joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b632f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x3c]
jne 0x100b5d16
setle ah
xadd di, cx
mov edi, dword [ebp - 0x7dc]
aaa
sbb ah, ch
adc cx, bx
mov esi, dword [ebp - 0x7d4]
bswap ax
aad 0xdd
mov eax, dword [ebp - 0x7d8]
dec dx
ror ch, 5
mov ecx, eax
push ecx
shr ecx, 2
not dx
bswap dx
rep movsd dword es:[edi], dword [esi]
rol dl, 7
mov ecx, eax
rdtsc
stc
rol dl, cl
and ecx, 3
movzx dx, bl
rep movsb byte es:[edi], byte [esi]
not ecx
cwde
mov ecx, dword [ebp + 0x10]
movzx ax, bl
rdtsc
bswap dx
mov dword [esp], ecx
not ch
pushal
mov edx, dword [ebp + 0xc]
lahf
pushal
mov dword [esp + 0x3c], edx
cwde
lea ecx, [esi - 0x272e5604]
xchg cx, ax
call fcn.100235cd

Function at 0x101bb1f0
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 2
call fcn.1031653d

Function at 0x101e7572
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x28]
jne 0x10160d7b
add ah, 0xb5
mov eax, dword [ebp + 8]
stc
test dh, 0xac
clc
pushal
and eax, 4
lea esp, [esp + 0x20]
jge 0x10203d73
pushfd
pushfd
pushal
lea esp, [esp + 0x28]
je 0x10160d7b
pushal
mov ecx, dword [ebp + 8]
call fcn.101978e7
xchg dh, al
sbb dword [edi + esi - 0x1cf702ce], 0x9fb4c98e
sub ch, cl
movsd dword es:[edi], dword [esi]
xor dword [esi], ebp
out dx, al
lds esi, [ebp + 0x213cfab0]
dec ecx
sub edx, 0x290f1385
or eax, 0x3182f6e8
invalid
lea esp, [esp + 8]
jne 0x10160d7b
shl dx, 0xa
inc dl
pushfd
bsf dx, ax
movzx edx, byte [ebp - 0x211]
mov byte [esp], 0x5a
clc
pushfd
test edx, edx
pushal
jmp 0x100c2e86
jmp 0x102db312
jge 0x10238571
les edx, [edx + 0x7c]
sbb bh, byte [esi + ecx*2 - 0x74]
dec eax
pop ds
xchg ecx, eax
test byte [ecx + edx*4], bh
invalid
movzx ecx, dl
lea ecx, [ecx*8 - 0x26ccc088]
mov ecx, dword [ebp + 8]
pushal
pushfd
dec ebp
or byte [eax - 0x64], ah
xchg dword [esp + 0x20], ecx
pushal
call fcn.1024b07c
popaw
sub al, 0x46
jno 0x10238542
push edi
push edx
mov ebp, 0x29ee3308
fcom st(4)
and al, 0xc6
xchg ecx, eax
mov byte [edi], bh
dec ebx
neg dword [ebx]
or al, byte [edx]
mov edx, 0x58e501e5
inc eax
or al, 8
enter 0x52ca, 0xffffffffffffffac
sbb ecx, esi
mov ss, word [0x36ced8fd]
and al, 0x7e
insd dword es:[edi], dx
imul ebx, dword [edx + 0x46], 0x36
aam 0xe0
sub dword [ebp - 0x6f8e04fa], eax
rcr byte [esi - 0x15], cl
int1
daa
scasb al, byte es:[edi]
push edx
dec ebp
pop edx
aam 0xb8
lcall 0xcc49, 0xb545d9a4
cmp dword [esp + esi], ebx
mov dl, 0xda
mov dl, 0xfe
jp 0x1023860b
dec eax
pop eax
invalid
or byte [ecx - 0x5a5b5021], ch
push ebx
pushal
pushfd
lea esp, [esp + 0x28]
je 0x10160d7b
jmp 0x10238566

Function at 0x101f2545
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx cx, bl
mov eax, 0x6c
setle ch
mov word [ebp - 0x40], ax
bswap cx
bswap ecx
movzx cx, al
mov ecx, 0x6c
mov byte [esp], 0x48
mov word [ebp - 0x3e], cx
mov byte [esp + 8], 0x56
mov byte [esp + 8], ah
mov word [esp + 4], cx
lea esp, [esp + 0x50]
jmp 0x1019a287
Function at 0x101f93eb
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
call fcn.1003ad90
jmp 0x102bf22c
mov eax, dword [ebp - 0x80]
call fcn.1016f197
mov dword [esp + 0x28], ecx
push 0x5beae317
push 0x72f1fd8f
jmp 0x100bc165
pushal
stc
add esp, 0x24
pushfd
mov byte [esp], al
call fcn.10258a65
cmp bh, byte [edx]
adc al, 0x1f
jp 0x102bf285
invalid
fcomp dword [edx + 0x76c78fde]
push ds
mov byte [edi + eax*8], bh
push ebp
lodsb al, byte [esi]
pop ss
inc edx
or eax, 0xb98ee368
add al, 0x23
adc ebp, dword [esi + 0x59ef48f6]
in al, 5
xchg ah, al
invalid

Function at 0x101fd8d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x10382e97
dec dl
and cl, dh
inc cl
mov edx, dword [ebp - 4]
cmp ah, ch
adc al, 0x36
mov al, byte [edx]
mov ch, bh
movsx cx, bl
add dl, 0xec
pushal
mov byte [ebp - 0x4a8], al
aas
mov ecx, dword [ebp - 4]
shld ax, bx, 0xe
lea eax, [eax*4 + 0x7186272]
neg eax
mov dl, byte [ecx + 2]
bts eax, 2
jmp 0x10281570
mov al, 0x5f
movsx ax, cl
pushfd
mov edx, dword [ebp - 0x4b8]
xchg ah, cl
mov eax, dword [ebp - 0x244]
movzx ecx, cl
push 0x91d5c98a
pushal
mov dword [edx + 0x1c], eax
lea ecx, [eax + 0x664bdd8e]
lea ecx, [eax - 0x2b619cda]
movsx ecx, cl
mov ecx, dword [ebp - 8]
call fcn.1036930c
sub dword ss:[edi + esi], 0xb2173d22
pop ebp
sbb byte [ebx], al
leave
dec eax
push esp
in al, dx
add cl, dh
test eax, 0xa6ab347e
adc al, 0x13
wait
xlatb
jmp 0x532bbc84
mov byte [ebp - 0x4a5], dl
and ah, cl
and ah, al
not cl
aas
mov eax, dword [ebp - 4]
inc cl
sub dx, 0xffff
rol cl, 1
sal cl, 2
mov cl, byte [eax + 4]
inc al
xchg al, dl
mov byte [ebp - 0x4a7], cl
sub al, 0xaa
mov edx, dword [ebp - 4]
stc
or cx, 0xa11c
cmp ch, cl
mov al, byte [edx + 6]
inc cx
mov byte [ebp - 0x4a6], al
ror al, 7
shrd cx, sp, 3
xadd dh, ch
rcr cl, cl
movzx ecx, byte [ebp - 0x4a8]
cdq
and dx, di
neg al
movzx edx, byte [ebp - 0x4a5]
btc ax, di
shl edx, 8
pushfd
not ah
or ax, ax
sal ah, cl
add ecx, edx
test di, 0xd196
bsr ax, dx
shld ax, bx, 2
movzx eax, byte [ebp - 0x4a7]
clc
sar dl, cl
sal dh, 4
btr edx, ecx
shl eax, 0x10
bt dx, 0xf
cmp bx, 0xeedd
add ecx, eax
shld dx, cx, cl
shrd edx, ebx, cl
bt bx, dx
movzx edx, byte [ebp - 0x4a6]
pushfd
pushfd
cmp bh, ch
shl edx, 0x18
mov dword [esp], 0x217a0660
pushfd
push 0xdeedecf
add ecx, edx
call fcn.10284daf
xchg ah, ch
setnp al
rdtsc
cwde
mov eax, dword [ebp - 4]
push edx
mov word [esp], 0x2564
mov ecx, dword [eax]
rdtsc
mov dword [ebp - 0x244], ecx
lea esp, [esp + 4]
jmp 0x1025eaec

Function at 0x1020b7ae
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x102145c1
mov dword [esp + 4], eax
pushal
mov byte [esp + 8], 0xf0
pushal
mov byte [esp], ch
mov dword [esp + 0x40], 0x1015c540
mov word [esp], 0xe5f8
pushfd
mov byte [esp], bh
call fcn.100fe63d
Function at 0x10212e9c
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x20]
call fcn.1002c6a0
pushfd
pushfd
mov ecx, 0xc3
pop edi
not di
setbe dl
movzx esi, dl
mov esi, eax
mov byte [esp], 0xb1
lea edi, [ebp - 0x8b4]
rdtsc
rep movsd dword es:[edi], dword [esi]
movsx cx, dl
xchg dh, ch
pop edx
xadd dl, cl
lea edx, [ebp - 0x8b4]
mov ah, bh
lea ecx, [edx*2 - 0x16326ccb]
test dl, 0xed
inc cl
mov dword [ebp - 0x978], edx
adc al, 0x5d
inc ah
mov eax, dword [ebp - 0x978]
clc
mov cx, cx
bsf ecx, ebp
sub cl, bl
add eax, 1
pushfd
and dl, bh
mov dword [ebp - 0x97c], eax
sub esp, 0xfffffffc
pushfd
lea esi, [edx*2 - 0x2608bf4c]
pop esi
mov byte [ebp - 0x8be], 1
not si
call fcn.102c83a6
mov word [esp], si
mov byte [esp], 0xc7
jmp 0x102145e6
lea esp, [esp + 0x28]
jae 0x100d30f7
movzx di, cl
not esi
mov edi, dword [ebp - 0x5a0]
lea esi, [esi + 0x677d4a6d]
lea esi, [ebp - 0x38]
jmp 0x100a9031

Function at 0x10218add
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [edx + 0xc], 0
pushal
lea esp, [esp + 0x24]
jne 0x1026c6ea
call fcn.100a89b4

Function at 0x1021f034
Capabilities:
Hash data with crc32

Disassembly:
stc
mov dword [ebp - 0x414], edx
add esp, 4

Function at 0x1022b043
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x74], eax
pushfd
mov dword [ebp - 0x70], eax
shl dx, cl
rcr edx, 7
mov dword [ebp - 0x6c], eax
shr cx, 1
sub dx, dx
stc
mov dword [ebp - 0x68], eax
movsx cx, cl
jmp 0x1018281a
not dx
add esp, 0xc
jmp 0x10172b47

Function at 0x1023f81f
Capabilities:
Authenticate hmac

Disassembly:
and dword [edi + 0x78], ebp
dec ebp
push ecx
retf 0x7333
or ebp, edi
das
aas
jbe 0x10211a50
hlt
mov dword [0xb6667cec], eax
pushfd
cmp bh, byte [esi]
add dword [ecx - 0x29], 0xffffff8c
fimul word [0x1884341a]
les esi, [esi - 0x5c80f19a]
inc ecx
stosd dword es:[edi], eax
in eax, 0x54
cmpsb byte [esi], byte es:[edi]
sbb dl, ch
dec ebx
jo 0x10211b2c
xor ebp, dword [edi - 0x55]
push edi
mov bl, 0xef
ja 0x10211a96
add ch, byte [edx]
cmp byte [eax + 0x65337bc0], 5
aas
invalid
pushal
call fcn.10019ce6
cwde
mov ecx, 0x644a5ff4
pop ds
and eax, 0xf4b998ff
pop edi
dec edx
pop ds
jp 0x10211b7d
xor byte [ebx], bh
push ss
add dword [ebx + ecx*8], edi
pop es
xchg dword [ecx], ebp
cmp dword [ebp - 0x7c618b29], ebx
jg 0x10211ad6
mov esp, 0x82db0b12
mov cl, 0x59
outsd dx, dword [esi]
rcl dword [ebx], 0x3d
dec edi
cmpsb byte [esi], byte es:[edi]
push ebp
adc dword [edx - 0x29], edi
out dx, al
pop ebx
cdq
or ecx, 0xa472ca1b
push edi
xlatb
pop es
inc ebp
sbb byte ds:[edx - 0x36], 0xb6
push es
cmp al, 0x24
adc al, 0x19
dec eax
lodsb al, byte [esi]
mov ah, 0xb4
adc byte [ebx - 0x62], bl
lds esp, [ebx]
sbb al, 8
int3
inc edi
invalid
pushfd
movzx ax, bl
mov eax, dword [ebp + 0xc]
lea esp, [esp + 8]
jbe 0x10211b29
mov dword [eax], edx
pushal
call int.1027757e
das
add byte [edi], ch
outsd dx, dword [esi]
sbb al, byte [ebp - 0x7f2a4490]
wait
or dword es:[edi + edx*2 - 0x7252be5e], 0x4fde0f2f
cmc
pushal
out 0xa, al
mov dword [ebp - 0xc27e9e5], eax
jo 0x1023f838
mov gs, word [esi + ebx*4 + 0x51]
rol eax, 1
ret 0xf8aa
Function at 0x1024746e
Capabilities:
Execute anti-debugging instructions

Disassembly:
aam 0x6e
xchg edx, eax
not dx
daa
mov eax, 0x5f
clc
mov word [ebp - 0xba], ax
ror ah, 1
movzx dx, cl
neg ch
sub ax, cx
mov ecx, 0x33
ror dl, cl
xadd ax, dx
xadd dl, al
mov word [ebp - 0xb8], cx
call fcn.10209c57
push 0x6a1d4248
call fcn.10003f99
xchg ebx, eax
or ch, dl
push eax
cmp eax, dword [esi - 0x2d58136f]
insd dword es:[edi], dx
push 0xcf24e603
mov dl, 0x4a
jmp 0x687639ef
mov word [ebp - 0xbe], cx
push 0xdc951b89
mov edx, 0x32
aam 0xe2
sbb ch, bl
mov word [ebp - 0xbc], dx
not ax
lea esp, [esp + 8]
jo 0x100c91ed
jmp loc.10026996

Function at 0x102505e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
js 0x1025abf4
pushal
lea esp, [esp + 0x20]
call fcn.1003d8e0
rdtsc
setno ch
lahf
not cl
add esp, 0xc
pushal
mov ecx, dword [ebp - 0x50]
movsx dx, al
movsx dx, al
rdtsc
mov dword [ecx], 1
rdtsc
jmp 0x1020c4da
lea esp, [esp + 4]
call fcn.1003d8e0
shr ax, 1
add esp, 0xc
cdq
mov ecx, dword [ebp - 0x50]
cwde
lahf
movzx ax, bl
lahf
mov dword [ecx], 1
jmp 0x102b2237
mov dword [esp + 0xc], 0
movzx dx, cl
setnp ah
cdq
mov dword [esp + 8], 0x118
pop edx
mov edx, dword [ebp - 0x50]
call fcn.1035239a
ljmp 0xa2b7
mov dword [ecx + 4], 0
pop edx
mov dword [esp + 0x18], 0
not dl
mov dword [esp + 0x14], 0
movsx dx, dl
push ebp
mov dword [esp + 0x14], 0x118
setl dh
bswap dx
xchg al, dl
push dword [esp]
mov edx, dword [ebp - 0x50]
mov eax, dword [esp]
mov dword [esp + 0x14], edx
push 0x32da3902
call fcn.1014c3d0
int1
pushfd
push edi
jno 0x1020c583
xchg dword [edx], eax
cmp eax, 0x79de13b8
cwde
in al, 0xfc
adc ah, byte [edx - 0xf3a2ec7]
shr dword [ebx], 1
pop ebp
in eax, dx
je 0x1020c560
sub esi, esp
mov ebx, 0xa60769f9
cmp al, byte [edx - 0x320a20a9]
push dword [esi*4 - 0x538dfec5]
dec byte [edi - 0x3a3a117]
cmp ch, byte [ecx - 0x4c59a5c3]
mov bh, 0xfc
inc ebx
jae 0x1020c5ae
mov eax, 0x739aacae
lea ebp, [0xa2842d6f]
invalid
invalid
pop es
sub byte [eax - 0x6c9aab9a], cl
mov edi, 0x6aaf20e6
mov byte [0xa1070903], al
invalid
mov dword [esp + 0x18], eax
pushal
jmp 0x1008e6d4
push ecx
jmp 0x1012baf5
push 0x44d1d880
lahf
mov dword [ecx + 4], 0
mov byte [esp], bl
push ebp
setle dl
mov dword [esp + 4], 0
push edi
pushfd
push 0x8d9dd9
jmp 0x10173c8f
Function at 0x10269620
Capabilities:
Packed with generic packer

Disassembly:
add dx, ax
cmc
rol dh, cl
mov ch, al
mov edx, dword [ebp - 0x4c]
inc ch
sar cl, cl
ror ecx, cl
add edx, 1
xor cl, 6
bswap cx
btr cx, 0xc
or cx, si
mov dword [ebp - 0x4c], edx
bsr cx, bp
movzx cx, dl
mov ecx, dword [ebp - 0xd4]
push 0xdabd782a
jmp 0x101c361e
jmp 0x102ea54a
pushal
bt ecx, eax
add ecx, 0x1c
jmp 0x1017868d
lea esp, [esp + 0x2c]
call fcn.10015d80
pushfd
pushal
lea esp, [esp + 0x24]
jmp 0x1012ed2a
push esp
pushfd
lea esp, [esp + 0x28]
jae 0x101cd2c0
cmp bx, 0x305
bsr esi, ebx
mov dword [ebp - 0x50], 0
btr si, 8
stc
xadd edi, esi
mov esi, dword [ebp - 0xd4]
movsx edi, bl
or edi, 0x1b63be55
sbb di, cx
pushfd
add esi, 0x1c
lea edi, [0xed25a001]
mov edi, dword [ebp - 0x4c]
call fcn.1032cc33
test cl, 0xc0
test ebx, edx
call fcn.102c63e9
das
rcr dword [edi + edx*4 + 2], 0x3d
or byte [ebx + 0x1e], dl
fnstenv [ebx - 0x777fdedd]
push esp
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
aad 0xf5
fadd qword es:[ecx + 0x5c]
ljmp 0x2cfe
push 0x6a436bfc
lea esp, [esp + 0x28]
call fcn.10015f90
pushal
cmp dword [ebp - 0x4c], eax
jmp 0x10314649
jmp 0x102cba62

Function at 0x10296612
Capabilities:
Encode data using xor

Disassembly:
call fcn.101c510f
mov dword [edx - 0x59a4cf6b], ebp
and dword [edi - 0x6e], edi
lea ebx, [eax + 0x693d3e43]
and dword [ebx], esi
push cs
and ebx, edi
or eax, 0x5cd1edb7
aas
fisub word [edi + 0x7e84b772]
test dword [0x27522263], esp
cmp dword [esi + 0x7b994e0], eax
mov ch, 0xbf
mov ebp, dword [ecx + edx - 0x33a0c898]
mov fs, word ss:[ebx]
js 0x100ebc28
xchg edi, eax
test eax, 0x7f8fc334
add byte [esi - 0x71], dl
or ah, 0x43
rcr byte [esi - 0x79d1cd62], cl
mov ecx, 0x34a484a4
test byte [eax - 0x52], bh
cmp al, 0xde
invalid
sub dword [eax + 0x4810d20f], esp
stosb byte es:[edi], al
cmp al, 0x6e
and dl, 0xca
salc
mov edi, 0x5d2bc3b1
adc byte [ecx + edi*4], cl
or dword [esi], eax
and al, dh
lodsb al, byte [esi]
xor byte [esi + 0x37], ah
pop edx
invalid
mov dword [ebp - 4], eax
lea esp, [esp + 0xc]
pushal
push edx
bt dx, 0xf
clc
cmp dword [ebp - 4], 0x10
jmp 0x100ebb89

Function at 0x102b117b
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ch, dl
stc
mov dword [ebp - 0x78], eax
push edx
shl edx, 1
mov dword [ebp - 0x74], eax
lea esp, [esp + 8]
jp 0x102a0a73
mov dword [ebp - 0x70], eax
not dh
not dh
pushfd
inc cl
mov dword [ebp - 0x6c], eax
neg cl
xor cx, 0x77c9
shld dx, si, cl
shr dh, cl
mov dword [ebp - 0x68], eax
sal dh, 4
adc dx, bp
mov dword [ebp - 0x64], eax
btr ecx, edi
mov dword [ebp - 0x78], 0x18
aad 0x5f
pop edx
aaa
mov ecx, dword [ebp - 0x5c]
stc
shl ecx, 4
lahf
cwde

Function at 0x102b5058
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt edi, esi
cdq
mov edx, dword [ebp - 0xac]
ror ah, 1
imul edx, edx, 0x2c
push esi
push dword [esp]
lea eax, [ecx*2 + 0x4da61777]
lea eax, [ebp + edx - 0x4f]
mov byte [esp + 8], 0xbc
mov byte [esp], bl
mov byte [esp], 0x16
mov dword [esp + 0x4c], eax
push 0x299bfd47
jmp 0x10296eb4
Function at 0x102cd66e
Capabilities:
Packed with generic packer

Disassembly:
add al, 0x3e
in eax, dx
aad 0x5f
popal
lock xor dword [ebx], ecx
invalid
call fcn.101a09e0
push ebx
je 0x100ff4ef
ficom dword [ebp - 0x7f1af450]
or edx, dword [esi - 0x5f]
lodsb al, byte [esi]
div dword [esi - 0x5e]
adc ch, ch
ja 0x100ff5d4
dec ecx
ret 0x4b07
scasb al, byte es:[edi]
out 0xa7, eax
rcl dword [ecx + 0x1290bac0]
mov ss, edi
in eax, 0x7c
push edi
push ebp
lodsb al, byte [esi]
sti
fcom qword [edx]
insb byte es:[edi], dx
sbb al, 0x22
nop
sbb byte [ecx + 0x5a1465d2], dl
xchg byte [ebp - 0x1a379045], dh
lodsb al, byte [esi]
fcomp dword [ebp - 0x12]
and eax, 0x8b395129
push es
test dword [ecx - 0x67], esi
jmp 0x100ff5ef
push edx
mov esi, 0x18a89eaf
mov dh, al
add eax, 0x58cfc96d
cld
sbb ch, al
cmp byte [edx], 0xc5
ja 0x100ff5a0
std
add al, 0x68
stosd dword es:[edi], eax
sti
xor al, 0x5c
pop esp
stosb byte es:[edi], al
into
fimul word es:[esp + ecx]
xchg ebp, eax
xchg ebp, eax
les esi, [edi + 0x27]
push esi
nop
aas
jns 0x100ff623
xor byte [eax + 0x30e76bf0], bh
push esp
xchg ebp, eax
movsd dword es:[edi], dword [esi]
cmc
add eax, 0x966ad9a5
xor dh, 0x36
mov dl, 0x9f
invalid
cmpsd dword [esi], dword es:[edi]
push si
xor dword [ecx - 0x66], esi
mov edx, 0x9a5804fb
mov ebx, 0x2b637f02
adc ebp, dword [ebp + 0x5c]
pop edx
cmp dword [ecx], edi
ret 0xc336
jmp 0x102c6255
call fcn.1000859f
push 0x5c1c441c
call fcn.10001e02
scasb al, byte es:[edi]
push eax
mov dword [esp], ecx
jmp 0x100ff548
jmp 0x101fbf42
push 0x3204cd5f
lea esi, [ebp - 0xc8]
pushal
pushfd
pushfd
jmp 0x1020c63a
lea esp, [esp + 0x2c]
call fcn.1000de40
lea edx, [0x820b8f72]
mov edx, dword [eax]
bt bp, di
pushfd
pushal
cmp edx, dword [ebp + 0x10]
pushal
call fcn.100ac54f
test ebp, eax
mov al, 0xbb
xchg esi, eax
sar esp, 1
push edi
ret 0xf84d
test eax, eax
pushal
push edx
pushfd
lea esp, [esp + 0x2c]
je 0x101e24b2
pushal
mov dword [ebp - 0xfc], 0
bswap ecx
pop ecx
lea esp, [esp + 0x1c]
jg 0x101a5fbe
mov dword [ebp - 4], 0xffffffff
not ecx
jmp 0x10101f60
lea ecx, [esi*4 - 0x37d78e81]
lea ecx, [ebp - 0x34]
jmp 0x101caf1d
movzx eax, al
cmc
mov byte [esp], bl
cmc
jmp 0x102879ee
Function at 0x102cf563
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp ecx, dword [eax]
pushfd
lea esp, [esp + 0x2c]
jae 0x10353ba9
call fcn.100a3921
pushal
xchg ch, al
setns ah
mov ecx, dword [ebp - 0x58]
jmp 0x1035cc7f
pop eax
setb dl
pushal
mov edx, dword [ebp - 0x54]
lahf
setp al
lahf
mov dword [ecx + 0x30c], edx
seta ah
mov dword [esp + 0x38], 0x8000
movzx ax, al
inc esp
and al, 0x38
add byte [eax + 0xf660000], al
mov dh, 0xc0
not ah
seta ah
mov dword [esp + 0x34], 0
lahf
not ah
mov eax, dword [ebp - 0x4c]
mov byte [esp + 4], 0x16
mov dword [esp + 0x30], eax
mov byte [esp], 0x91
push dword [esp]
call fcn.1037142d
cmp bh, dh
pop ecx
adc al, 0xf
pop edx
in eax, 0x40
sti
push es
xor dword [edi + esi + 0x5dd8162], ebx
pop ss
cmp bl, byte [eax]
sub byte [eax + 0x2e306836], 0xc6
pop edi
xchg edx, eax
cmp ch, byte [ebx + 0x40e6cee6]
outsd dx, dword [esi]
and al, dh
adc dl, ah
insb byte es:[edi], dx
mov byte [0xdf9dfe2], al
jb 0x1035cc96
sal dword [ebp + 0x1039ff73], cl
or ch, ah
push ebx
mov esp, 0xfe34f332
fdivr dword [edx + 0x37]
fiadd word [esp + ebx*8]
xor byte [edi + ecx], ch
push ebp
enter 0xffffffffffffd704, 0x16
add al, 0xf
dec edx
cmp ecx, ebx
sbb ecx, dword [ebx]
push cs
dec esi
inc edi
popfd
xlatb
or al, 3
dec edi
push 0x51cdf1e2
imul edx, dword [ecx - 0x50], 0x1f
ljmp 0x256

Function at 0x102fb79f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
mov byte [ebp - 0x43e], 0x61
xchg ch, dh
mov byte [ebp - 0x43d], 0x74
seto cl
lea ecx, [ecx*4 - 0x538e299c]
movzx cx, dl
mov cl, 0x69
mov byte [ebp - 0x43c], 0x69
not cx
mov byte [ebp - 0x43b], 0x6f
push ebx
bswap ecx
mov byte [ebp - 0x43a], 0x6e
not dh
not dh
push dword [esp + 4]
mov byte [ebp - 0x439], 0x50
pop edx
setl ch
lea ecx, [ebx*2 + 0x764723d2]
mov byte [ebp - 0x438], 0x72
not cx
movsx cx, dl
mov cx, word [esp]
mov byte [ebp - 0x437], 0x6f
movsx cx, dl
movzx cx, bl
setae cl
movzx cx, al
mov byte [ebp - 0x436], 0x63
call fcn.10331009
loopne 0x102fb87e
add eax, dword [eax]
xchg ecx, eax
mov dl, 0x5d
clc
add ecx, dword [esi - 0x17]
jg 0x102fb83d
jne 0x102fb825
pop ebx
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
xchg ecx, eax
cmp dword [edi + 0x1f], ecx
fst dword [esi + 0x2d]
loop 0x102fb886
push esi
sub eax, 0x986945e2
nop
dec edi
shl byte [eax - 0x2b], 0x95
sar dword [ebx - 0x33], cl
cld
imul ebx, dword [eax + 0x60c04f90], 0x7bd395d5
int 0xfc
loopne 0x102fb87b
out dx, al
jle 0x102fb867
popal
push esi
cmp byte [edi + 0x3af9c9a8], ah
movsb byte es:[edi], byte [esi]
dec ecx
inc edx
xchg bl, al
jmp 0x102fb7fc
dec edx
jns 0x102fb839
add byte [eax], bh
insd dword es:[edi], dx
pop edi
and eax, 0x953757a7
retf
xchg ecx, eax
lcall 0x3a3e, 0x93f94b16
jbe 0x102fb867
dec ebx
stc
xchg ebx, eax
cmp dh, byte ds:[esi - 0x1e]
dec byte [edx]
push ss
or dl, byte [esi]
inc edx
into
dec edx
invalid
Function at 0x10321a91
Capabilities:
Check for vm using instruction vpcext
Execute anti-debugging instructions

Disassembly:
jmp 0x1034e1a1
bt sp, 0xf
bt sp, 8
cmp dword [ebp + 0xc], 0
jmp 0x101f1f39
push dword [esp]
mov byte [esp + 4], bl
lea esp, [esp + 0x28]
je 0x10265002
lahf
push 0
pushfd
mov dword [esp], 0x118
movsx ax, dl
pushfd
movsx dx, bl
rdtsc
mov edx, dword [ebp + 0x14]
cwde
mov dword [esp], edx
pushfd
pop eax
mov eax, dword [ebp + 0x10]
pushfd
jmp 0x1031e72b

Function at 0x1032dcda
Capabilities:
Encode data using xor

Disassembly:
pushfd
pushal
call fcn.101d9d0f
shrd dx, ax, cl
bts dx, 2
mov edx, dword [ebp - 0xc4]
bt di, 7
stc
cmp dword [edx + 0x514], 0x3f
pushal
pushfd
push ebp
pushfd
lea esp, [esp + 0x2c]
jne 0x10254f83
test dl, bl
jmp 0x102581df
cmp dword [ebp - 0x60], 0
jmp fcn.1023b571
lea esp, [esp + 0xc]
jne 0x1025008d
pushal
push esp
call fcn.10235fbd
push 0x481f6c24
call fcn.10004682
or byte [ecx - 0x72eae370], 0x64
lea esp, [esp + 0x4c]
call fcn.1003b370
shl ax, 1
add esp, 0xc
bswap ax
push 0x294187ae
movzx ax, bl
lea eax, [ebp - 0x118]
jmp 0x101741e3
jmp 0x1027f966

Function at 0x10334add
Capabilities:
Check http status code

Disassembly:
bsf dx, sp
bsr dx, ax
pushfd
mov dword [esp], ecx
pushal
ror dx, 7
mov dword [esp + 0x1c], 0xffffffff
btc dx, si
mov edx, dword [ebp - 0x5c]
shl eax, 0xe
shr ch, cl
dec al
clc
shl edx, 4
push dword [esp + 0x10]
xchg ch, al
pushal
mov eax, dword [ebp - 0x1c]
call fcn.103185d2
mov cl, 0xe1
cld
xchg dword [edx + 0x1d], esi
sbb bl, ah
mov gs, word [ecx - 0x2c]
dec edi
pop edx
adc eax, 0x6d170ff3
push ebp
cmpsd dword [esi], dword es:[edi]
cld
cmpsb byte [esi], byte es:[edi]
cmp al, 0x21
mov byte [0xae9a928a], al
invalid
pushal
lea esp, [esp + 0x24]
je 0x1013437c
aad 0x4b
cdq
push 2
bswap dx
cwde
shr ah, cl
daa
push 0
pushfd
cmp ah, 0x13
shld cx, dx, 0xd
mov dword [esp], 0
rcl ch, 2
bts dx, dx
cmp ah, 0xd9
lea ecx, [ebp - 0x7c]
jmp 0x101583b8

Function at 0x1033cd43
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
call fcn.1003b370
push edx
test cl, dl
add esp, 0x10
pushal
pushfd
push 0xaf53c630
lea esp, [esp + 0x28]
jmp fcn.102ba625

Function at 0x10360709
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
ror ch, cl
add eax, dword [ebp + 0xc]
movzx cx, cl
mov dword [ebp - 0x40], eax
movzx cx, al
rdtsc
bswap ax
mov ecx, dword [ebp - 0x48]
lea eax, [ebp*4 - 0x4465a69b]
push 0x3c38cdd7
cwde
mov dword [esp + 4], ecx
rdtsc
lea edx, [ebp*4 + 0x28e7c2e8]
mov edx, dword [ebp - 0x54]
not ah
pushfd
lea eax, [ecx + 0x27580ef6]
movzx eax, word [edx + 6]
seta dl
pushfd
mov dword [esp + 8], eax
xchg ecx, edx
pop ecx
mov ecx, dword [ebp - 0x50]
push 0x2a610c02
mov edx, dword [ecx + 0x24]
movsx cx, dl
setne ch
mov dword [esp + 4], edx
pushfd
bswap cx
pushfd
mov ecx, dword [ebp - 0x18c]
jmp 0x102ffe27
mov word [esp], 0x9571
push dword [esp + 0xc]
lea esp, [esp + 0x40]
call fcn.1001bb80
bsr dx, cx
jmp 0x100fbbc9
pushal
call fcn.102e13c3
mov eax, dword [edx + 0x20]
not cl
mov dword [esp + 0x38], eax
push edx
not cl
mov ecx, dword [ebp - 0x18c]
jmp 0x102417c4