joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45252c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47cbb0]
cmp dword [eax + 0x30], 0
je 0x4525d6
cmp dword [ebx + 0x94], 0
jne 0x4525d0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4524bc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4525d0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452596
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4525d0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413e58
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4525a5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453134
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x453169
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404324
jmp 0x453176
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404288
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454288
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4542c9
mov eax, esi
call fcn.0043a8a0
test al, al
je 0x4542c9
mov eax, dword [ebx + 0x84]
call fcn.0043a59c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4542c9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a59c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4579b4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4579e2
mov eax, ebx
call fcn.00458468
cmp dword [ebx + 0x40], 0
je 0x4579db
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x457a53
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x457a45
cmp dword [ebx + 8], 0
je 0x457a04
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x457a16
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x457a45
cmp dword [ebx + 8], 0
je 0x4579f7
cmp eax, 3
je 0x457a29
dec eax
jne 0x4579f7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4579f7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4579f7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x457a71
cmp dword [ebx + 0x14], 0xcc
je 0x457a71
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00457a7c
pop ebx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x403e59
pop dword [ebp - 4]
mov eax, 0x403e59
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x1fad0e74
add dword [ebp - 0x14], 0x2ea536d7
mov dword [ebp - 0x10], 0x12e990cd
add dword [ebp - 0x10], 0x1f49bb78
mov dword [ebp - 0xc], 0x9ff3d157
add dword [ebp - 0xc], 0xac5872d7
mov dword [ebp - 8], 0x77cb5e6
sub dword [ebp - 8], 0x77cb5e6
lea eax, [ebp - 0x14]
push eax
mov eax, 0x5be420a
sub eax, 0x57dc17e
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xd5eb6c88
add dword [ebp - 0x14], 0x9e86fcce
mov dword [ebp - 0x10], 0x4786de27
sub dword [ebp - 0x10], 0x61a7cb2
mov dword [ebp - 0xc], 0x47a983b
add dword [ebp - 0xc], 0x5ef4d431
mov dword [ebp - 8], 0x540d98a
sub dword [ebp - 8], 0x540d98a
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x40f49793
add eax, 0xbf4be941
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3a31d
push 0
call eax
mov ecx, 0x73db6625
sub ecx, 0x73db105b
mov ebx, eax
mov esi, 0xe01cda40
sub esi, 0xdfdbca40
add esi, dword [ebp - 4]
mov edi, 0x1ae8885
mov edx, dword [esi]
xor edx, edi
mov dword [ebx], edx
add ebx, 4
add esi, 0xe18f5f51
add esi, 0x1e70a0b3
loop 0x403f70
add eax, 0x149fb
xor ebx, ebx
add ebx, eax
add eax, 0x29ffcf1e
add eax, 0xd60030e7
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x5edfc4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0x8b2ba3
movzx ecx, cl
movzx eax, word [esi]
pushal
not cx
movzx ecx, word [esi + 2]
pushal
pushfd
inc ebx
mov byte [esp + 0xc], ch
cmp ch, 0xfb
add eax, ecx
clc
cmc
bt ebp, 0xd
stc
cmp ebx, eax
pushfd
mov dword [ebp - 4], ebx
call fcn.008b2b99
push 0xbce757a5
pushal
pushfd
mov word [esp], 0xb720
jmp 0x872234
mov dword [esp + 0x20], 0x4a415ec5
push dword [esp]
push ebx
lea esp, [esp + 0x28]
jmp int.0041cca4

Function at 0x616871
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
mov dword [esp + 0x24], edi
mov byte [esp], 0xdf
lea esp, [esp + 0x24]
jmp 0x8f1f93
lea esp, [esp + 0xc]
jle 0x8b2bb6
pushfd
jmp 0x5f10ae

Function at 0x61e828
Capabilities:
Encode data using xor

Disassembly:
push edi
mov byte [esp], 0x56
lea esp, [esp + 4]
je 0x5e712f
neg dh
movzx ecx, word [edi]
xor edx, 0x268f5709
movzx edx, word [edi + 2]
bt edx, edx
jmp 0x759d5b
jmp 0x8a9e53
cmp al, 0x7a
cmc
sub esi, esi
pushfd
bt di, bx
add ecx, edx
stc
bt ax, cx
stc
clc
mov dword [ebp - 8], esi
pushfd
test bh, bl
clc
bt cx, bx
test ecx, ecx
push dword [esp]
pushal
lea esp, [esp + 0x2c]
jle 0x71dd85
sub ax, 0x44d8
sar al, 1
mov eax, dword [edi + esi*8 + 4]
clc
pushal
bt cx, 5
test eax, eax
pushal
call fcn.008ed3a6
add esp, 4
jle 0x8b23c2
test edi, edi
pushfd
lea esp, [esp + 4]
jno 0x84a6b4
pushfd
lea esp, [esp + 4]
je 0x5e712f
shrd dx, dx, 4
movzx ecx, word [edi]
bsf dx, cx
stc
adc dl, bl
movzx edx, word [edi + 2]
test ah, al
stc
pushal
pushfd
xor esi, esi
stc
add ecx, edx
cmc
call fcn.00621ee2
pushfd
mov dword [esp], 0xccdf57ee
call fcn.0092a3a5
pushfd
mov word [esp], bp
push 0xd246ddc6
mov dword [esp + 4], 0x77e557e6
call fcn.0090b728
call fcn.00904e78
add edx, ebx
push esp
mov dl, 0x40
jae 0x84690a
pop es
sahf
cmp eax, 0x1ffc34df
cmp dword [esi], 0xcff331d6
invalid
sub edx, ebp
push ss
dec esi
adc al, 0x8d
sbb al, byte [edx - 0x4dac68b3]
jmp 0x8468d6
jmp 0x5ee190
push dword [esp + 0xc]
mov byte [esp], 0x46
lea esp, [esp + 0x24]
call fcn.005f2751
cmp cx, 0x3f0e
cmp ah, ah
jmp 0x846869
lodsd eax, dword [esi]
invalid
clc
test edi, edi
call fcn.0091d584
pop eax
mov eax, 0x34fbf08e
jae 0x8b243c
mov ecx, 0xac56e641
cmp ch, byte [edx + ebx - 0x3dec9803]
push 0x21864ef1
stosd dword es:[edi], eax
xor al, 0xc4
nop dword [0xbe1e1447]
fmul qword [ebp - 0x23]
loop 0x8b2390
ret
adc bl, byte [ebx - 0x29]
cmp al, byte [0x2700ef33]
xor eax, 0xae2eb917
sub byte [ecx - 0x7094178a], 0x4b
and ebp, eax
imul ecx, dword [esi + 0x1f], 0x858fde2
pop eax
int3
std
pop eax
or byte [eax - 0x34], bl
inc esi
cmp byte [ebx + 0xf], cl
xor byte [edx], ah
and eax, 0x36782611
aas
cmpsd dword [esi], dword es:[edi]
jg 0x8b2420
mov cl, 0xe
cmp al, ch
xor dword [ebp - 0x61], ecx
invalid
Function at 0x623d92
Capabilities:
Encode data using xor

Disassembly:
jmp 0x827884
mov dword [esp + 4], 0xbce757a5
push esi
pushal
push 0x2954c0e6
call fcn.0091239f
lds edi, [ebp + 0x2c50d371]
jae 0x8278ed
std
aaa
lahf
daa
in al, dx
xor al, 0xe7
cmp dword [ecx], edx
sbb byte [ebx], 0xb5
imul esi, dword [ebx - 0x7b], 0x64
fsubr st(4), st(0)
fsub st(2), st(0)
mov eax, 0xcbb8f76a
int 0x73
lcall 0xf78a, 0xf1c60c02
fcmovnbe st(0), st(7)
inc ecx
mov al, 0x30
rcr dh, 1
test dl, ch
pop ebx
xchg esp, eax
lodsb al, byte [esi]
ja 0x8278b1
in al, 0xdc
ljmp 0xcdcb
push 0xfffffffffffffffa
mov ebx, ebp
push dword [esi + 0x6c]
invalid
fadd st(1)
xor al, al
sub eax, 0x973dceef
push eax
invalid

Function at 0x62f061
Capabilities:
Encode data using xor

Disassembly:
pushfd
dec eax
cmc
cmc
add ecx, 0xc
bt di, 0xd
jmp 0x729f9f
stc
cmp edx, eax
call fcn.008eed44
xor eax, 0x7808a4c7
sbb al, 0x73
xor byte [edx], 0xda
mov ah, 0x42
in eax, 0x77
stosd dword es:[edi], eax
fisub dword [ecx*2 + 0x3062eb2f]
loopne 0x729fa7
loopne 0x729fbf
prefetchnta byte [ebx - 0x2075be0c]
movsd dword es:[edi], dword [esi]
xor eax, 0x22703e
mov cl, byte [edx]
push ss
push ebp
iretd

Function at 0x719b20
Capabilities:
Packed with generic packer

Disassembly:
salc
or al, byte [ecx]
add byte [eax - 0x77], ah
je 0x719b19
sbb al, 0xe8
sbb edi, 0x16e90017
xchg dword [edi], edx
add byte [esi + 0x60], dl
pushal
mov dword [esp + 0x20], 0xefff5b8c
pushal
mov byte [esp], 0x4c
push 0x4302f22f
mov byte [esp], bh
lea esp, [esp + 0x44]
and al, 0x44
jmp loc.0041d180
call fcn.008ab978
mov bl, 0x65
jp 0x719b01
jae 0x719b46
jae 0x719b7f
add dh, byte [edx - 0x17]
jnp 0x719b3a
xor bl, bh
inc ebp
salc
jbe 0x719aed
daa
jnp 0x719b2d
dec ecx
dec ecx
stosd dword es:[edi], eax
adc byte [eax], ch
out dx, eax
invalid
and ah, byte [ebx + 0x43]
invalid
dec edi
cdq
add dword [esi + 0x6ae007cd], esp
jmp dword [edi]

Function at 0x729369
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ecx, dword [ebp + 8]
mov byte [esp], bh
pushfd
call int.00731a5b
Function at 0x72de01
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp + 0xc], 0
mov byte [esp], 0x26
lea esp, [esp + 4]
jne 0x838074
call fcn.00926f5a
mov word [esp], sp
lea esp, [esp + 4]
jne 0x76bcca
sbb dx, ax
mov ah, cl
push ebx
xadd eax, edx
bt esp, ebx
setle dl
xadd dh, ah
push esi
setns al
and si, 0xfe02
mov esi, dword [ecx + 0x2c]
rdtsc
sub eax, eax
setbe dh
xchg ah, dl
movzx edx, word [esi]
bsr ax, di
clc
jmp 0x5ece8f
cmp dh, 0x36
cmp eax, 0xbcfd8431
bt bp, 0xd
cmp eax, dword [ecx]
call fcn.00902d82
add eax, ebp
aaa
aas
adc byte [eax], al
fnstenv [ebx]
movsb byte es:[edi], byte [esi]
add al, bh
sub dword [ebx + 0x7c], esi
sub al, 0xf4
salc
pop es
enter 0xffffffffffff9738, 0x41
outsd dx, dword [esi]
jnp 0x7fee45
pop ebp
inc esi
mov ch, 0x57
sar dword [edx], cl
push edx
mov ch, 0x1b
sub dh, al
xchg esi, eax
pop ebp
sar edx, 0xd6
xor dword [edi - 0x63c98f7e], edi
pushfd
or esp, dword [ebp + 0x7d]
mov esp, 0x4871b927
push esi
lahf
inc esp
mov word [edi], cs
add dword [ebp - 0x1dca62cb], esp
sub al, byte [ebp + ecx*4 - 0x69b75191]
mov cl, 0x19
fldenv [ebx]
invalid
aad 0x1b
mov ecx, edx
inc cl
rcr ah, cl
mov ecx, dword [ebp + 8]
aad 0xcf
mov eax, dword [ebp + 0xc]
cmp ax, 0xe2cd
jae 0x7fee37
bt bp, 5
cmp eax, dword [ecx]
push eax
jmp 0x740761

Function at 0x73bcd4
Capabilities:
Encode data using xor

Disassembly:
pop eax
add bl, byte [ebx - 0x15]
xchg ecx, eax
cmp eax, 0x1623171f
test byte [eax], dl
mov cl, 0xc
sub dl, al
inc edi
dec byte [esp + edi*4 + 0x6e784b96]
mov esp, 0x6e784b96
movsd dword es:[edi], dword [esi]
push ebp
call [ebx + eax*4 - 0x5d4ae253]
hlt
movsd dword es:[edi], dword [esi]
cdq
jne 0x73bc8d
inc esi
sub eax, 0x3202a862
pushfd
sub al, 0xdc
xor al, 0xf
xor ebx, esp
out 0xf9, al
xor bl, byte [esp + ebp + 0x330f34dc]
fsubr st(6), st(0)
stc
mov ebp, 0x948b1657
sbb eax, 0x19e00573
push es
jle 0x73bc25
sub esp, eax
push eax
xor cl, bl
mov byte [eax - 0x21a93689], bh
loopne 0x73bc07
xor eax, 0x4bc52b44
pop es
popfd
out dx, eax
jle 0x73bbf4
invalid
add esi, dword [edi - 0x17f29c40]
adc dword [edx - 0x10], ebp
test byte [ebp + 0x1ddc6281], 0x8a
adc esi, dword [ebp + 7]
push edi
mov dh, 0xe7
adc eax, 0x9d25a574
cmpsb byte [esi], byte es:[edi]
mov dh, 0x68
jo 0x73bc1c
push 0x28cc8c70
retf 0x5a9e
int3
lea esp, [esp + 0x10]
jg 0x90176a
push 0x7e9129
call fcn.00613031
jbe 0x73bc70
pushfd
invalid

Function at 0x7474e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x602ba0]
lea esp, [esp + 4]
Function at 0x74f2d4
Capabilities:
Encode data using xor

Disassembly:
pushfd
pushfd
mov dword [esp + 0x28], 0x82893f
call fcn.00722473
pushfd
mov dword [esp], 0xd99d57c8
call fcn.00613a40
sbb eax, 0xcaf7958d
push ds
jae 0x74f369
and ebx, edx
push ebx
lcall 0x2f9e, 0xf0588371
aas
invalid
and bl, byte [esi + eax*2 - 0x6b]
adc ecx, eax
push ebx
add ch, byte [eax - 0xb43b449]
shl dword [0xa205551f], cl
out 0x9c, al
or ebx, dword [0x9e411995]
pop ds
push ebp
add eax, 0xb9ce6a2
sbb eax, 0x9e411995
push ds
mov edx, ebp
mov edx, ebp
xor ebx, 0x7c422a58
and ebx, dword [edi + 0x15]
and ebx, ebx
dec edx
xchg ebx, eax
cdq
fadd dword [ebp - 0x4bc391d3]
shr byte [ebx], cl
jbe 0x74f336
mov ah, 0xd2
sub esi, dword [esi - 0x38]
xor dword [ecx], ebx
push 0x66438aa1
rcl ah, 1
and esi, ebx
arpl dx, si
mov al, byte [0x2c7c68b2]
lodsb al, byte [esi]
sbb dh, byte [eax]
push ebx
inc esp
cmpsb byte [esi], byte es:[edi]
test al, 0x95
sar dword [esi - 0x58], 1
mov ecx, dword [bx + di]
lea ecx, [ebp + 0x14634fec]
jle 0x74f353
dec edi
cld
jbe 0x74f345
cmp esi, ebx
movsb byte es:[edi], byte [esi]
dec edx
test eax, 0x17e74875
clc
mov esi, 0x80992254
imul ebp, edi, 0x5f992c22
daa
fisttp qword [esp + ebx*4 - 0x10]
retf 0x818d

Function at 0x750747
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp + 0x2c], eax
mov byte [esp], 0xfe
lea esp, [esp + 0x2c]
call fcn.005f2751
lea ecx, [esp + 0x4c71a6c4]
shl ch, 7
dec cx
add esp, 8
bswap cx
jmp 0x8a3204
push ebx
lea ecx, [esi + 8]
mov byte [esp], dl
push 0x8fb3a1f
mov dword [esp + 4], ecx
mov byte [esp], ah
and al, 0x68
pop ds
cmp bh, bl
or byte [ecx - 0x77fbdbb4], cl
and al, 0x24
pushal
pushal
mov dword [esp + 0x40], 0x7283bf
pushfd
call fcn.0087056d
push esp
cmp cl, byte [eax]
push 0xa
xor al, 0x73
in al, 0x33
mov dword [0x2944223], eax
add byte [ecx + 0x11d8a63e], ch
mov byte [esi + 0x54], 0x72
call 0x4156dfcd
scasd eax, dword es:[edi]
push ecx
push ss
xor eax, 0xf8a4fd8f
mov esi, 0x4816ac4c
jb 0x8a320a
test dword [edi - 0x6aff6574], ebp
pop ebx
cmp esp, dword [ebx + 0x63]
imul esi, dword [ebx - 0xd], 0xffffff8a
call 0x630f6efc
ljmp 0x24fa

Function at 0x750c1d
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], 0x494157e0
push esi
pushfd
mov dword [esp + 8], 0xe5f5f315
pushal
pushfd
lea esp, [esp + 0x2c]
jmp loc.0041c27f

Function at 0x75f5af
Capabilities:
Encode data using xor

Disassembly:
mov edx, edx
mov edx, dword [ebp + 0xc]
jle 0x805819
push 0x25c52b12
mov dword [esp], eax
call fcn.0088643d
lea esp, [esp + 0x28]
je 0x88931c
push edx
not dx
jmp 0x5e7533
pushal
mov dword [esp + 0x1c], eax
lahf
setnp al
mov eax, dword [ebp + 8]
mov byte [esp + 4], bh
mov dword [esp + 0x18], ecx
mov word [esp], bx
call fcn.00825eac
jmp 0x8951d8
pushfd
push edx
pushfd
xchg dword [esp + 8], edx
pushal
not dl
pushfd
mov edx, dword [ebp + 0xc]
push 0xe5257f65
mov byte [esp + 0x18], cl
push dword [esp + 8]
pushfd
xchg dword [esp + 0x34], eax
call fcn.00771199
call fcn.00720b7b
Function at 0x76c094
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0xd8519476
pushal
push dword [esp + 4]
mov byte [esp], 0x9e
lea esp, [esp + 0x24]
jmp loc.0041c27f
mov eax, dword [esi + 0x2c]
pushal
call fcn.00749e09
mov dword [esp], 0xc26157d0
push 0x3da1076a
jmp 0x71b379

Function at 0x7e6389
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x1c], 0x544157cb
jmp 0x6162c7
mov dword [esp + 0x18], 0x32841be8
mov byte [esp + 4], ah
pushfd
lea esp, [esp + 0x1c]
jmp loc.0041c27f
pushal
jmp 0x614aae

Function at 0x7eb42f
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
je 0x862fb5
bswap dx
xchg dl, cl
movsx dx, bl
mov edx, dword [ebp + 0xc]
lea ecx, [eax + 0xf7d1e45]
jmp 0x7fc1cc
setbe cl
mov ecx, dword [ebp + 0x10]
pushal
mov dword [esp + 0x1c], 0
push dword [esp]
lea esp, [esp + 0x20]
jl 0x87a1aa
push edx
push 0xadca6b56
jmp 0x806ecf
sbb al, 0x6d
mov eax, dword [0x899ad2e7]
ret
call fcn.00771449
jb 0x87a19d
invalid
stc
sub eax, eax
test dh, 0x52
cmc
push 0x2f6fc819
clc
add esp, 8
bt dx, di
cmp bh, dh
pushal
cmp dword [ecx + 4], eax
mov byte [esp], 0x12
pushal
call fcn.0083d480
push ebp
mov dword [esp], 0xfd0357f8
call fcn.0080b4ca
or eax, 0x7a0faded
xor dword [ebx - 0x77], esi
cmp ebx, edx
xor al, 0xe4
sub eax, dword [ebp - 0x36b03fa7]
push ebp
jge 0x87a1c6
mov al, byte [0x83ffe721]
fadd qword [edx + esi*2 - 0x20d89e5d]
xchg ebx, eax
sbb dword [edx], 0x5a08ed92
jnp 0x87a1ac
dec edx
mov dh, 0xd4
insd dword es:[edi], dx
lds ecx, [ebx + edx*8]
push ebp
popal
and dword [edx - 0x11c213d6], ebp
push es
add byte [ecx - 0x623a363f], 0xa8
adc byte [edi], 0x5e
std
cmc
insd dword es:[edi], dx
and al, 0x40
dec eax
inc eax
scasd eax, dword es:[edi]
imul ebp, ecx, 0x5250ed6b
sub byte [esi], dh
test byte [edi + 0x10], cl
mov ecx, 0x9cb2a9bc
insb byte es:[edi], dx
invalid

Function at 0x7efe07
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], 0x726957f4
mov word [esp], si
jmp 0x88e5b7
lea esp, [esp + 4]
jae 0x8be133
pushfd
mov dword [esp], 0xd99971aa
pushal
push edi
lea esp, [esp + 0x24]
jmp loc.0041c27f
je 0x8be12d
mul ebx
hlt
ret 0x6fe9
call fcn.00771c0b
pushal
call fcn.00915864
imul ebp, dword [ebx + 0x4c], 0xffffffb0
mov ecx, 0x792a7335
popal
mov dh, 0x26
jl 0x8be119
into
adc eax, 0xe35cf437
cmpsb byte [esi], byte es:[edi]
test eax, 0xc92bdf10
arpl dx, ax
xor eax, 0x8c1301ae
dec ebx
pop ecx
adc ecx, ebp
ror byte [esi + 0x2937b658], 0xeb
stc
mov cl, 0xcc
or eax, 0x7fde8801
aaa
dec dword [ebx]
push 0x5c
bound ecx, qword [eax + 0x36]
mov cl, 0xb
sti
and ebp, dword [esi - 0x27]
call 0x68568418
inc esp
jmp 0xfb36f2d5

Function at 0x7f91bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x1e4a51da
mov dword [ebp - 4], ebx
bt si, bx
stc
test edx, edx
push ebx
pushfd
pushfd
lea esp, [esp + 0x14]
jle 0x8b2bb6
pushfd
push edx
mov dword [esp + 4], edi
pushfd
mov byte [esp], 6
push esp
lea esp, [esp + 0xc]
jmp 0x8f1f93
Function at 0x800bcc
Capabilities:
Packed with generic packer

Disassembly:
test bl, 0x3d
mov dword [ebp - 8], eax
clc
clc
pushfd
pushal
cmp ebx, dword [eax]
pushfd
lea esp, [esp + 0x34]
jb 0x7649ac
push ebx
xor eax, eax
mov esi, 0xee05311
mov esi, dword [esp + 4]
pushal
mov esp, ebp
movzx ebp, bl
jmp 0x5ee368
jmp 0x62c74a

Function at 0x823d0c
Capabilities:
Encode data using xor

Disassembly:
or byte [edi + 0x2b], 0x6d
call fcn.008a705e
dec eax
push es
cdq
div ebp
push ds
jae 0x751d94
and ebx, esp
adc byte [eax], al
pop es
adc dword [edx], ecx
cmp bh, cl
jae 0x751d12
or al, 0x12
mov byte [eax - 0x30], ah
invalid
das
jmp 0x477be1ef
push 0xb0bb7a99
add esp, 0x34
push esi
mov byte [esp], 0xbd
jmp 0x751d16

Function at 0x82b5e2
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov dword [esp + 0x1c], 0xccb95248
pushfd
pushfd
pushfd
lea esp, [esp + 0x28]
jmp loc.0041e29f
ret
mov dword [esp + 0x4c], edx
pushfd
mov byte [esp], ch
lea esp, [esp + 0x50]
jae 0x85c67e
push eax
call fcn.0075bdb2
mov byte [eax + 0x2c8d5bf7], ch
jae 0x82b5d7
and al, 0xea
imul eax, dword [ebx + 0x290d167f], 0xd9cbd3cb
stc
popal
dec esi
daa
fsub qword [ebp + 2]
fdiv dword [ecx - 0x5f]
inc ecx
xor eax, 0xbead0b8f
sub ecx, ebx
adc bh, byte [ecx]
fcmovne st(0), st(7)
invalid
call fcn.008619ee
jmp 0x6331b9

Function at 0x82c6a6
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x1980f261
push ebx
push 0xd9db3062
pushal
pushfd
lea esp, [esp + 0x2c]
jmp loc.0041c27f

Function at 0x82e29a
Capabilities:
Packed with generic packer

Disassembly:
movzx cx, dl
setnp cl
mov ecx, dword [ebp + 0xc]
jmp 0x8c21df
jmp 0x90570e
pushfd
mov dword [esp + 8], edx
call fcn.00427079

Function at 0x8303a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0xcc6760d3
mov dword [esp + 0x1c], 0x11dd57e6
mov byte [esp + 4], bl
pushfd
push dword [esp]
jmp 0x8f2e06
push edi
pushal
pushfd
pushfd
push dword [esp]
lea esp, [esp + 0x2c]
jmp 0x8f1f93
clc
mov byte [esp], dh
mov dword [ebp - 8], esi
cmc
mov dword [ebp - 4], ebx
pushfd
test edx, edx
lea esp, [esp + 0xc]
jg 0x84f6ca
pushal
push 0x45e4f888
lea esp, [esp + 0x24]
jle 0x8b2bb6
jmp 0x7ed7c1
call 0x8acacb
pushal
mov byte [esp + 4], 0xc6
jmp 0x734845
mov dword [esp + 0x20], 0xcdf16ac4
pushfd
mov byte [esp], 0x5c
lea esp, [esp + 0x24]
jmp int.0041dc41

Function at 0x83a9e7
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov dword [esp + 4], 0xddf14ac8
pushal
mov dword [esp], esp
pushfd
lea esp, [esp + 0x28]
jmp loc.0041c27f

Function at 0x858c98
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [edx + 8]
jmp 0x8f4f61
pushfd
lea esp, [esp + 0x2c]
jb 0x8fefec
rdtsc
dec dword [esi + 0x28]
bswap bx
xchg bx, cx
mov byte [ebp - 1], 1
movzx cx, cl
lahf
pushal
pushal
mov ebx, dword [esp + 0x40]
rdtsc
lahf
mov edx, dword [esi]
movzx eax, bl
jmp 0x7449c1
Function at 0x85f06e
Capabilities:
Encode data using xor

Disassembly:
pushfd
push 0x588ea414
call fcn.00617059
pop es
adc dword [ecx - 0x55], ecx
enter 0x732f, 0x25
aad 0x7f
mov al, 0x48
dec edx
or ebp, dword [ebx - 0x1c9bfbd5]
pop ebp
push es
push esi
fisttp qword [edi]
sub ebp, esp
insb byte es:[edi], dx
test dword [eax - 0x7e], eax
imul ebx, edx, 0x2a
sbb byte [ebp - 0xa703df], bh
sbb eax, 0xe7a0027c
test dword [ebx + 0x72208453], esp
pop ebx
mov cl, 0x20
mov eax, 0x2f4763ea
pop ebx
sub ecx, esp
pop esp
neg bh
mov dh, 0x47
xchg ebx, eax
push fs
fsubr qword [ebx + edi*2]
arpl word [ebp + 0x40], sp
mov ecx, 0x83a89340
push cs
wait
push ds
inc edx
sar esp, cl
xor al, 0xf6
dec edi
push esp
push ss
mov dword [edi + 0x11], ebx
sbb al, 0xcc
pop esp
js 0x85f0b6
push es
enter 0x20b8, 0xffffffffffffffef
jmp 0x64d063c8

Function at 0x87bd85
Capabilities:
Packed with generic packer

Disassembly:
mov dword [edi + 0xc], 0
mov word [esp], 0x75f8
call fcn.0080b4cf
mov dword [esp + 0x20], 0xf9d957a4
jmp 0x7f1723
push edx
mov dword [esp + 0x20], 0x4df39761
mov byte [esp + 4], cl
pushal
pushfd
lea esp, [esp + 0x44]
jmp loc.0041c27f
pushal
jmp 0x88c60b
mov dword [edi + 4], eax
jmp 0x5ed816