joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb51ff2
Capabilities:
Packed with generic packer

Disassembly:
nop
cmc
cmp esp, 0x5b496755
nop
clc
nop
test dl, 0x3b
nop
test si, 0x20a0
nop
nop
nop
nop
stc
nop
test edx, 0x323f3398
nop
jmp 0xccb70d
mov edx, 1
or ax, 0x73fa
mov edx, 2
inc dh
sal dx, cl
mov edx, 4
add dx, sp
sub dx, sp
mov edx, 2
shrd ax, ax, 0x12
cwd
mov edx, 5
sal edx, 0xf7
shl ax, cl
mov edx, 4
cmovge edx, eax
bt ax, 0xf8
mov edx, 2
adc dx, 0x37e5
sal ah, cl
mov edx, 5
mov dx, sp
xadd ax, ax
bt ax, si
mov edx, 5
and ax, ax
cmc
pop edx
mov dword [ebp - 4], 0
bt ax, dx
btr eax, esi
mov dword [ebp - 8], 0
cmp sp, si
or ax, sp
mov dword [ebp - 0xc], 0
clc
bt ax, sp
movsx eax, bx
push ecx
shr ax, 0x51
push edx
sbb edx, edx
test si, 0x3ccd
push ebx
or eax, 0x1d4721a
rdtsc
mov eax, 1
xor edx, 0x503521eb
cmp bx, bp
test si, 0x7c3f
cpuid
cmp sp, si
stc
xor ebx, ebx
not bl
mov bl, al
jmp 0xc4a4b0
push dword [ebp - 4]
movzx ebx, ax
mov bl, 0x68
push 1
cmovno ebx, edi
not bl
bswap bx
mov ebx, 0x44b1b0
jmp loc.004060c5
push ebp
inc ebp
mov ebp, esp
sub esp, 0x2c
clc
stc
mov dword [ebp - 4], 0
cmp edi, 0x50a63408
clc
mov dword [ebp - 8], 0
clc
test ch, 0xe8
jmp 0xccd35c
mov dword [ebp - 4], ebx
xchg bl, bl
mov bl, cl
cmovle ecx, ebp
not cx
movzx ecx, bx
mov dword [ebp - 8], ebx
mov bl, dl
xchg ecx, ecx
cmovae dx, sp
mov dword [ebp - 0xc], ebx
pop ebx
pop edx
xchg bl, cl
bswap ebx
movzx bx, ch
pop ecx
setno bl
push 0x80000301
mov ebx, edi
cmovns ebx, edi
mov bx, 0x7fe4
push 0
jmp 0xb38e08
mov eax, 6
popal
inc ax
shr ah, cl
push edx
jmp 0xb12f0d
nop
nop
clc
cmp esp, edi
nop
clc
nop
cmc
pushal
bsf eax, esi
shld esi, eax, 0x23
mov eax, 1
neg cl
mov eax, 2
bt edx, 0x50
mov eax, 4
bt esi, edx
mov eax, 2
test edi, 0x70aa05ac
test ax, ax
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
jmp 0xc96876
mov dword [ebp - 0xc], 0
cmp ebp, edx
stc
nop
cmp esi, edi
nop
cmc
nop
test bx, 0x7a44
nop
jmp 0xb0cda8
Function at 0xb76b2c
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0xbd3ad5
nop
jmp 0xc8b117
nop
nop
jmp 0xb0cab2
push ebp
mov ebp, 0x531d580c
jmp 0xc75d41
pushal
cbw
not ah
mov eax, 1
bswap eax
mov eax, 2
bswap ecx
not cl
mov eax, 4
mov eax, 2
movsx esi, si
xchg edi, esi
movzx ax, bl
mov eax, 5
mov eax, 4
cmovae edi, eax
movsx ebp, di
mov eax, 2
rdtsc
xchg esi, eax
mov eax, 5
mov eax, 6
not cl
jmp 0xb818d5
popal
fninit
mov dword [ebp - 8], esp
push 0
movzx ax, bh
not ax
movsx ax, ch
mov eax, 0x1b
jmp 0xc4fe80
nop
jmp 0xc52136
je fcn.00bd523a
push 6
jmp loc.00407faf
nop
nop
nop
jmp 0xc66bf6
nop
nop
jmp 0xb7e75d
call fcn.00c838a5
cmp dword [ebp - 8], esp
jmp 0xb980d5
nop
jmp 0xad0cec
mov dword [ebp - 4], 0
nop
jmp 0xb10fd3
nop
nop
nop
jmp 0xc7d46e
mov ebp, esp
sub esp, 8
jmp 0xc5e00c
nop
nop
jmp 0xc243b3
nop
jmp 0xb94122

Function at 0xb84945
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
nop
jmp 0xc51931
nop
jmp 0x433e34
push ebp
xchg bp, bp
movsx ebp, si
not ebp
mov ebp, esp
jmp 0xbede45
nop
nop
jmp 0xab496b
nop
jmp 0xb3524e

Function at 0xb8c9d5
Capabilities:
Check for software breakpoints
Encrypt data using speck
Packed with generic packer

Disassembly:
call fcn.00a687a2
add esp, 4
movzx esi, sp
mov dword [ebp - 0x1c], eax
movzx edi, ax
mov edi, eax
cwde
mov si, ax
mov esi, 0x50d7c9
cbw
lodsd eax, dword [esi]
jmp 0xac96a6
mov dword [ebp - 0x20], 0
jmp 0xb299b3
stosd dword es:[edi], eax
xchg al, ah
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x24], 0
jmp 0xaa558d
nop
jmp 0xbf43e9
push 8
call fcn.00a687a2
add esp, 4
bswap di
jmp 0xc35d72
mov dword [ebp - 0x18], 0
jmp 0xc8e9e1
nop
jmp 0xbb1e85
lodsd eax, dword [esi]
movzx cx, dl
stosd dword es:[edi], eax
mov ah, 0x83
lahf
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
jmp 0xbeb4c3
mov dword [ebp - 0x28], 0
push 0x198
jmp 0xc8e326
nop
nop
jmp 0xc148d0
push ebp
shr bp, 0x8c
mov ebp, esp
cmp ebp, 0x1e6d0a20
stc
test sp, si
sub esp, 0x74
jmp 0xc9ce2b
nop
jmp 0x43602b
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
jmp 0xcb97ce
nop
jmp 0xb25525
nop
jmp 0xc599a3
stosd dword es:[edi], eax
jmp 0xae5c44
mov ecx, 0x64
jmp 0xc571a7
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0xbbed23
nop
jmp 0xb52033
nop
nop
jmp 0xba2e78
mov dword [ebp - 0x14], 0
jmp 0xb2289c
mov dword [ebp - 0x4c], eax
mov edi, eax
not ah
cwde
mov esi, ecx
mov esi, 0x50d7c9
lodsd eax, dword [esi]
jmp 0xbf27b6
mov dword [ebp - 4], 0
jmp 0xcad512
mov dword [ebp - 0x10], 0
jmp 0xc1c5c7
rep stosd dword es:[edi], eax
jmp 0xb95a56
nop
nop
jmp 0xb8ff44
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
jmp 0xca28a4
call fcn.00a687a2
add esp, 4
xchg cx, cx
bswap si
mov ecx, esi
mov dword [ebp - 0x2c], eax
mov edi, eax
mov cx, 0x433f
movsx ax, bl
mov esi, 0x50e27a
cwde
lahf
jmp 0xb26dc4
push 8
jmp 0xa973bc
mov dword [ebp - 8], 0
jmp 0xc413ab
mov dword [ebp - 0x44], 0
jmp 0xcbceb5
mov dword [ebp - 0xc], 0
jmp 0xc52044
mov dword [ebp - 0x38], 0
jmp 0xc6fcfb
mov dword [ebp - 0x48], 0
jmp 0xaf6ce2
Function at 0xba36cf
Capabilities:
Packed with generic packer

Disassembly:
push ebp
bsf ebp, edx
mov ebp, esp
sub esp, 0x10
jmp 0xc1ded5
mov dword [ebp - 4], 0
jmp 0x42d25d

Function at 0xba9bde
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
nop
cmc
stc
nop
nop
jmp 0xaf9d67
nop
nop
clc
jmp 0xab781d
nop
jmp 0xbf53f8
push ebp
mov ebp, esp
cmp cx, sp
lea esp, [esp - 8]
mov dword [ebp - 4], 0
clc
cmp bl, bl
nop
nop
cmp esi, edi
jmp 0xab8911
nop
clc
test ch, ah
nop
nop
nop
cmp di, 0x5011
test bp, 0x119c
nop
nop
nop
nop
cmp edi, ebp
nop
nop
pushal
bt ebx, 0xc8
rcl ebx, 0xd3
mov eax, 1
mov eax, 2
mov eax, 4
bts ebp, eax
btr ax, 0xf3
bt bx, dx
mov eax, 2
shld dx, dx, 0xac
mov eax, 5
mov eax, 4
test esi, edi
mov eax, 2
mov eax, 5
shr dl, 0x27
mov eax, 6
add di, bp
xor dx, di
popal
shl bh, 0xc8
push edx
sar dx, cl
mov edx, 1
rdtsc
mov edx, 2
mov edx, 4
cmp esp, 0x258c5528
shrd ax, cx, 0x6f
cdq
mov edx, 2
sbb bl, 0xb5
shl dh, cl
mov edx, 5
shl bh, 0xbd
mov edx, 4
lahf
shl bh, cl
mov edx, 2
mov edx, 5
sbb bx, di
xadd ah, dh
mov edx, edi
mov edx, 5
pop edx
btr ebx, edx
clc
rcr ax, 0xa1
push edx
xor al, 0xd1
rdtsc
dec bh
add bx, si
sub eax, eax
mov al, dh
mov dword [ebp - 4], eax
jmp 0xc08144
jmp loc.0042189e
pop edx
mov ebx, esi
push 0x80000301
movzx ebx, si
not bh
push 0
xchg bx, bx
cmovle ebx, esi
push dword [ebp - 4]
bswap bx
mov bh, 0x27
push 1
mov ebx, 0x44b1b0
jmp 0xc79c19
call fcn.00cb9e3c
add esp, 0x10
jmp 0xbfb5ea

Function at 0xbad36e
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
jmp 0xbc6d98
nop
jmp 0x40894c
mov dword [ebp - 0xc], 0
jmp 0xbce8bf
nop
jmp 0xcb4f31
push ebp
mov ebp, esp
cmp edx, 0x7964419
sub esp, 0x44
jmp 0xc13a45
nop
jmp 0xb130a6
nop
jmp 0xbe82ef
nop
jmp 0xadc2ab
nop
jmp 0xba5c51
mov dword [ebp - 4], 0
jmp 0xc52038
mov dword [ebp - 8], 0
jmp 0xb895e9
nop
nop
nop
jmp 0xbe707d

Function at 0xbc235c
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
nop
nop
nop
nop
nop
clc
test bp, 0x4ff9
nop
cmc
cmp dh, 0xff
nop
nop
clc
cmp dl, dl
nop
nop
cmp bp, bp
nop
nop
test bp, 0x5c90
cmp edx, esi
nop
pushal
xor dx, di
stc
mov eax, 1
bsf bx, cx
mov eax, 2
shr ax, 0xac
xadd eax, ebp
mov eax, 4
inc bp
mov eax, 2
bts ecx, ecx
mov eax, 5
sal dh, 0xbd
xadd ebp, edx
rcr dx, 0xa5
mov eax, 4
shl ebp, 0xd3
rcr edi, 0xf
bt cx, 0x7f
mov eax, 2
rcl dl, cl
mov eax, 5
adc bl, 0x1d
btc ebx, 0xc9
btc dx, bx
mov eax, 6
popal
rcl ax, 0xe9
push edx
add ah, 0xe9
btr dx, 0x1b
mov edx, 1
lahf
mov edx, 2
cwd
bts dx, sp
sar al, 0xfb
mov edx, 4
btr dx, 0xc7
mov edx, 2
mov edx, 5
shr al, cl
adc edx, edx
mov edx, 4
mov edx, 2
xchg edx, eax
xor edx, 0x72c75604
mov edx, 5
cwde
mov edx, 5
bt edx, ecx
pop edx
ror ax, cl
sets ah
cwde
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add eax, 0x100
jmp 0xbdfb14
push ebp
neg bp
cmp si, 0x733b
mov ebp, esp
sub esp, 4
clc
cmp dl, 0xcf
test esi, esp
mov dword [ebp - 4], 0
cmp ebx, eax
nop
test dx, di
nop
test sp, cx
clc
nop
test cl, ch
jmp 0xb73737
mov dword [ebp - 4], eax
mov eax, 0x667b4857
movsx eax, bx
mov eax, dword [ebp - 4]
jmp 0xcb7ec2
jmp loc.00421db4
Function at 0xbc50a1
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebp - 4]
jmp 0xb2a5a3
push ecx
mov cx, di
push eax
cwde
mov eax, 1
cmovo cx, cx
bswap eax
jmp 0xc22204
jmp loc.00423018
push ebp
mov ebp, esp
lea esp, [esp - 4]
cmp edi, ecx
mov dword [ebp - 4], 0
test sp, bp
nop
nop
cmp edx, esi
jmp 0xc8e5ab
mov dword [ebp - 4], eax
jmp 0xaed9a6
mov ecx, 2
mov eax, 4
mov eax, esp
mov al, 0xa8
cmovs eax, ebx
mov ecx, 2
movzx cx, ch
mov ecx, edi
pop eax
cmovns cx, bx
pop ecx
nop
movzx eax, di
movzx ax, ch
not eax
nop
cbw
nop
movzx eax, cx
movsx ax, ch
nop
nop
not al
movsx ax, cl
nop
lahf
nop
cbw
nop
not ax
mov eax, edi
xchg al, ah
nop
jmp 0xc49c83
nop
nop
nop
seta al
movzx eax, si
cwde
nop
bswap ax
movzx ax, al
nop
nop
nop
bswap ax
sets al
nop
cbw
movzx eax, si
nop
bswap eax
mov ax, bp
movsx ax, dl
nop
movsx ax, dl
nop
jmp 0xad5651
nop
nop
clc
nop
stc
test ax, 0x40a6
nop
jmp 0xc9d250
nop
nop
nop
cmp dx, 0x485c
stc
nop
cmp esp, 0x55f94b37
nop
cmp bh, 0x63
cmp sp, di
nop
nop
nop
nop
cmc
nop
stc
cmp ax, 0x731f
nop
test si, si
test cx, 0x70c9
nop
jmp 0xc5362b
pushal
mov di, 0x774d
mov eax, 1
mov eax, 2
add esi, 0x4215787b
btc ecx, 0xf9
mov eax, 4
sal cx, 0xc2
mov eax, 2
mov eax, 5
movzx ebp, ax
mov eax, 4
add bx, bp
btc ebx, edx
mov eax, 2
mov eax, 5
dec bp
sar esi, 0x3e
mov eax, 6
movzx edx, di
sar ecx, 0xea
test ax, si
popal
bts ax, ax
push edx
mov edx, 1
sub dl, 0xbd
mov edx, 2
shrd edx, edx, 0xa
lahf
inc dl
mov edx, 4
shr dh, cl
rcl dx, cl
shl edx, cl
mov edx, 2
rcl edx, cl
bt eax, 0xa4
sbb dh, 0x43
mov edx, 5
sbb edx, ebx
xor dl, bh
rcl ah, 0x75
mov edx, 4
sar dl, 9
cmp esi, 0x6856dec
rol ah, 0x4a
mov edx, 2
cdq
mov dh, 0xe5
clc
mov edx, 5
bts edx, esp
mov edx, 5
sbb eax, 0x5c2b6809
xor dh, 0xa1
pop edx
mov dword [ebp - 4], 0
bswap eax
dec al
ror al, cl
mov eax, dword fs:[0x18]
cmp ecx, edi
add eax, 0x400
jmp 0xc1c70f

Function at 0xbe33b1
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp cx, si
cmc
sub esp, 4
nop
jmp 0xc93c36
nop
jmp 0x434d06
nop
jmp 0xc9eb0a
nop
jmp 0xc88753

Function at 0xbf663d
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
test ah, 0xf7
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
clc
mov dword [ebp - 0xc], 0
test esp, ebp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp bh, al
test si, 0x75cd
nop
cmp esi, 0x7a817206
cmc
nop
jmp 0x43351c

Function at 0xc018fb
Capabilities:
Get process heap flags
Get process heap force flags
Packed with generic packer

Disassembly:
nop
cmc
cmp sp, ax
nop
test bp, si
stc
nop
jmp 0xbf91c9
nop
cmp ebp, edi
nop
test ebx, 0x431632c7
cmp cx, cx
nop
nop
jmp 0x402f14
push ebp
stc
cmc
rol bp, 0x45
mov ebp, esp
test ebp, 0x4d7b6369
stc
lea esp, [esp - 4]
jmp 0xc38993
mov dword [ebp - 4], 0
nop
cmp edi, ecx
stc
nop
nop
test edi, edi
jmp 0xcbf74d
nop
test esi, 0x171e66e1
stc
nop
nop
nop
cmc
jmp 0xb83949
Function at 0xc1ecb0
Capabilities:
Packed with generic packer

Disassembly:
je 0xad5259
push 6
jmp 0xbedf4d
nop
jmp 0x40b516
nop
nop
stc
cmp si, 0x7924
cmc
nop
cmp ebp, ebp
nop
nop
jmp 0xc2d6bb
test eax, eax
jmp 0xafcdda
call fcn.0044a4c8
add esp, 4
jmp 0xbfe3da
lea esp, [esp - 0x1c]
clc
mov dword [ebp - 4], 0
cmp edx, 0x4435597a
clc
stc
mov dword [ebp - 8], 0
cmc
test esp, 0x79511f65
mov dword [ebp - 0xc], 0
cmp ah, 0x1b
jmp 0xabfb0d
push 0
jmp 0xac33c7
je 0xc4ca21
mov dword [ebp - 0x10], esp
setb ah
movsx ax, cl
movzx eax, sp
push 0x2710
push 0
movzx eax, dx
push 0x10
push 0x50e2d4
not ah
bswap eax
push 0x50e2dd
bswap eax
setge ah
push 0
cmovae eax, esp
mov eax, 0x1c
jmp 0xb69745
call fcn.00c838a5
cmp dword [ebp - 0x10], esp
jmp 0xa69ea1
je 0xc72b79
cmp dword [ebp - 0xc], 0
jmp 0xbf6b5f
call fcn.00bfe2e8
add esp, 4
jmp 0xad5259
je 0xc72b79
xor eax, eax
jmp 0xc3c7b9
call fcn.00416910
cmp dword [ebp - 4], 0xfffffff5
je 0xc4ca21
push 0
xchg bl, bl
bswap ebx
mov ebx, 0x44d4b0
jmp 0xc6f9d7
nop
jmp 0xa97936
push ebp
shl ebp, 0x18
mov ebp, esp
jmp 0xac6571
nop
test sp, ax
nop
nop
cmp edx, ecx
nop
clc
stc
test eax, ecx
nop
cmp ebp, eax
cmp ch, 0x37
nop
test dx, bx
nop
nop
test edi, 0x537f6f78
cmp edx, ecx
nop
nop
nop
nop
test eax, ebp
cmp sp, di
nop
jmp 0xc55376
jmp 0xac316a
push ecx
cmovp cx, bp
not cx
push eax
movzx eax, bp
mov cx, 0x690
mov eax, 1
bswap cx
movzx ecx, bp
mov ecx, 2
movzx ecx, dx
mov ax, sp
bswap ax
mov eax, 4
setnp ah
mov ecx, 2
not eax
pop eax
pop ecx
jmp 0xc08209
pushal
rdtsc
sub esi, eax
mov eax, 1
movzx dx, bh
mov ch, 0xa9
mov eax, 2
ror dh, cl
mov eax, 4
sub al, 0x18
bswap esi
cmp bh, 0x8e
mov eax, 2
sar bh, 1
mov eax, 5
cmovns ebx, esp
cmc
cwde
mov eax, 4
movzx ax, bh
adc di, 0x4cc4
btr ax, 0xeb
mov eax, 2
shl bl, cl
xchg ebp, edi
mov eax, 5
mov eax, 6
sub si, 0x5194
popal
cwde
push edx
movsx eax, si
rcr ah, 0xec
xor edx, edx
mov edx, 1
btr eax, edx
mov edx, 2
rol eax, 0x2e
bts eax, eax
and ax, 0x3de8
mov edx, 4
mov edx, 2
rcl ah, 0xa1
dec eax
mov edx, 5
mov ax, sp
mov edx, 4
btr eax, 0x87
rol al, 0x6b
mov edx, 2
mov edx, 5
cmc
movzx edx, ax
mov edx, 5
or eax, esi
bts edx, ecx
rcl eax, 0x41
pop edx
cwde
seto al
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
shl eax, 0xe7
btc ax, 0xb2
mov dword [ebp - 0xc], 0
bswap ax
shld ax, cx, 0x4c
mov eax, dword fs:[0x100]
cmc
stc
mov dword [ebp - 4], eax
mov eax, dword fs:[0x104]
cmc
stc
mov dword [ebp - 8], eax
sal ah, 0x38
mov eax, dword fs:[0x124]
nop
clc
mov dword [ebp - 0xc], eax
cmp sp, bx
nop
cmp ebp, edi
nop
cmp ebp, 0x793b581b
clc
cmp dword [ebp - 4], 0
je 0xc72b79
cmp dword [ebp - 8], 0
jmp 0xbba31a
call fcn.00cb9e3c
add esp, 4
jmp 0xbfe3df
mov eax, 1
jmp 0xac316a

Function at 0xc39880
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
jmp 0xc4db7c
nop
jmp 0x435285
nop
nop
jmp 0xb2755e
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
jmp 0xba092d
nop
jmp 0xb6ae69
Function at 0xc450ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
cmc
stc
nop
nop
clc
test ah, 0x95
jmp 0x430d6f

Function at 0xc567fd
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
jmp 0x46aad5
mov dword [ebp - 4], 0
nop
jmp 0xb62356
push ebp
cmp ecx, edi
and bp, dx
mov ebp, esp
cmc
stc
sub esp, 4
jmp 0xbda935

Function at 0xc57aeb
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Check os version
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Parse credit card information
Parse pe header

Disassembly:
nop
nop
clc
cmc
test ebx, 0x1e043e58
nop
cmp esi, 0x1a5863b2
cmc
nop
stc
test si, 0x3015
nop
nop
clc
nop
jmp 0x42dd49
push ebp
mov ebp, esp
lea esp, [esp - 0x68]
cmp ebx, 0x5fdc0815
jmp 0xcb0b06
mov dword [ebp - 4], 0
stc
mov dword [ebp - 8], 0
cmc
stc
mov dword [ebp - 0xc], 0
cmp bp, dx
mov dword [ebp - 0x10], 0
test bl, 0x12
mov dword [ebp - 0x14], 0
jmp 0xa734e6

Function at 0xc5c338
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0xbbde67
nop
nop
nop
jmp 0xbf59cc
nop
jmp 0xad4a5f
nop
nop
jmp 0x423278
nop
jmp 0xad47aa
nop
nop
nop
jmp 0xc26429
nop
nop
jmp 0xc35e38
push ebp
xor bp, 0x4ee5
rcl bp, 0xff
movsx ebp, si
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
jmp 0xc429bc

Function at 0xc6b3be
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
nop
jmp 0xb0eb4a
nop
nop
nop
jmp 0xc4d5a1
nop
nop
jmp 0xc68736
nop
jmp 0xc0ffb1
nop
jmp 0xc5e305
nop
jmp 0xb83a72
mov dword [ebp - 4], 0
jmp 0xb09fb7
nop
jmp 0xc4c9d2
nop
jmp 0xcb5295
nop
jmp 0xca9e1a
nop
jmp loc.00431447
nop
jmp 0xc3490d
push ebp
mov ebp, esp
sub esp, 0x10
jmp 0xc29488
nop
nop
jmp 0xb3b3e1
nop
nop
jmp 0xb3c230

Function at 0xc71640
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
jmp loc.0044c78f

Function at 0xc7678e
Capabilities:
Packed with generic packer

Disassembly:
nop
test sp, 0x9e
stc
nop
nop
clc
cmp sp, bx
test ecx, ebp
nop
test edi, ecx
nop
cmp bp, 0x3819
cmc
nop
test dh, 0x53
cmp ebp, eax
cmc
nop
nop
jmp 0xc400e2
nop
cmp edi, ebp
nop
cmc
nop
pushal
or bh, dh
mov ecx, ebp
mov eax, 1
bt dx, 0x5c
mov eax, 2
or eax, 0x9ed18af
btc cx, 0x4b
mov eax, 4
btr ax, 0x6e
btc edx, ebx
mov eax, 2
bsf di, cx
lahf
rcr ebx, 0xf3
mov eax, 5
dec edi
sar bh, 0x52
rol ah, cl
mov eax, 4
ror ebp, 0xd9
mov eax, 2
btr ebp, ecx
sub cx, 0x2f5c
mov eax, 5
cmovle ebp, ebp
add bx, 0x56d3
btc si, 0xc2
mov eax, 6
popal
sub eax, 0x6318503a
sar eax, 0x4b
push edx
not dl
cwde
mov edx, 1
neg dl
mov edx, 2
mov edx, 4
mov edx, 2
shr dl, 0x59
shrd ax, si, 0xbc
setne ah
mov edx, 5
bswap eax
rcl dh, 0x18
mov edx, 4
sub eax, 0x6a25ad4
shl edx, cl
shr dl, cl
mov edx, 2
jmp loc.00402e1d
push ebp
mov ebp, esp
cmp esi, ebp
clc
cmc
nop
test cl, 0xff
cmp dx, sp
nop
clc
nop
nop
stc
cmp cl, 0x6c
cmp edx, eax
nop
cmp eax, ebx
test bp, dx
nop
cmp edx, esi
clc
nop
test esp, 0x7dd010c9
jmp 0xc18e9b
Function at 0xc7fafe
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 8], 0
cmp bh, 0xe5
cmc
jmp 0xb04387
mov eax, 4
cbw
not si
mov eax, 2
cdq
mov eax, 5
stc
test dx, bp
mov eax, 4
ror bl, cl
rcr dl, cl
sar esi, 0x8b
mov eax, 2
movzx esi, si
sub bp, 0x7903
cbw
mov eax, 5
movsx ax, bh
mov eax, 6
cwd
rol ch, cl
popal
inc bl
bsf ebx, ebx
shr eax, 0xfa
push edx
mov edx, 1
btr eax, esi
or ebx, 0x298055f
sub bx, bp
mov edx, 2
shl al, 0x51
mov edx, 4
cmc
bt dx, di
sbb bh, al
mov edx, 2
mov edx, 5
ror ebx, cl
sub ah, cl
mov edx, 4
mov edx, 2
mov edx, 5
not ax
mov edx, 5
bsf eax, esp
pop edx
sal al, cl
or ebx, 0x5b21376a
mov ebx, dword [ebp + 8]
sal al, cl
btc eax, 0xf
mov eax, dword [ebx]
test eax, eax
jmp 0xc69a17
mov dword [ebp - 0xc], 0
cmp dx, 0x50f3
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp esi, esp
nop
nop
test sp, 0x1964
cmc
cmp si, dx
nop
test ecx, ebx
clc
nop
cmc
cmp sp, dx
nop
nop
test esi, ebp
cmp esp, esi
nop
nop
cmp esi, ebp
nop
cmp cx, si
nop
nop
nop
cmc
jmp 0xc3408c
nop
stc
nop
cmc
jmp 0xc9bd0d
call fcn.00a687a2
pop ecx
cmovo bx, bx
not si
pop esi
mov edi, eax
xchg bl, bl
not bx
rep movsb byte es:[edi], byte [esi]
cmp cl, 0x21
ror bx, 0x63
push eax
mov ebx, dword [ebp - 4]
test dx, 0x437f
test ebx, ebx
je 0xc55c0c
push ebx
call fcn.00c01c6e
lea esp, [esp + 4]
cmovl ax, dx
pop eax
mov dword [ebp - 4], eax
add al, bl
or eax, 0x2134581e
movsx ax, cl
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jmp 0x4090d0
je 0xc55bed
push eax
cmp edi, 0x353c5563
mov eax, dword [eax + 4]
add eax, 8
jmp 0xc90499
push ebp
btc bp, 0x21
cmp ecx, 0x8793378
mov ebp, esp
lea esp, [esp - 0x1c]
mov dword [ebp - 4], 0
jmp 0xa65550
push eax
jmp 0xc55bcf
nop
test ebx, esp
nop
cmc
cmp edi, 0x3b366698
nop
cmp di, dx
test edi, esi
nop
test sp, 0x392a
pushal
xor ecx, ebx
mov edx, 0xf071ef3
mov eax, 1
mov eax, 2
movsx edx, bp
jmp 0xa65fc0

Function at 0xc8471a
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x42ce17
nop
jmp 0xb26f8c
nop
jmp 0xb3c1fb
push ebp
bt ebp, esp
clc
sub ebp, ebx
mov ebp, esp
test bp, 0x6521
clc
cmc
sub esp, 0xc
jmp 0xc71b89
Function at 0xc970be
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x2c], 0
jmp 0xb81895
mov dword [ebp - 4], 0
jmp 0xc35eb0
call fcn.004205a5
mov dword [ebp - 0x3c], eax
mov ebx, ecx
movzx bx, cl
fild dword [ebp - 0x3c]
movsx bx, al
movsx ebx, bp
fstp qword [ebp - 0x3c]
cmovbe bx, sp
fld qword [ebp - 0x3c]
not ebx
movsx ebx, bx
xchg ebx, ebx
fmul qword [0x50de1a]
fstp qword [ebp - 0x44]
push 0x80000601
bswap bx
mov bx, 0x79bd
setp bl
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 1
mov ebx, 0x44c6d0
jmp 0xbc0113
nop
jmp 0xcc7a05
nop
nop
jmp 0xcbe0ac
nop
nop
jmp 0xbf95f3
mov dword [ebp - 0x18], 0
push 8
call fcn.00a687a2
add esp, 4
mov si, 0x3d38
mov dword [ebp - 0x1c], eax
mov edi, eax
cmove si, sp
cwde
jmp 0xc7d600
nop
nop
jmp 0xc34a88
call fcn.00cb9e3c
add esp, 0x10
jmp loc.00434cc8
nop
nop
jmp 0xc8c321
pushal
mov eax, 1
mov eax, 2
movsx ebp, di
cwd
mov eax, 4
setp al
cwde
mov eax, 2
mov eax, 5
movsx esi, di
setnp cl
mov eax, 4
cmovl edi, esi
movzx dx, cl
mov eax, 2
cbw
mov eax, 5
mov bx, 0x1a19
cbw
mov eax, 6
popal
jmp 0xc7a3f5
mov dword [ebp - 0xc], 0
jmp 0xcc52ce
nop
jmp 0xaf481a
nop
jmp 0xac2201
mov dword [ebp - 8], 0
jmp 0xc07ddd
mov dword [ebp - 0x14], 0
jmp 0xb5c0ec
nop
jmp 0xc33ce1
nop
jmp 0xc73ab8
stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0
jmp 0xca7e5b
nop
jmp 0xbe6948
fninit
mov dword [ebp - 4], 0xd2cd5554
call fcn.00b6ff29
mov dword [ebp - 0x30], eax
jmp 0xab2744
mov esi, 0x50d7c9
lodsd eax, dword [esi]
jmp 0xc8e17b
nop
jmp 0xc48b3b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0xc6bf9d
push ebp
mov ebp, esp
test bp, 0x1aef
clc
cmp al, dl
sub esp, 0x88
jmp 0xaaca1a
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
jmp 0xa9fab2
nop
jmp 0xc4e06d
mov dword [ebp - 0x10], 0
jmp 0xc39d33
nop
nop
jmp 0xad2c20

Function at 0xc9cb62
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0xbcf7e9
nop
nop
nop
nop
jmp 0x424221
nop
jmp 0xb70c81
push ebp
mov ebp, esp
test bp, 0x19f
sub esp, 0xc
jmp 0xc2abd4
Function at 0x4c56e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6d000]
push edi
or ebp, 0xffffffff
jmp 0x4c5702
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c5709
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c56f8
mov eax, 1
add ebx, ebx
jne 0x4c571b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c572c
jne 0x4c574b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c574b
dec eax
add ebx, ebx
jne 0x4c5738
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c5710
add ebx, ebx
jne 0x4c5747
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c579d
xor ecx, ecx
sub eax, 3
jb 0x4c5763
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c57d2
sar eax, 1
mov ebp, eax
jmp 0x4c576e
add ebx, ebx
jne 0x4c576e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c573c
inc ecx
add ebx, ebx
jne 0x4c577c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c573c
add ebx, ebx
jne 0x4c5789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c577e
jne 0x4c579a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c577e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c57bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c57ae
jmp 0x4c56fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c57bc
add edi, ecx
jmp 0x4c56fe
pop esi
mov edi, esi
mov ecx, 0x198b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c57da
cmp byte [edi], 0x12
jne 0x4c57da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c57df
lea edi, [esi + 0xc3000]
mov eax, dword [edi]
or eax, eax
je 0x4c5857
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc6f7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc701c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c580c
mov ecx, edi
jns 0x4c583b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc7020]
or eax, eax
je 0x4c5851
mov dword [ebx], eax
add ebx, 4
jmp 0x4c5829
call dword [esi + 0xc7028]
mov ebp, dword [esi + 0xc7024]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
and byte [edi + 0x21f], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c5885
sub esp, 0xffffff80
jmp 0x427c2a