecx, dword [ecx + reloc.PSAPI.DLL_GetMappedFileNameW], 0x34eb0124
lea esp, [esp + 4]
mov byte [eax + esi + 0x18], cl
jmp 0x100b3dfc
push edi
mov edi, esi
mov dword [edi], edx
pop edi
jmp 0x100b3d9e
inc eax
jmp 0x100b3e65
sub esp, 0x12
add esp, 0xc
lea esp, [esp + 2]
lea esp, [esp + 0x18]
add dword [esi + 4], ecx
jmp 0x100b3df4
jne 0x100b3c63
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
xor ecx, ecx
mov dx, 0x24fc
jmp 0x100b3e8a
inc dword [ebp + 8]
sub esp, 8
lea esp, [esp + 8]
cmp eax, 0x40
jmp 0x100b3e3f
movzx edx, byte [eax + 1]
seto bl
jmp 0x100b3ecb
neg edx
lea eax, [esi + 0x1a]
jmp 0x100b3c3f
mov ecx, edi
sub esp, 0x15
lea esp, [esp + 1]
shr ecx, 0x1d
jmp 0x100b3e2c
push eax
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x100b3eed
movzx ebx, byte [eax]
push di
push ax
shl edx, 8
jmp 0x100b3eb5
shl edx, 8
jmp 0x100b3fe1
or edx, ebx
bswap ebx
movzx ebx, byte [eax - 1]
stc
jmp 0x100b3ed7
cmp edx, ecx
lea esp, [esp + 4]
jae 0x100b3c29
inc dword [esi + 4]
jmp 0x100b3c29
push bx
add esp, 1
lea esp, [esp + 1]
jmp 0x100b3f62
shl edx, 8
or edx, ebx
sub esp, 0
mov dword [ebp + ecx*4 - 0x40], edx
jmp 0x100b3f1c
lea esp, [esp + 0x24]
add eax, 4
cmp ecx, 0x10
jb 0x100b3c3f
jae 0x100b3f81
push edi
aad 0x45
sub al, 0xdf
mov dword ss:[esi - 0x2c], 0x77a64eb3
pop esi
test eax, 0x24648dc8
xor byte [ecx + 0x50], al
lea esp, [esp + 0x30]
inc ecx
push eax
pushal
jmp 0x100b3f40
lea ecx, [esi + 8]
jmp 0x100b3fc1
mov cl, al
mov ax, 0xc003
mov cx, word [esp]
jmp 0x100b3f6b
movzx ebx, byte [eax - 2]
sub esp, 0x1d
mov dword [esp + 0x18], ebp
stc
lea esp, [esp + 1]
jmp 0x100b3f32
bsr eax, ecx
jmp 0x100b3ff1
lea eax, [ebp - 0x40]
call fcn.100750c0
mov eax, ebp
setae al
jmp 0x100b3fab
or edx, ebx
lea ebx, [edi*4]
dec bx
sbb bl, 0x92
jmp 0x100b3f99
xor eax, eax
jmp 0x100b3c63
jne 0x100b3c8f
je 0x100b404c
adc ebx, dword [ebx + reloc.PSAPI.DLL_GetMappedFileNameW]
jnp 0x100b4004
popfd
push 0x7b
cld
xchg edx, eax
cmc
add al, 0xe6
dec ecx
call 0x3ce8e21d
cmc
mov byte [esp + 2], ch
jmp 0x100b3f08
pop ebx
jmp 0x100b3c0c
Function at 0x1018ad4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
add ecx, 0x24
clc
xor edx, ecx
jmp 0x1018ad20
sub esp, 0x14
mov edx, 0xe969ebf4
pop dword [esp + 4]
mov edx, dword [ecx + 0x24]
clc
jmp 0x1018acd9
push 0
jmp 0x1018ad27
clc
mov ecx, dword [eax]
push edx
stc
jmp 0x1018ad0a
push 1
clc
call 0x1018adc6
fcomp dword [esi - 0x34]
stosd dword es:[edi], eax
xchg di, ax
sub dh, byte [ebx + 0x51b54623]
and dword ss:[ebx + esi + reloc.PSAPI.DLL_GetMappedFileNameW], ebx
add al, 0xf
test ch, ch
and bh, 0xff
jne 0x1018acf8
call 0x1018ad7e
loop 0x1018adc4
sub eax, 0x66000000
loop 0x1018adc4
pop ss
loop 0x1018adbc
movsb byte es:[edi], byte [esi]
daa
mov bh, 0xd2
and dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW], ebp
mov esi, 0xffe4e853
push ebx
invalid
in al, 0xff
invalid
or ecx, eax
sub dword [edx + reloc.PSAPI.DLL_GetMappedFileNameW], ebp
dec ebx
loop 0x1018ad99
insb byte es:[edi], dx
jg 0x1018ad0c
and al, 8
call dword [0x4577049a]
not cx
jmp fcn.1018ad68
xor ecx, eax
push di
push edi
lea esp, [esp + 2]
lea esp, [esp + 0xc]
call ecx
jmp fcn.10002e37
jl 0x1018ad4d
jl 0x1018ad71
movsb byte es:[edi], byte ss:[esi]
ret
fsub qword [edi - 0x72f4137d]
and al, 3
jmp 0x1018ad96

Function at 0x1018dc35
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 3
jmp 0x1018dc72
jmp 0x1018dcd6
mov edx, dword [esp + 0x14]
setg al
push 0
xchg ah, al
jmp 0x1018dd1e
or eax, reloc.PSAPI.DLL_GetMappedFileNameW
cmc
jmp 0x1018df24
jmp 0x1018dca8
mov bh, byte [esp]
pop edi
setne cl
call fcn.1018dc5c
mov dword [esp], ebp
lea esp, [esp + 4]
jne 0x1018d3f6
je 0x1018d30d
lea esp, [esp + 8]
xor ecx, esp
jmp 0x1018dcec
mov ecx, dword [ebp + 0x10]
bswap edx
jmp 0x1018d3fb
call fcn.100198ca
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 0x1c]
push eax
push ebx
jmp 0x1018dd8a
mov dword [esp], ecx
push edx
call fcn.1018dd26
jne 0x1018d453
lea esi, [ecx + edi]
cmp si, 0x6724
bswap edx
neg ecx
jmp 0x1018dde8
lea eax, [esp + 0x18]
lea edx, [edi + 0x10]
neg si
bswap esi
shr si, 9
jmp 0x1018de0e
lea ecx, [eax + 0x20]
sub esp, 0xd
lea esp, [esp + 1]
lea esp, [esp + 0xc]
jmp 0x1018ddc1
mov esi, eax
pushal
call fcn.1018ddf8
popal
invalid
pop edi
pop esi
mov ecx, ebp
setp bl
jmp 0x1018df41
sub esp, 3
lea esp, [esp + 3]
pop ebx
mov ch, byte [esp]
mov cx, 0x2ba9
jmp 0x1018df8f
mov esp, ebp
jmp 0x1018df79
pop ebp
ret 0xc
mov ecx, dword [esp + reloc.PSAPI.DLL_GetMappedFileNameW]
xor ecx, esp
call fcn.100198ca
jmp 0x1018df52

Function at 0x1018dd26
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 1], dh
jmp 0x1018dd58
lea esp, [esp + 4]
call fcn.10007760
add esp, 0x10
call fcn.1018dd42
sub esp, 0x1e
lea esp, [esp + 2]
lea esp, [esp + 0x20]
test eax, eax
jmp 0x1018dd93

Function at 0x1018f791
Capabilities:
Packed with generic packer

Disassembly:
xchg byte [esp + 1], bh
jmp 0x1018f7e3
mov dword [esp + 0x20], esi
sub esp, 0x18
mov dword [esp + 1], ecx
mov dword [esp + 6], edi
lea esp, [esp + 0x1c]
popal
jmp 0x1018f7cd
Function at 0x10190bd9
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], ah
jmp 0x10190bfa
lea esp, [esp + 4]
call dword [0x4577048e]
push ecx
lea esp, [esp + 3]
lea esp, [esp]
jmp 0x10190c3b
bsf dx, sp
bsf dx, dx
jmp 0x10190c5f
lea esp, [esp + 1]
push eax
call dword [0x4577048a]
stc
jmp 0x10190c25
rol edx, cl
jmp 0x10190c97
pushal
mov dword [esp + 4], eax
popal
mov ah, byte [esp]
inc al
jmp 0x10190c49
push eax
jmp 0x10190cc0
xor eax, eax
mov edx, esi
inc edx
jmp 0x10190c81
mov eax, esi
add eax, 4
mov dword [eax], edi
pop eax
jmp 0x10190fc3
mov dword [esi + 0x10], eax
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
jmp 0x10190f19
mov dword [esi + 8], eax
bswap edx
sub esp, 0x13
lea esp, [esp + 3]
jmp 0x10190ce6
mov ebp, esi
add ebp, 0xc
mov dword [ebp], eax
pop ebp
jmp 0x10190cfc
push ebp
mov dword [esi], eax
call fcn.10190d21
mov edi, 0x3acfa83a
mov ebp, 0xea8f1f9b
sbb esi, esp
in eax, dx
cld
iretd
stc
push esi
add eax, edi
jmp 0x10190d37
push edi
call fcn.1001ed40
mov eax, dword [ebx + 0x3c]
jmp 0x10190d50
pushfd
lea esp, [esp + 4]
push edx
push ebx
jmp 0x10190d7f
mov edx, dword [ebp + 0x54]
clc
lea esp, [esp + 0x10]
add edx, dword [ebx + 0x3c]
jmp 0x10190e63
rcl dx, 0xf
adc dh, 0x42
mov edx, dword [esp]
push ebp
jmp 0x10190d16
Function at 0x1019c3e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, bp
xchg dword [esp], edi
xor ah, al
jmp 0x1019c3d1

Function at 0xa9b8100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa57d000]
push edi
jmp 0xa9b811a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa9b8121
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b8110
mov eax, 1
add ebx, ebx
jne 0xa9b8133
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa9b8144
jne 0xa9b8163
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b8163
dec eax
add ebx, ebx
jne 0xa9b8150
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa9b8128
add ebx, ebx
jne 0xa9b815f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa9b81b5
xor ecx, ecx
sub eax, 3
jb 0xa9b817b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa9b81ea
sar eax, 1
mov ebp, eax
jmp 0xa9b8186
add ebx, ebx
jne 0xa9b8186
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b8154
inc ecx
add ebx, ebx
jne 0xa9b8194
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b8154
add ebx, ebx
jne 0xa9b81a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa9b8196
jne 0xa9b81b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa9b8196
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa9b81d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa9b81c6
jmp 0xa9b8116
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa9b81d4
add edi, ecx
jmp 0xa9b8116
pop esi
lea edi, [esi + 0xa5b6000]
mov eax, dword [edi]
or eax, eax
je 0xa9b8233
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa5b90f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa5b917c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa9b81f1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa5b9184]
or eax, eax
je 0xa9b822d
mov dword [ebx], eax
add ebx, 4
jmp 0xa9b820e
call dword [esi + 0xa5b9180]
mov ebp, dword [esi + 0xa5b9188]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa9b8267
sub esp, 0xffffff80
jmp 0x4038e8
Function at 0x4013e6
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x401433
mov al, cl
cmp al, 0x61
jb 0x40140e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x401433
mov al, cl
cmp al, 0x61
jb 0x401426
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x4013ff
cmp edx, dword [esp + 0x18]
je 0x401443
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x4013f8
xor eax, eax
jmp 0x401446
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40144e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x401535
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40153b
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40149a
cmp al, 0x61
jb 0x401492
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401485
cmp edx, dword [esp + 0x14]
je 0x4014aa
dec ecx
jne 0x40147a
xor eax, eax
jmp 0x401535
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x401535
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x401535
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x4014e6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4014f5
jmp 0x4014dd
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.004013e6
test eax, eax
je 0x401535
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x401530
cmp al, 0x61
jb 0x401528
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40151b
call fcn.0040144e
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x401553
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x401553
sub edx, ecx
mov ecx, edx
jmp 0x4014aa
xor eax, eax
jmp 0x401535