joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402030
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.MyTemp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0xf], 0
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0xc]
and ecx, 3
push 0x4045a0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4020c3
mov ecx, dword [esp + 0x114]
push esi
push ecx
call dword [sym.imp.MSVCRT.dll_fputs]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x104
ret

Function at 0x4022c0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
push 0x104
push 0x404e04
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Debugs.inf
or ecx, 0xffffffff
xor eax, eax
push 0x404540
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x404e04
mov esi, edi
mov edx, ecx
mov edi, 0x404e04
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
call esi
add esp, 8
test eax, eax
jne 0x40233a
push 0x4045a0
push 0x404e04
call esi
add esp, 8
test eax, eax
jne 0x402335
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
xor eax, eax
pop esi
ret
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x5efc67e7
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x7c2d3723
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4021a5
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4021d3
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4021ca
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4021c2
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4021f4
mov esp, ebp
pop ebp
ret

Function at 0x4021f8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x402264
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x402291
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x402280
xor ecx, eax
xor edx, ebx
dec edi
jne 0x402271
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x4022b7
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x402258
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4022e3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406e2f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x406e67
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x406e55
mov al, 1
jmp 0x406ec6
cmp dword [ebx + 0x54], ecx
jne 0x406e5e
mov al, 2
jmp 0x406ec6
cmp dword [ebx + 0x7c], ecx
jne 0x406ec6
mov al, 3
jmp 0x406ec6
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x406e7c
mov al, 4
jmp 0x406ec6
cmp ecx, 5
jne 0x406e9c
cmp ebx, 0
jne 0x406e8a
mov al, 5
jmp 0x406ec6
cmp ebx, 1
jne 0x406e93
mov al, 6
jmp 0x406ec6
cmp ebx, 2
jne 0x406e9c
mov al, 7
jmp 0x406ec6
cmp ecx, 6
jne 0x406ec4
cmp ebx, 0
jne 0x406eaa
mov al, 8
jmp 0x406ec6
cmp ebx, 1
jne 0x406eb1
mov al, 9
cmp ebx, 2
jne 0x406eb8
mov al, 0xa
cmp ebx, 3
jne 0x406ebf
mov al, 0xb
cmp ebx, 4
jne 0x406ec6
mov al, 0xc
pop ebx
leave
ret

Function at 0x408d58
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0x408d8f
mov esp, ebp
pop ebp
ret
Function at 0x4422d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4422e8
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jle 0x44233d
push dword [ebp + 8]
call fcn.004424e9
mov dword [ebp - 0x24], eax
cmp word [ebp - 0x24], 0x5a4d
jne 0x44233d
xor eax, eax
jmp 0x442342
mov eax, 1
test eax, eax
je 0x442354
mov eax, 0
jmp 0x4424e3
push 0x3c
push dword [ebp + 8]
call fcn.0044252b
push eax
call fcn.00442505
push eax
push dword [ebp + 8]
call fcn.0044252b
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.00442505
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4550
jne 0x4423af
push 0x7c
push dword [ebp - 4]
call fcn.0044252b
push eax
call fcn.00442505
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4423af
xor eax, eax
jmp 0x4423b4
mov eax, 1
test eax, eax
je 0x4423c6
mov eax, 0
jmp 0x4424e3
push 0x78
push dword [ebp - 4]
call fcn.0044252b
push eax
call fcn.00442505
push eax
push dword [ebp + 8]
call fcn.0044252b
mov dword [ebp - 8], eax
push 0x20
push dword [ebp - 8]
call fcn.0044252b
push eax
call fcn.00442505
push eax
push dword [ebp + 8]
call fcn.0044252b
push eax
call fcn.00442505
push eax
push dword [ebp + 8]
call fcn.0044252b
mov dword [ebp - 0xc], eax
push 0x18
push dword [ebp - 8]
call fcn.0044252b
push eax
call fcn.00442505
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
call fcn.00442552
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x4424d6
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.0044252b
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.00442579
test eax, eax
je 0x4424b9
push 0x1c
push dword [ebp - 8]
call fcn.0044252b
push eax
call fcn.00442505
push eax
push dword [ebp + 8]
call fcn.0044252b
mov dword [ebp - 0x24], eax
push 4
push dword [ebp - 0x10]
call fcn.004425ad
push eax
push dword [ebp - 0x24]
call fcn.0044252b
push eax
call fcn.00442505
push eax
push dword [ebp + 8]
call fcn.0044252b
jmp 0x4424e3
push dword [ebp - 0x14]
call fcn.004425d5
push eax
push dword [ebp - 0x18]
call fcn.0044252b
mov dword [ebp - 0x18], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x442442
add esp, 0xc
mov eax, 0
jmp 0x4424e3
mov esp, ebp
pop ebp
ret 8
Function at 0x4984c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8818d0]
xor edx, edx
cmp eax, edx
jne 0x4984e6
xor eax, eax
mov byte [eax + 0x8817d0], al
inc eax
cmp eax, 0x100
jl 0x4984ce
mov dword [0x8818d0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8817d0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x498577
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x49854a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x498518
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x498580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4985d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4985ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ae270
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x532b58
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x4ae2a9
inc eax
mov dword [esi + 0x10], eax
jmp 0x4ae3bc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x4ae2bd
mov eax, 0xffffffc7
jmp 0x4ae3be
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x4ae2ce
cmp dword [esi + 8], eax
jne 0x4ae2bd
cmp dword [esi + 8], eax
jne 0x4ae2e7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x4ae2e7
mov eax, 0xffffffc7
jmp 0x4ae3be
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x4ae2fb
push eax
mov ecx, ebx
call fcn.004adaa0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00475bd0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4ae32c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00475bf0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.004ad210
test eax, eax
mov dword [esp + 0x38], eax
je 0x4ae35f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x838c80
call fcn.00475dd0
mov eax, dword [esp + 0x38]
jmp 0x4ae3be
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.004ae0d0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x4ae3a3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004ae0f0
mov esi, eax
test esi, esi
jne 0x4ae3d3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.004ae0d0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x4ae375
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x838c80
call fcn.00475dd0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x838c80
call fcn.00475dd0
mov eax, esi
jmp 0x4ae3be
Function at 0x4de540
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83c7f0
push 0x516154
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00513c70
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fedd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4fee23
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4fee0a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5057e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53455e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00506100
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x83f0fc
call fcn.005241a1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x505873
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005241a1
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x50586c
push 0
mov ecx, eax
call fcn.004fc8e0
mov dword [esi + 0xc], eax
jmp 0x505875
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x505875
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x8cb329
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x14], si
call fcn.00978011
pushal
call fcn.00903b05

Function at 0x8cb339
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], edx
call fcn.0090889b

Function at 0x8cb342
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
nop
push 0x459035a
jmp 0x8e908a
mov dword [esp + 0x28], eax
movzx ax, al
setnp al
mov eax, 0x4edff4
pushfd
push dword [esp]
pushfd
mov eax, dword [eax + 0x49afa8]
call fcn.008e4033

Function at 0x8e2888
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x18]
jl 0x9328df
movzx esi, dl
pop edi
lea eax, [ebx - 0x4f18b3bf]
pushfd
lea ebx, [esi + 0x7b00c54e]
not cl
mov esi, dword [esp + 4]
xchg dx, ax
mov ebx, dword [esp + 8]
pop edx
rdtsc
pushfd
mov edx, dword [ebp + 0x14]
lahf
xchg ch, ah
cwde
movzx cx, dl
mov eax, dword [ebp + 0x10]
lea ecx, [edi*2 + 0x99df4c8]
call fcn.0098d410
Function at 0x8eccf1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
call fcn.00949ea1
ret
pushfd
bt sp, si
test eax, eax
pushal
lea esp, [esp + 0x28]
je 0x99be58
push ecx
push dword [esp]
lea esp, [esp + 8]
jg 0x958040
push ebx
pushal
mov byte [esp], dh
pushal
lea esp, [esp + 0x40]
call fcn.008cdd69
pushal
push edi
mov dword [esp + 0x20], esi
stc
lea ebx, [ebx]
cmc
cmc
push ebx
cmp dword [ebp - 0x28], 0x10
pushal
mov byte [esp + 0x1c], bh
jmp 0x9986bb
push ebx
call fcn.00926fb4
call fcn.008f2bf7
push esi
pop eax
lea eax, [ebp - 0x28]
jmp 0x8d27a6
jmp 0x8ede0d
pushal
jmp 0x982db8
mov dword [esp + 0x1c], 0
push dword [esp + 0xc]
push dword [esp]
mov word [esp], 0xa88a
pushfd
mov dword [esp + 0x24], 2
call fcn.009351b4
jmp 0x99da9e
lea esp, [esp + 0x44]
jb 0x93a67e
rol ch, cl
mov ch, ch
movsx cx, bl
mov ecx, dword [ebp - 4]
clc
test bh, cl
clc
cmp dword [ebp - 0x1c], ecx
ja 0x915426
pushfd
lea esp, [esp + 4]
jne 0x93a67e
sub ah, 0xe1
sets al
mov eax, dword [ebp - 0x20]
push 0x15a70128
pushfd
cmp eax, dword [ebp - 8]
push 0x3e3de6f7
pushfd
pushal
mov word [esp], 0xac31
lea esp, [esp + 0x30]
je 0x93a67e
pushfd
mov dword [esp], eax
jmp 0x9827ae

Function at 0x8f0c13
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x28], esi
pop esi
bswap si
push dword [esp + 0x10]
mov esi, dword [esp + 0x2c]
call fcn.008e3377

Function at 0x8f0c28
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
sub esi, 0x13a5b738
push 0x93e936ab
pushfd
bt eax, 0x1a
cmc
xor esi, dword [eax + 0x11]
bt edi, ecx
cmp dword [ebp + 0x10], 3
mov byte [esp + 4], 0x7e
pushfd
xchg dword [esp + 0x44], edi
push dword [esp]
bswap edi
pushfd
jmp 0x956c36
inc eax
cmc
stc
test dl, bl
cmp cl, 0xd6
cmp byte [eax], cl
pushfd
jmp 0x9a1997
lea esp, [esp + 0x3c]
jne 0x999729
call fcn.00999711
pushal
jmp 0x969740
mov edi, dword [ebp + 0xc]
jmp fcn.0099be60
pushal
jmp 0x8ec20a
bt bx, 8
push ebx
movsx bx, dl
shl ebx, 0xe
rcr bh, 5
mov ebx, dword [ebp + 8]
clc
pushal
xchg dword [esp + 0x1c], esi
not si
bt ax, 5
mov esi, dword [eax + 1]
pushal
cmc
jmp 0x8e90aa
push 0x505ecd33
pushal
push esp
shr ecx, 8
clc
cmc
cmp byte [eax], cl
call fcn.0099c342
pushal
btr ecx, eax
rol eax, 0x11
stc
bsf cx, bx
pushal
neg cl
not eax
rcr cx, 7
shl cx, 0xe
mov ecx, eax
sub esp, 0xffffffc0
jnp 0x9908fc
pushfd
shr ecx, 8
bt edi, edi
push 0x50df56b1
cmp byte [eax], cl
push 0x16884794
lea esp, [esp + 0xc]
je 0x98524c
push 0xdeb26aa
lea esp, [esp + 4]
jmp 0x92d68e
call 0x98523f
Function at 0x8f686c
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 4], ebp
lea ebp, [edi*4 + 0x4955c427]
call fcn.00994c6f
je 0x8f68aa
lahf
out dx, eax
mov edx, 0x4a78d89d
and esi, dword [eax]
adc cl, byte [ebp + 0x26]
pop ds
push edi
push 0x715be6d9
stc
stc
daa
xor dword [ecx + 0x3fbaa638], esi
invalid
mov fs, word [ebx - 0xa]
pop edx
push es
loopne 0x8f6918
pop ebp
pop ss
adc eax, 0xa64802ea
mov esi, 0x7dcd59aa
jno 0x8f6919
or ch, byte [edi - 0x28e52937]
out 0x9f, eax
pop ebx
pop es
in al, 0xbe
and byte [esp + edi*2 - 0x2a], 0x10
sub byte [ebx + ecx*2], dl
pop ebp
mov ah, byte [0xdc0e5119]
cmp dword [ecx + 0x3d], ebx
sub eax, 0xf005e868
lahf
and byte [edx - 0x5e], al
sub eax, 0xd40ccac9
cld
aam 0xfc
cmc
xchg byte [edx - 0x7ec16e03], dl
popal
dec esp
arpl word [edi - 0x30f5dabd], bx
std
xchg ecx, eax
and dword ds:[ecx + 0x4c], 0x25439f63
or cl, bh
xor byte [edx], 0xd4
jo 0x8f68ef
push esi
mov ah, 0x67
sal dword [eax + 0x58], 1
xchg edi, eax
ljmp 0xb8cc
and edi, dword [esi - 0x6d3b5274]
mov esi, 0x92c4ad8c
push ss
insd dword es:[edi], dx
jb 0x8f68ea
add al, 0x16
rcl byte [esi + ebp*4 + 0x3557fcba]
invalid

Function at 0x91dd85
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
call fcn.00981624
stc
test eax, eax
pushal
mov byte [esp + 8], bh
pushfd
jmp 0x93eec0
lea esp, [esp + 0x24]
je 0x99be58
pushal
mov dword [esp + 0x1c], ebx
call fcn.008e93f4

Function at 0x92c8c6
Capabilities:
Encode data using xor

Disassembly:
imul dword [eax]
add byte [ebx + ecx*4 + 0x46346db6], bl
add al, ch
loopne 0x911401
add al, 0
mov dword [esp + 0x38], ebx
push ebx
sete bh
setp bl
movsx ebx, al
mov ebx, 0x4c2c35
call fcn.008ea6a3
loope 0x911430
sar byte [ecx + 0x4a], 1
and dh, byte [esi - 0x615cd632]
test eax, 0xe46409dc
mov esi, 0x7651dc9f
xlatb
in eax, 0x61
div dword [eax + 0x4d]
pop ds
push edi
aad 0xa4
test al, 0xe
dec eax
and byte [edx], ah
cmp eax, 0x31afe418
xor al, 0x7c
jbe 0x9114c4
xor byte [edi + ecx*2 + 0x588d3a23], 0x3a
leave
loope 0x911549
inc dword [esi + ebx*4 - 0x77]
and byte [ecx], dh
cmp esp, ecx
jge 0x911519
pop esi
mov eax, dword [0x379912d7]
jbe 0x9114c4
mov al, byte [0xbac68734]
and edx, ebx
salc
pushal
pop ss
popal
leave
sbb al, 0x95
test al, 0xd9
aas
cdq
jne 0x91154e
wait
sahf
cmp al, 0x2c
scasb al, byte es:[edi]
xor byte [esi - 0x38], al
cmp eax, eax
push ds
iretd
imul ebx, dword [eax + 0x5a], 0xffffff84
pop eax
fisttp word [ebp + 0x43]
fadd st(1), st(0)
frstor dword [esi - 0x60b2a471]
scasd eax, dword es:[edi]
cmp eax, 0x971ec3b5
add dword [ebx - 0x5fd158b1], eax
cmp al, 0x5a
imul ebp, ebp, 0x52
pop es
pop es
xchg esp, eax
loop 0x91153b
push ebp
pop ecx
dec ecx
xchg ecx, eax
xchg edx, eax
aam 0x7e
and byte [eax - 0x5d1ddc55], dh
xchg edx, eax
adc ecx, eax
sub eax, 0x1f8f92ad
jle 0x9115c5
and esp, edx
mov byte [0x2dc11192], al
lodsd eax, dword [esi]
xchg edx, eax
invalid
shr dword [0x1f8f92ad], 0x7e
outsd dx, dword [esi]
insd dword es:[edi], dx
hlt
retf
mov dword [esp + 0x2c], ebx
setns bh
mov ebx, dword [esp + 0x30]
mov byte [esp + 0xc], 0x70
jmp 0x98e71f
push 0x6058f89f
push ebp
lea ebx, [ebx + 1]
mov byte [esp + 4], dl
jmp 0x911490