joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053b98
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [eax + 0x5bb4c8af]
push 0x53990971
mov byte [0x1003ccd0], 0
pushal
movsx ax, dl
mov eax, dword [esp + 0x28]
pushfd
push dword [esp + 4]
push 0xc6079e15
push 0xe84a2ccd
mov eax, dword [esp + 0x3c]
mov byte [esp + 4], 0x9e
pushfd
pushfd
lea esp, [esp + 0x48]
jmp fcn.100021a3

Function at 0x10053daf
Capabilities:
Packed with generic packer

Disassembly:
jno 0x100613f4
push 0x7b6f2db7
cmp byte [0x1003ccd0], 0
jmp 0x10065069
pushfd
mov byte [esp], 0x4f
lea esp, [esp + 0x50]
jne 0x10063a7d
jmp 0x10052e65
pushal
clc
cmp byte [0x1003ccd0], 0
pushfd
push ecx
push edi
push 0xe02728a8
lea esp, [esp + 0x30]
jne 0x10066a34
pushal
lea esi, [esp + 0x20]
jmp 0x1004b3ac
pushfd
call fcn.1004fe2b

Function at 0x10053e19
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea eax, [esi - 0x240b9e81]
inc dword [0x1003d108]
cwde
rdtsc
lea esp, [esp + 0x14]
popal
pushfd
pushal
pushal
lea esp, [esp + 0x44]
jmp 0x1005419e

Function at 0x10054388
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp], 5
lea esp, [esp + 0xc]
jne 0x1005ea2c
push 0x211ea2bd
sar al, cl
rcl al, 2
mov al, byte [ebp + 5]
call fcn.1005a0aa
call fcn.1004bea9
pushfd
pushfd
push dword [esp + 4]
mov dword [esp + 0x38], 0x1004dfea
call fcn.1004eea0

Function at 0x100543e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x79
lea esp, [esp + 0xc]
jne 0x1005ea2c
sub al, 0x7a
cmp bh, 0xdf
not al
mov al, byte [ebp + 0xa]
call fcn.1006c570

Function at 0x10054ad5
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
call fcn.100567ab
push 0xd21211c0
push dword [esp]
mov byte [0x1003ccd0], 0
bswap eax
jmp loc.1004c290

Function at 0x10054b08
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1006a32d
mov dword [0x1003ccb8], eax
push dword [esp]
mov ax, di
lahf
mov byte [esp], 0xeb
mov eax, dword [0x1003ccb4]
pushal
call fcn.1006737a

Function at 0x10054ea7
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x1003ccd0], 0
pushfd
pushfd
lea esp, [esp + 0x10]
jne 0x10066a34
not si
jmp 0x1005ada8

Function at 0x100550d6
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov word [esp + 4], sp
mov dword [esp + 0x20], eax
push esp
pushfd
lea esp, [esp + 0x28]
call fcn.100567ab
movsx eax, bl
movsx ax, bl
movsx ax, dl
mov byte [0x1003ccd0], 0
push esi
mov eax, dword [esp + 4]
jmp 0x10068740
mov byte [0x1003ccd0], 0x99
pop eax
setns ah
mov eax, dword [ebp + 4]
jmp 0x1004fb61
pushal
mov eax, dword [esp + 0x28]
pushfd
lea esp, [esp + 0x30]
jmp fcn.100021a3

Function at 0x1005705a
Capabilities:
Packed with generic packer

Disassembly:
push eax
lea esp, [esp + 0x2c]
call fcn.1006d285
cwde
movzx ax, cl
setb ch
lea edx, [edx - 0x1970b2f]
popal
setno al
rcl al, cl
mov al, byte [ebp]
pushfd
cmp al, 0x6a
mov word [esp], 0x668b
lea esp, [esp + 4]
jne 0x10054451
add al, 0x94
setbe al
mov al, byte [ebp + 1]
cmp ah, 0xcf
cmp bh, 0x68
pushfd
cmp al, 0x20
jmp loc.1004b9ca
Function at 0x100574f5
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x38]
je 0x10052177
push 0xa3a56ff8
pushal
lea esp, [esp + 0x24]
jno 0x1006c098
mov bl, byte [ebp + edx]
call fcn.10050dca
push dword [esp]
jmp 0x10055ea3

Function at 0x10057b4f
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb al, 0xa8
mov al, byte [ebp + 0xa]
jmp 0x10068bc5
test dh, bh
pushal
cmp al, 0xc4
push ecx
push edx
push 0xec90de97
lea esp, [esp + 0x30]
jne 0x1005ea2c
jmp 0x1004fdc0
cmp al, 0xc2
pushal
pushal
call fcn.10005a45
lea esp, [esp + 0x14]
je 0x10050d34
lahf
push ebx
movzx cx, bl
movzx ax, bl
bswap ecx
lea eax, [esp + 0x20]
movsx cx, cl
setae cl
call fcn.10050396
pushfd
mov word [esp], bp
push 0x639d70fe
mov byte [esp + 0xc1], 0xa4
mov byte [esp], 0x96
call fcn.1006380b

Function at 0x10058106
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushal
mov dl, byte [eax + ecx]
mov byte [esp + 0xc], dl
jmp 0x10005548
jmp 0x100690d1
push ebp
lea esp, [esp + 0x4c]
jne 0x1004fdb3
movzx cx, al
cwde
popal
push esp
push dword [ebp + 8]
pop dword [esp]
push 0xa38c37d8
push 0xa8d554f5
call fcn.10052257

Function at 0x10058328
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
setne dh
pushal
mov dword [esp + 0x24], 0x1003d1f8
movzx edx, bl
movzx dx, al
setg dh
mov edx, dword [0x1003d398]
pushfd
pushfd
pushfd
mov dword [esp + 0x2c], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x28], 0x1005d1a7
call fcn.1006c789

Function at 0x10059837
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x28]
jne 0x10066a34
not si
mov esi, esp
call fcn.1005eed0
jmp 0x1006951e
mov ax, 0xfd45
popal
and bp, 0x89d3
movsx bp, cl
sbb bp, ax
add esp, 0x100
or bp, bp
bts bp, ax
mov bp, 0x895
cmp sp, 0x474d
pop ebp
jmp 0x10068b36
cmp sp, 0x83e4
xor eax, eax
pushfd
pushfd
push 0x5daabc2d
pushal
push dword [esp + 0x2c]
ret 0x40

Function at 0x10059b9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add al, 0x2f
call fcn.1006d6f0
cmp al, 0x81
mov byte [esp], 0x32
lea esp, [esp + 4]
jne 0x1005ea2c
je 0x1005443d
mov al, byte [ebp + 5]
pushal
cmp al, 0xc4
jmp 0x1006d1c0
pushal
pushfd
lea esp, [esp + 0x44]
jne 0x1005ea2c
sar al, cl
pushfd
cmp bl, 0xc2
mov al, byte [ebp + 0xa]
pushal
cmp al, 0xc2
mov byte [esp], 0xbf
pushfd
mov word [esp], 0x1d18
push 0x6665a84b
lea esp, [esp + 0x2c]
jmp 0x10068758

Function at 0x10059ef4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
pushal
pushfd
lea esp, [esp + 0x2c]
jne 0x1005ea2c
cmc
clc
rcr al, cl
mov al, byte [ebp + 0xa]
call fcn.1006b07d
lea esp, [esp + 0x30]
je 0x1005d970
pushfd
mov byte [esp], ch
mov dword [esp], eax
push 0xd01fa5a1
jmp 0x10056812

Function at 0x1005a0aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
pushal
cmp al, 0xc4
jmp 0x1006cf2c

Function at 0x1005a3ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x20], ecx
mov byte [esp], dl
call fcn.1004f031
Function at 0x1005b76e
Capabilities:
Packed with generic packer

Disassembly:
pop edx
mov dword [esp + 0x28], 0x40
push dword [esp]
movzx edx, cl
lea eax, [ecx - 0x75dcf07b]
mov dword [esp + 0x28], 0xa
call fcn.1004d970
pushal
movsx ax, cl
mov dword [esp + 0x2c], 0x1003a090
push 0xd1f00e3a
xchg dx, ax
jmp 0x1004f8ed

Function at 0x1005b835
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 0x60], bl
jmp loc.1004c6a6

Function at 0x1005b9c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0x1005ea2c
inc al
add al, 0x84
call fcn.1006b951
lea esp, [esp + 0x2c]
jne 0x1005ea2c
sbb al, 0x1d
mov al, byte [ebp + 4]
cmp cl, bh
test ch, dl
cmp al, 0x81
jmp 0x10068141
jne 0x1005ea2c
inc al
mov al, byte [ebp + 5]
jmp 0x100676e2

Function at 0x1005bbdb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x958d1d6a
push 0xcc17c315
lea esp, [esp + 0x2c]
jne 0x1005ea2c
pushal
push dword [esp]
stc
sbb al, ah
mov al, byte [ebp + 4]
clc
cmp al, 0x81
jmp 0x10064f85
pushal
lea esp, [esp + 0x44]
jne 0x1005ea2c
neg al
sal al, 5
stc
mov al, byte [ebp + 5]
bt si, 0xd
call fcn.10057b4f

Function at 0x1005c151
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
pushal
xor eax, eax
mov byte [esp], ah
jmp loc.10007b85

Function at 0x1005c7cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x1004dc61
pushfd
cmp bh, 0xa
jmp 0x10052d78
Function at 0x1005d4b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xca2612cf
lea esp, [esp + 4]
jmp 0x1004f857
jns 0x10050550
push 0x1003cac0
jmp 0x10067a3e
push edx
mov byte [esp], bl
setne al
mov dword [esp], 0x1003cac0
movzx dx, al
cdq
lea edx, [ebp*8 - 0x71849acf]
push 0xff
lahf
push 0x1003ced8
rdtsc
push 0x7e2bd8fe
mov edx, dword [0x10037a80]
movsx ax, al
setle ah
jmp 0x10052337
push 0x383f2de7
mov ecx, dword [0x1003ccb4]
pushal
pushal
mov dword [esp + 0x40], ecx
call fcn.10005627
lahf
mov dword [esp], edx
xchg ah, ch
lea ecx, [edx + 0x6d598e]
push 0x1003ced8
lea ecx, [esi - 0x4835192c]
jne 0x10064183
cwde
mov eax, dword [0x1003a0a4]
setg cl
setle cl
not ch
push eax
movzx cx, al
mov ecx, dword [0x1003ccb4]
push esp
mov dword [esp], ecx
pushfd
push 0xcc351fe6
lea esp, [esp + 8]
call fcn.1005b353
movsx ebx, bl
mov dword [0x1003ccb8], eax
setge bh
mov bx, 0x9268
mov eax, dword [0x1003d190]
movzx ebx, bl
sar bl, 2
bsf ebx, eax
mov bh, dh
mov ebx, dword [0x10039d7c]
cmc
push ebp
cmp eax, 0
call fcn.1006d82b
push 0x7fd686fd
pushal
mov byte [esp + 0xc], 0xd4
lea esp, [esp + 0x2c]
jge 0x10069b42
or cl, ch
cdq
not ah
cwde
mov edx, dword [ebp - 0xc]
btr eax, 6
lea eax, [esp + 0x179aaf58]
and edx, 0xff
bts ax, ax
cwde
mov eax, dword [ebp - 0xc]
shl cl, cl
push esi
setle cl
and eax, 0xff
jmp 0x1006c05e
pushfd
bt sp, 7
and ecx, 0xff
jmp 0x100606d0
push 0xfa575a0
mov dword [0x1003a0a4], 0x10033084
pushfd
mov byte [esp], al
lea esp, [esp + 8]
jmp 0x1004f066
pushal
pushfd
lea esp, [esp + 0x24]
jmp 0x10062809
pushfd
lea esp, [esp + 0x24]
jo 0x10069fb2
mov dword [0x1003a0a4], str.2090
push esp
pushal
push eax
lea esp, [esp + 0x28]
jmp 0x10059d40
mov word [esp], sp
movzx cx, al
mov dword [esp + 0x3c], eax
mov ch, ah
mov ecx, dword [0x1003ccb4]
call fcn.10054214
jmp loc.100070a0
mov byte [esp], ch
lea esp, [esp + 0x24]
je 0x10069ada
cmp bx, 0xc88
cmp ah, ah
jmp 0x10069acb
push eax
cmp ecx, 0x80
jmp 0x100541a9
pushal
mov byte [ebp - 0xc], 0
mov dword [esp], ebx
push 0x5151100
pushfd
lea esp, [esp + 0x28]
jmp 0x10068c4d
cwde
push edi
mov eax, dword [0x1003a0a4]
setg cl
movzx ecx, cl
lea esp, [esp + 4]
js 0x1005fd2b
not cl
push eax
jmp 0x10050637
movzx ax, dl
push 0xff
mov al, dl
xchg ah, dl
mov dh, dl
push edx
mov dword [esp], 0x1003ced8
mov al, 0x2f
cdq
mov edx, dword [0x10037a80]
not al
movsx cx, dl
xchg cl, ah
cwde
push edx
lahf
push 0x1003ced8
xchg ecx, eax
bswap eax
pushal
mov eax, dword [0x1003a0a4]
pushal
jmp 0x1005cb18
rol ecx, 0x1b
shld cx, sp, 0xc
bt cx, 8
mov ecx, dword [ebp - 0xc]
cmp al, 0x85
jmp 0x10055e3a
cmp ax, 0x2020
pushfd
lea esp, [esp + 4]
je 0x100574c6
pushal
jmp 0x1005c459
pushal
call fcn.1005f6e2
pushfd
pushal
call fcn.1005fb45
setb cl
call fcn.100673bb

Function at 0x1005e117
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x1005ea2c
sar al, cl
sar al, 4
rcr al, cl
mov al, byte [ebp + 0xb]
test dx, 0x7424
cmp di, bx
cmp al, 0x10
call fcn.1005b9c9

Function at 0x1005f40d
Capabilities:
Packed with generic packer

Disassembly:
mov byte [ebx + ecx], dl
pushal
inc ecx
push ebp
stc
cmp ecx, 5
jmp fcn.10002199
Function at 0x1005f5c6
Capabilities:
Packed with generic packer

Disassembly:
push 0xe56f25c6
lea esp, [esp + 0xc]
jns 0x10068f03
xadd dx, cx
add edx, ecx
not cl
mov edx, eax
rcl cx, 2
adc cx, si
mov ecx, eax
pushal
push edx
test ecx, ecx
push dword [esp + 8]
pushfd
mov dword [esp + 0x44], edx
push ebp
jmp fcn.100017db
pushfd
test di, cx
cmc
sub eax, 1
mov word [esp + 4], 0x754f
jmp 0x1005d59e

Function at 0x1005f842
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dl
mov ecx, dword [0x1003a094]
lahf
lea eax, [edx*8 + 0x2ee0224a]
pop edx
mov dword [esp + 0x38], ecx
cwde
not dh
cdq
mov edx, dword [0x1003d0fc]
movsx ax, dl
setbe al
movsx ax, cl
mov dword [esp + 0x34], edx
movzx eax, dl
mov byte [esp], al
lahf
push edx
mov eax, dword [0x1003d398]
mov word [esp + 0x14], bx
pushfd
mov byte [esp + 4], ch
mov word [esp + 4], dx
mov dword [esp + 0x38], eax
jmp fcn.10003ba5

Function at 0x1005fa28
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0x1005ea2c
call fcn.1006704e
mov byte [esp], bh
mov byte [esp + 0x81], 0
pushfd
push edx
mov byte [esp + 0x8a], 0x3a
pushfd
call fcn.10065455

Function at 0x1005ff1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 0x1c]
aam 0x3e
shld dx, si, 0xe
lea edx, [esp + 0x10]
rcr al, cl
test ah, bl
stc
shr edi, 3
lea eax, [esi*4 - 0x5654202d]
rcr al, cl
mov dword [esp], esi
pushfd
mov esi, dword [esp + 0x24]
sbb al, bl
bsr ax, di
movsx ax, cl
xor al, 0xa8
sub ebx, edx
not ax
aam 0x9b
sal ax, cl
add edi, 1
lea esp, [esp + 4]

Function at 0x1005ffd2
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], cl
lea esp, [esp + 0x38]
je 0x1006b1a2
cmp dl, 0x60
cmp cl, ch
bt sp, 4
clc
test edi, 3
pushal
call fcn.10064379
pushal
pop esi
lahf
pushfd
mov eax, dword [esp + 0x30]
setne bl
pushal
mov ebx, dword [esp + 0x40]
movzx di, bl
mov esi, dword [esp + 0x44]
lea edi, [ebp + 0x6250f157]
pop edi
mov edi, dword [esp + 0x44]
push dword [esp + 4]
push dword [esp + 0x4c]
ret 0x50
Function at 0x1005fff6
Capabilities:
Packed with generic packer

Disassembly:
movzx bp, bl
not bp
jmp loc.100648d2
pushal
mov byte [esp + 4], ah
inc ebp
jmp 0x10068313
call fcn.1005685f
mov al, byte [ebp]
bt di, cx
jmp 0x1006b990
jmp 0x1006d0a0
lea esp, [esp + 0x24]
popal
pushal
lea esp, [esp + 0x20]
jmp 0x1005419e
push ebp
mov word [esp + 8], 0x89d1
lea esp, [esp + 0x44]
jne 0x10054451
cmp cl, bh
dec al
mov al, byte [ebp + 1]
pushal
cmp al, 0x20
push dword [esp]
pushal
lea esp, [esp + 0x44]
jne 0x10054451
pushfd
sbb al, 0x7b
push dword [esp]
mov al, byte [ebp + 2]
push dword [esp + 4]
jmp 0x1006984f
pushal
push 0xce69670e
lea esp, [esp + 0x30]
jbe 0x1005fc43
jne 0x10054451
cmp dx, si
sbb al, al
rcr al, 3
sar al, cl
mov al, byte [ebp + 3]
cmp al, 0xca
pushfd
cmp bh, dl
cmp al, 0x6a
call fcn.1005c15d
jmp 0x1005fbc9
jmp 0x1006a812
cmp ch, 0xc5
cmp al, 0x50
jmp 0x10066340
inc ecx
bt si, ax
cmc
cmp ecx, ebx
pushal
lea esp, [esp + 0x40]
je 0x10002412
pushal
lea esp, [esp + 0x20]
jmp 0x100670b9
pushal
pushal
cmp al, 0x6a
mov word [esp], ax
jmp 0x1006030e
push edx
lea esp, [esp + 4]
jne 0x10054451
mov al, cl
ror al, 5
ror al, cl
mov al, dh
mov al, byte [ebp + 3]
jmp loc.10001a67

Function at 0x10060ad1
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ecx, ecx
jmp 0x1006551f
call fcn.1005f679

Function at 0x1006152b
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
xchg esi, ecx
bsr si, bx
mov byte [ebp], 0xe9
inc ch
pop ecx
movsx ebx, bl
mov cx, bp
mov dword [ebp + 1], eax
rdtsc
lahf
seto ah
inc dword [0x1003d14c]
cwde
popal
push edi
push dword [esp]
pushal
lea esp, [esp + 0x28]
jmp 0x1005419e

Function at 0x10061ba2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jne 0x1005ea2c
cmp bx, 0x4dcd
xor al, dh
clc
cmc
mov al, byte [ebp + 0xb]
stc
cmp al, 0x10
call fcn.1004b6e0
clc
add edi, 0x138
lea esp, [esp + 0x24]
push esp
call fcn.100626b0
jmp 0x10066170
pushfd
call fcn.1006776c
cmc
cmp esi, esp
jmp 0x1006364f

Function at 0x100623f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x14], 0x10001beb
pushal
call fcn.1005f4e6

Function at 0x10062400
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx cx, bl
push eax
movsx dx, al
lea ecx, [esp + 0x1a]
jmp 0x1005faa7
lea esp, [esp + 0x2c]
jne 0x1006969b
not cl
rdtsc
movzx eax, word [esp + 0x414]
not edx
bswap edx
xchg dx, cx
push 0x10037b50
jno 0x10050f6c
movzx cx, cl
lea edx, [ebp - 0x60b1b74e]
push eax
mov cl, 0x3d
rdtsc
lea ecx, [esp + 0x1a]
movsx eax, cl
mov al, ah
call fcn.10066d38
lahf
push ecx
call fcn.100678b4
mov byte [esp + 0xc], 0xf3
push dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop dword [esp + 0x48]
mov byte [esp + 0x14], 0x72
push dword [esp + 0x48]
ret 0x4c
pushal
test eax, eax
push ebx
push dword [esp]
jmp 0x1005a3b8
bswap si
sub esi, esi
or esi, esi
cmp bl, 0x90
pop esi
stc
clc
add esp, 0x414
pushal
push dword [esp + 4]
push 0x5598a58e
push dword [esp + 0x28]
ret 0x30
Function at 0x1006249b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10061b51
mov dword [esp], esp
lea esp, [esp + 4]
je 0x100017b9
shr edi, 0x13
sub di, bx
bswap di
push esi
bts si, dx
dec si
lea edi, [ecx*8 - 0x1beb9bb0]
not si
push ebx
shr edi, cl
test ch, 0x77
mov ebx, ecx
bts edi, 0xc
bsr esi, ebp
mov esi, dword [esp + 0x14]
test ah, 0x6c
movsx di, cl
bts di, bp
test esi, 3
call fcn.1006812e
cmp ch, al
neg ch
mov ecx, dword [esp + 0xc]
bt edx, 0xd
cmp sp, 0xf69e
push 0x96edba36
mov dword [esp], edi
clc
cmc
clc
cmc
test ecx, ecx
pushfd
jmp 0x1005f810

Function at 0x10062797
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [0x1003d338], al
setb ah
movsx si, cl
jmp 0x10065357
lea esi, [esp + 4]
mov eax, 0xfb524f46
setp ah
mov edx, eax
setnp ah
mov dword [esp], 0
cwde
not edx
cwde
push 5
call fcn.10051dbd

Function at 0x100644c8
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
cmp esi, esp
call fcn.1004e79a
call fcn.10063aff
stc
clc
cmc
jmp 0x10053e12
lea esp, [esp + 4]
je 0x10056602
pushal
clc
lea ecx, [ecx]
jmp 0x10060fa8

Function at 0x10064af0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 4], ecx
pushfd
call fcn.10053d31
lea esp, [esp + 0x28]
jne 0x1005ea2c
not al
setbe al
mov al, byte [ebp + 0xa]
call fcn.10058a7e

Function at 0x10064ba2
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp al, 0x5f
mov byte [esp + 8], 0x81
push 0x6b637bb9
mov dword [esp], 0xdaff10a7
mov word [esp + 0xc], sp
lea esp, [esp + 0x2c]
jne 0x1005ea2c
pushal
sete al
mov al, byte [ebp + 1]
pushal
pushfd
clc
stc
cmp al, 0x5e
pushfd
lea esp, [esp + 0x48]
jne 0x1005ea2c
cmp si, sp
cmc
rol al, cl
setl al
mov al, byte [ebp + 2]
pushal
mov byte [esp + 8], 0xd
mov byte [esp], dl
cmp al, 0x5d
push 0xa11de353
call fcn.1006d7c4
bt bx, 1
call fcn.10065922

Function at 0x100670a3
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
call fcn.1006d285
push esp
bts ax, dx
setne al
lea esp, [esp + 4]
popal

Function at 0x100671e8
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], eax
push dword [esp]
mov word [esp + 4], 0xcd74
pushfd
lea esp, [esp + 0xc]
call fcn.100567ab
pushal
lea eax, [ebx*2 + 0x36924ba2]
mov byte [0x1003ccd0], 0
lea eax, [esp + 0x63222448]
movsx ax, bl
push dword [esp]
not al
mov eax, dword [esp + 0x24]
pushfd
mov eax, dword [esp + 0x2c]
pushfd
push dword [esp]
push 0x2ade1605
lea esp, [esp + 0x3c]
jmp fcn.100021a3
mov dword [esp], eax
pushfd
mov dword [esp], eax
pushfd
mov byte [0x1003ccd0], 0x99
lahf
lea eax, [edx + 0x784ce5f]
mov eax, dword [ebp + 4]
jmp 0x10065d93

Function at 0x100673bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not cl
mov cl, byte [edx + 0x10037a8c]
pushal
jmp 0x100688f1
pushfd
mov byte [eax + 0x1003ced8], cl
pushfd
pushfd
pushfd
pushfd
lea esp, [esp + 0x3c]
jmp 0x10068c22
bts cx, sp
btc ecx, ecx
cmp sp, si
mov al, byte [ebp - 0xc]
inc cx
shld cx, di, cl
neg cx
xor cx, bp
add al, 1
shl cx, 0xd
shrd ecx, esp, cl
setne ch
neg cl
mov byte [ebp - 0xc], al
Function at 0x1006762d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x30], 0x1006a8f5
jmp 0x1006cce3
call fcn.1004e39b
pushal
lea esi, [esp + 0x20]
not cx
setae cl
bswap cx
mov dword [esp + 0x1c], 0x1003a090
pushal
mov dword [esp + 0x38], 0x40
push ebx
setns ch
xchg dh, ch
not cl
mov dword [esp + 0x38], 0xa
push 0x76cef72e
mov byte [esp], bh
mov ecx, dword [0x1003d39c]
movsx dx, dl
setne dl
not dh
not dl
mov dword [esp + 0x38], ecx
call fcn.10063c27

Function at 0x10067977
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x38]
je 0x10052177
pushal
not bl
pushal
push dword [esp]
mov bl, byte [ebp + edx]
jmp 0x10065064

Function at 0x10068083
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebx
pushal
call fcn.10054ad5
jmp 0x1006930a
pushal
push 0xdeb410f1
lea esp, [esp + 0x30]
jne 0x1005ea2c
rcl al, cl
mov al, byte [ebp + 4]
cmp ax, cx
pushfd
cmp al, 0x81
mov byte [esp], 0xff
lea esp, [esp + 4]
jne 0x1005ea2c
clc
pushal
dec al
mov al, byte [ebp + 5]
bt bx, 1
bt ebx, edx
cmc
cmp al, bl
cmp al, 0xc4
push edi
call fcn.1006a348
mov dword [esp + 8], eax
push 0x15362d8c
pushal
lea esp, [esp + 0x2c]
jbe 0x100607b1
pushfd
lea esp, [esp + 4]
call fcn.100567ab
pushal
not ah
pushal
mov byte [0x1003ccd0], 0
movzx ax, bl
mov eax, dword [esp + 0x40]
bswap ax
movzx ax, dl
mov eax, dword [esp + 0x44]
mov dword [esp], ecx
push 0x5685e4b5
lea esp, [esp + 0x4c]
jmp fcn.100021a3

Function at 0x100690f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], 0xa
rdtsc
setge dh
mov edx, dword [0x1003d39c]
lahf
pushfd
mov dword [esp + 0x24], edx
pushfd
seto ah
lahf
movsx ax, dl
mov eax, dword [0x1003d398]
pushfd
mov dword [esp + 0x28], eax
call fcn.1005b03e
mov dword [esp + 0x28], 0x40
lahf
jmp 0x10064cee

Function at 0x1006a139
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x7c9eb3fa
jmp 0x1005b9dc

Function at 0x1006aad6
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edi, 0xb7f3bdb0
pushal
cmp dword [eax + 0x10], ebx
mov word [esp], si
call fcn.1006a8ab

Function at 0x1006b414
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x1a
mov dword [esp], eax
shr eax, cl
cmc
movsx eax, cx
pushal
inc cl
ror ch, 3
test bp, dx
add eax, dword [esp + 0xec]
lea ecx, [ecx - 0x6585356]
pushal
bswap cx
call fcn.1006c030

Function at 0x1006b53f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1005a4c3
lea esp, [esp + 8]
jne 0x1005ea2c
rcl al, cl
sub al, 0x28
sal al, 6
mov al, 0xd8
mov al, byte [ebp + 0xa]
pushal
pushfd
cmp al, 0xc2
push 0xc6b2125f
mov byte [esp + 8], 0xd7
pushfd
lea esp, [esp + 0x2c]
jmp 0x10068758

Function at 0x1006b6d3
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x40]
call fcn.100080f0
clc
rcr edx, cl
mov edx, dword [esp + 0xd4]
test ch, bl
bt ebp, edi
add esp, 0xc
bt bp, 0xb
clc
test ah, 0x10
clc
cmp byte [edx + 1], 0x47
jmp loc.100017e4
Function at 0x1006bb67
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 0xd4]
movzx cx, cl
setbe dh
mov dword [esp + 4], 0x40
push 0xc08b33
push 0xfc45c6e
setg ch
pushal
mov dword [esp + 0x28], eax
call fcn.1006347d
jmp fcn.1004bd92

Function at 0x1006bfab
Capabilities:
Packed with generic packer

Disassembly:
bswap ax
pop eax
mov byte [0x1003ccd0], 0
push 0x4daa2965
mov eax, dword [esp + 4]
setp al
push 0xd0ab7beb
setb al
mov eax, dword [esp + 0xc]
pushfd
pushfd
pushal
push 0x1328976d
lea esp, [esp + 0x3c]
jmp fcn.100021a3

Function at 0x1006c230
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x44]
jne 0x1005ea2c
pushal
rcl al, cl
sbb al, cl
or al, 0xae
mov al, byte [ebp + 3]
test bl, 0xc9
jmp 0x10056ef8
jmp 0x1005d259
jmp 0x10051661

Function at 0x1006cd39
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt sp, 4
cmp al, 0x81
pushal
lea esp, [esp + 0x20]
jne 0x1005ea2c
shl al, cl
rol al, cl
adc al, ah
sar al, 5
mov al, byte [ebp + 5]
stc
cmp al, 0xc4
pushfd
jmp 0x1005e786
lea esp, [esp + 0x28]
jne 0x1005ea2c
sal al, 5
mov al, byte [ebp + 4]
jmp 0x10061562

Function at 0x1006d5eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
stc
cmp al, 0
jmp 0x10065a9d
pushal
pushal
jmp 0x10001693
pushfd
pushfd
lea esp, [esp + 0x30]
jne 0x1005ea2c
mov al, 0x37
bt edx, 0xd
mov al, byte [ebp + 0xc]
stc
jp 0x10052e4d
clc
cmp bp, dx
cmp al, 0
pushal
pushal
pushfd
push ecx
lea esp, [esp + 0x48]
je 0x10050ead
push 0xbbabf969
mov al, byte [ebp]
stc
mov byte [esp], bl
cmp al, 0x83
call fcn.1005adf0

Function at 0x1006d733
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x58]
call fcn.1006567b
clc
push ebp
jmp 0x100575f2

Function at 0x1006d7c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x1005ea2c
call fcn.100570a9
call fcn.100540c0