joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x520628]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
call fcn.007d7119

Function at 0x41af7d
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0x8dd8e3f8
call fcn.008591b7
call fcn.0046e7f3
mov ecx, dword [esp + 0x14]
adc dh, 0
mov edx, dword [ecx + 0x84]
stc
test sp, bx
lea esp, [esp + 4]
test edi, ebx
mov dword [edx + 0xbd4], eax
stc
mov byte [esp + 0x1bf0], 6
stc
clc
cmp dword [esp + 0x7b4], esi
jmp fcn.0079599a
Function at 0x42b050
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push esi
mov dword [edi], 0
call fcn.0042afe0
mov ebx, eax
test ebx, ebx
jne 0x42b083
mov dword [edi], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x20]
mov edx, dword [esi + 0x78]
push 0
push ecx
push edx
call fcn.00470fbd
mov eax, dword [esi + 0x78]
mov ecx, dword [ebx + 0x28]
mov edx, dword [0x52a944]
push eax
push 1
push ecx
push edx
call fcn.004714ed
mov ecx, dword [0x52ab50]
push 0
lea eax, [esp + 0x2c]
push eax
mov eax, dword [0x52a944]
mov dword [esp + 0x30], 0
mov edx, dword [ebx + 0x28]
push ecx
push edx
push eax
call fcn.004e2be0
add esp, 0x30
test eax, eax
jne 0x42b1da
mov ecx, dword [esp + 0xc]
cmp ecx, dword [ebx + 0x24]
jne 0x42b1da
mov eax, dword [0x52ab50]
movzx esi, word [eax]
movzx edi, word [eax + 2]
xor eax, eax
push 0x2c
push eax
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call fcn.00473d40
add esp, 0xc
push 0
push 0
lea edx, [esp + 0x18]
push edx
mov eax, 0x18
mov word [esp + 0x2e], ax
push 0
mov ecx, 1
lea eax, [esp + 0x4c]
mov word [esp + 0x30], cx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
push eax
mov ecx, 0xa
lea esi, [esp + 0x28]
lea edi, [esp + 0x50]
mov dword [esp + 0x28], 0x28
mov dword [esp + 0x38], 0
push 0
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0
call fcn.007caaef
mov dword [edi], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x450670
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x45075b
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4506a7
cmp dword [esi + 0x40], edi
jae 0x4506a7
push eax
call fcn.004509e1
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x4506bf
lea eax, [edi + edi]
push eax
call fcn.004509ec
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.004760f0
add esp, 0xc
xor ebx, ebx
test edi, edi
jbe 0x450758
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x50f840]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x50f840]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x4506d7
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x45079a
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x45077f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.004760f0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4507bc
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
push eax
call 0x733027
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x537c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x537d8c
test eax, eax
je 0x537d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x552ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x537d73
lea edi, [eax + 4]
jmp 0x537cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x537cec
mov dword [ebp - 4], 2
jmp 0x537d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x537d03
mov dword [ebp - 4], 1
jmp 0x537d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x537d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x537d46
mov byte [ecx], 0x3d
jmp 0x537d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x537d5d
mov byte [ecx], 0x3d
jmp 0x537d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x537cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x599635
Capabilities:
Execute anti-debugging instructions
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cbw
push 0xffffffffffffffff
setae ah
cmova eax, edx
push 0x4e5b32
cwde
jmp 0x7b565d
push ebx
cmp ecx, edx
test bx, 0x4b92
push esi
stc
push edi
cmp al, 0x60
stc
push eax
add ah, 0x81
cmp bp, 0x7954
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
not eax
mov eax, dword [0x52bfc0]
test edi, 0x64762bb0
clc
sub ebx, ebx
push ebx
jmp 0x81142d
mov eax, dword fs:[0]
push eax
cwde
mov eax, 0x1054
jmp 0x845508
push eax
call fcn.007357bb
test eax, eax
jmp loc.00419ebb
call fcn.00474d50
mov eax, dword [0x520628]
test bl, 0xb3
xor eax, ebp
test edx, eax
cmp ebx, 0x4257661f
mov dword [ebp - 0x10], eax
jmp 0x6b232e

Function at 0x5a6172
Capabilities:
Authenticate hmac
Check for software breakpoints
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x7518b36
call fcn.00804e18
Function at 0x64d000
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x89d49f
mov eax, dword [eax + 0x7c]
cmp eax, eax
push ebx
test di, 0x3613
cmp eax, eax
push edi
or edi, 0xffffffff
jmp 0x426425
lea esp, [esp - 0x120]
shr eax, cl
rol ch, 0x98
seto ch
mov eax, dword [0x520628]
or ecx, edi
xor eax, ebp
shld cx, bx, 0xae
shl ecx, cl
xadd cx, cx
mov dword [ebp - 4], eax
stc
sbb cx, 0x270b
mov ecx, dword [ebp + 8]
cmc
push esi
sbb esi, 0x37e3a34
bsf si, sp
mov esi, dword [ebp + 0xc]
cmp dh, 0x97
stc
mov dword [ebp - 0x120], esi
test ecx, ecx
jmp 0x750bbb
je 0x89d49f
mov eax, 0x5a4d
jmp 0x89d496
je 0x89d49f
test esi, esi
jmp 0x65251e
push ebp
mov ebp, esp
jmp 0x64d000
mov eax, dword [ecx + 0x3c]
test esp, esi
cmc
clc
lea eax, [eax + ecx]
cmp dword [eax], 0x4550
jmp 0x83cf6e
call fcn.0046e186
mov esp, ebp
pop ebp
jmp 0x89b5c6
jne 0x89d49f
mov edx, dword [eax + 0x78]
mov dword [ebp - 0x114], edx
test edx, edx
jmp 0x6419d9
ret
cmp word [ecx], ax
je 0x8060d7
xor eax, eax
stc
pop esi
not ch
bswap cx
mov ecx, dword [ebp - 4]
test esp, esp
test dh, 0x19
xor ecx, ebp
jmp 0x80e8fc
Function at 0x71f78b
Capabilities:
Parse pe header

Disassembly:
ret
mov byte [ebp - 0xd8], 0x74
mov byte [ebp - 0xd7], 0x69
jmp 0x741593
mov byte [ebp - 0x24], bl
jmp 0x655ad2
mov byte [ebp - 0x1f], 0x64
jmp 0x7d04d3
push edx
jmp 0x7d15a6
mov byte [ebp - 0x15], 0x6c
jmp 0x870c9a
push eax
mov byte [ebp - 0x18], 0x6e
jmp 0x8d8503
mov byte [ebp - 0x1c], 0
jmp 0x7bfa36
mov byte [ebp - 0x23], 0x6c
jmp 0x79a6f0
test eax, eax
jmp 0x78d9aa
mov esi, eax
jmp 0x6a0f90
mov byte [ebp - 0xde], 0x77
mov byte [ebp - 0xdd], 0x4f
jmp 0x6f7d0b
mov byte [ebp - 0x28], 0x6b
jmp 0x85aa8b
mov byte [ebp - 0xe7], 0x74
mov byte [ebp - 0xe6], 0x55
mov byte [ebp - 0xe5], 0x6e
mov byte [ebp - 0xe4], 0x6d
jmp 0x6b7e24
mov byte [ebp - 0xe3], 0x61
mov byte [ebp - 0xe2], 0x70
jmp 0x892566
mov byte [ebp - 0xd4], 0
call edi
mov dword [0x52be34], eax
cmp dh, 0x65
cmp si, sp
test eax, eax
jmp 0x6f474e
je 0x842357
lea eax, [ebp - 0x16c]
push eax
jmp 0x42ccc1
mov byte [ebp - 0xdc], 0x66
jmp 0x7348c8
mov byte [ebp - 0x21], 0x32
jmp 0x725fa9
mov byte [ebp - 0xd9], 0x63
jmp 0x576ba3
mov byte [ebp - 0xe0], 0x69
jmp 0x72c8ee
call edi
lea ecx, [ebp - 0x28]
mov bl, 0x65
push ecx
jmp 0x6685f0
push ebp
mov ebp, esp
sub esp, 0x16c
mov ah, 0xc4
mov eax, dword [0x520628]
cmp dl, ah
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
jmp 0x83580a
mov byte [ebp - 0x1d], 0x6c
jmp 0x63156e
mov byte [ebp - 0x20], 0x2e
jmp 0x59bed9
mov byte [ebp - 0xdf], bl
jmp 0x675e88
mov byte [ebp - 0xdb], 0x53
jmp 0x7d03b3
mov byte [ebp - 0x10], 0x6c
jmp 0x80f29c
mov byte [ebp - 0xd6], 0x6f
jmp 0x7b2c10
mov byte [ebp - 0x13], 0x2e
jmp 0x80a33e
je 0x842357
call 0x7a9b2a
lea edx, [ebp - 0xe8]
jmp 0x5ae189
mov byte [ebp - 0x22], 0x33
jmp 0x701d74
mov byte [ebp - 0xd5], 0x6e
jmp 0x6c8788
call edi
test esi, esi
jmp 0x842351
mov byte [ebp - 0xda], bl
jmp 0x7035e1
mov byte [ebp - 0x1e], 0x6c
jmp 0x725886
push esi
mov byte [ebp - 0xe8], 0x4e
jmp 0x6a1402
mov byte [ebp - 0x12], 0x64
jmp 0x880db8
mov byte [ebp - 0xf], 0
jmp 0x716dfc
push edi
call 0x8c3185
lea eax, [ebp - 0x18]
jmp 0x610890
push esi
jmp 0x833494
jne 0x658c4d
pop edi
rcr bl, 0x2e
pop esi
cmovns bx, ax
sub eax, eax
setnp ch
pop ebx
bt cx, bx
bts ecx, edx
movsx cx, al
mov ecx, dword [ebp - 4]
stc
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
cmovno ebp, ebx
pop ebp
jmp 0x54c55a
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x6e
jmp 0x582807
mov byte [ebp - 0x14], 0x6c
jmp 0x75ed3c
mov byte [ebp - 0x11], 0x6c
jmp 0x73d812
mov byte [ebp - 0xe1], 0x56
jmp 0x713d4e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x64
jmp 0x5c1d98
Function at 0x74169c
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
test eax, eax
jmp 0x6fde7f
push eax
jmp 0x6e803a
push eax
jmp 0x614ca8
call fcn.005e818e
add esp, 0x1c
jmp 0x42d68c
call fcn.0046ea50
lea esp, [esp + 8]
cmp si, si
jmp 0x57e1d4
call fcn.004718bb
add esp, 0xc
movzx dx, al
xchg cx, dx
lea ecx, [esp + 0x4bc]
cdq
xchg dx, dx
push ecx
bswap dx
lea edx, [esp + 0xc10]
push edx
jmp 0x791f28
push ecx
jmp 0x685510
je 0x795262
mov edx, dword [esp + 0x14]
mov ecx, esp
setle cl
movzx ax, bh
push edx
mov dx, ax
cdq
lea eax, [esp + 0x6d8]
movsx cx, bl
cmovge ecx, esi
push eax
cbw
lea ecx, [esp + 0xb14]
cwde
movzx eax, bp
push ecx
movzx edx, bx
lea edx, [esp + 0x950]
lahf
cbw
jmp 0x8113f6
push 0x8dd8e3f8
call fcn.008591b7
push esi
call dword [0x4e743c]
cmp edi, ebx
je 0x795262
lea edx, [esp + 0x6d4]
not al
push edx
jmp 0x775257
lea eax, [esp + 0xc10]
jmp 0x7866af
push 0x104
jmp 0x5ac9dd
call fcn.0046ea50
add esp, 8
cmp bp, 0x44cc
test eax, eax
jne 0x6fde85
lea eax, [esp + 0x4ec]
mov ecx, esi
bswap cx
push eax
lea ecx, [esp + 0xc10]
jmp 0x6e9ace
push edx
mov ax, bp
nop
push 0x33
lea eax, [esp + 0x2e0]
push 0x4d
jmp 0x5b67a0

Function at 0x77fef4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f], 0x20
jmp 0x7fb275
mov byte [ebp - 0x39], 0x77
mov byte [ebp - 0x38], al
jmp 0x89fc7f
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x41], 0x66
mov byte [ebp - 0x40], dl
jmp 0x59d267
mov byte [ebp - 0x23], 0x20
jmp 0x80ee75
mov byte [ebp - 0x3b], 0x64
jmp 0x82c567
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], al
jmp 0x64b9b7
push 0x8dd8e3f8
call fcn.008591b7
mov byte [ebp - 0x25], 0x77
jmp 0x7ecb2e
mov byte [ebp - 0x3c], 0x6e
jmp 0x758dea
mov byte [ebp - 0x45], 0x72
jmp 0x76766a
mov byte [ebp - 0x3d], cl
jmp 0x78a658
mov byte [ebp - 0x46], 0x63
jmp 0x7a9290
mov byte [ebp - 0x47], cl
jmp 0x7e03c9
mov byte [ebp - 0x24], al
jmp 0x74526f
mov byte [ebp - 0x3e], 0x57
jmp 0x7c429e
mov byte [ebp - 0x22], 0x38
jmp 0x87a507
mov byte [ebp - 0x3a], bl
jmp 0x645530
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x48], 0x4d
jmp 0x7e71ec
mov byte [ebp - 0x37], 0x20
mov byte [ebp - 0x36], 0x37
jmp loc.0041ec8e

Function at 0x7b423a
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
ror ah, 0x33
adc ax, di
push 0xfffffffffffffffe
sub ax, 0x21d9
push 0x8a882c
bsr ax, sp
push 0x4740a0
mov eax, dword fs:[0]
cmp bp, 0x174f
cmc
push eax
bts eax, ecx
cmc
add ax, 0xffc
sub esp, 8
movzx eax, di
setae ah
mov eax, 0x1e50
jmp 0x7b423a
call fcn.00474d50
mov eax, dword [0x520628]
test ecx, 0x2d343fd8
xor dword [ebp - 8], eax
clc
cmp si, cx
test bp, ax
xor eax, ebp
mov dword [ebp - 0x1c], eax
jmp loc.00434a97
Function at 0x7e46a1
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x89d49f
mov eax, dword [eax + 0x7c]
cmp eax, eax
push ebx
test di, 0x3613
cmp eax, eax
push edi
or edi, 0xffffffff
jmp 0x426425
lea esp, [esp - 0x120]
shr eax, cl
rol ch, 0x98
seto ch
mov eax, dword [0x520628]
or ecx, edi
xor eax, ebp
shld cx, bx, 0xae
shl ecx, cl
xadd cx, cx
mov dword [ebp - 4], eax
stc
sbb cx, 0x270b
mov ecx, dword [ebp + 8]
cmc
push esi
sbb esi, 0x37e3a34
bsf si, sp
mov esi, dword [ebp + 0xc]
cmp dh, 0x97
stc
mov dword [ebp - 0x120], esi
test ecx, ecx
jmp 0x750bbb
je 0x89d49f
mov eax, 0x5a4d
jmp 0x89d496
je 0x89d49f
test esi, esi
jmp 0x65251e
push ebp
mov ebp, esp
jmp 0x64d000
mov eax, dword [ecx + 0x3c]
test esp, esi
cmc
clc
lea eax, [eax + ecx]
cmp dword [eax], 0x4550
jmp 0x83cf6e
call fcn.0046e186
mov esp, ebp
pop ebp
jmp 0x89b5c6
jne 0x89d49f
mov edx, dword [eax + 0x78]
mov dword [ebp - 0x114], edx
test edx, edx
jmp 0x6419d9
ret
cmp word [ecx], ax
je 0x8060d7
xor eax, eax
stc
pop esi
not ch
bswap cx
mov ecx, dword [ebp - 4]
test esp, esp
test dh, 0x19
xor ecx, ebp
jmp 0x80e8fc
Function at 0x7e7e7a
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x1440], 5
jmp 0x80a644
push 0x1f
movsx ecx, di
xchg cx, cx
lea ecx, [esp + 0x2e0]
jmp 0x74f917
push ecx
jmp 0x79adcc
lea eax, [esp + 0x90]
push eax
call fcn.004415b0
mov dword [eax], 1
mov ch, bl
lea ecx, [esp + 0x84]
jmp 0x6344f1
push 0x4d
jmp 0x6e8a48
push edx
lahf
cbw
jmp 0x736dae
call fcn.005e818e
add esp, 0x1c
lea edx, [esp + 0x14]
cbw
jmp 0x770e4a
call fcn.00441190
mov ecx, dword [edi + 4]
bswap dx
movsx dx, dh
lea edx, [esp + 0x14]
jmp 0x413121
call fcn.0046ea50
add esp, 8
cmp bp, si
cmc
test eax, eax
jmp 0x840769
add ebp, edx
push ebp
ret
stc
jmp 0x7bbb75
push 0x9af4c503
call fcn.008a4b51
fsub qword [ebx - 0x60]
and byte [edi], dl
dec edx
fnstcw word [edx]
sbb dword [ecx + 0x63], 0x19
cwde
or bl, byte [esi + 0x7315063b]
xor edx, ebp
cmpsb byte [esi], byte es:[edi]
cmp eax, dword [esi]
adc eax, 0xa6ea3173
xor dword [edx + ecx], esp
cmp ebp, dword [ecx - 0x12daa064]
cld
dec edx
cmpsd dword [esi], dword es:[edi]
add dword [ebp - 0x589bac6c], eax
cmpsd dword fs:[esi], dword es:[edi]
jns 0x7e7ec7
jmp 0x7e7e93
fld dword [eax + 0x7c296156]
dec esp
inc eax
jecxz 0x7e7f39
xchg edi, eax
inc edx
sub dword [edx - 0x5e], ebp
cmp edi, dword [edx - 0x382b695e]
mov edx, 0x48b48ed6
dec ecx
sub dword [edi + 0x5b], edi
jb 0x7e7e68
mov edi, 0x921e4b91
salc
nop
lahf
mov ch, byte [ebx + 0x40]
not byte [edi - 0x4b]
push 0x29
das
jns 0x7e7f30
mov ss, word [esi + 0x1b]
inc ecx
pop esp
je 0x7e7eaa
pop es
push ds
in al, dx
ror dword [esi - 0x75], 0x89
pop edi
lodsb al, byte [esi]
cmp eax, dword [eax]
or ecx, dword [edi]
xchg ebx, eax
invalid
add byte [eax], al
movsx edx, bp
movzx edx, bx
cwd
push eax
push ecx
lea edx, [esp + 0xb14]
mov eax, ebp
movsx eax, ax
push edx
movsx cx, dl
lea eax, [esp + 0x6e0]
cmovg ecx, ecx
push eax
jmp 0x6cb3c7
push edx
jmp 0x7a80a2
call fcn.00406900
lea ecx, [esp + 0x42c]
bswap edx
push ecx
cwd
cdq
lea edx, [esp + 0xc10]
jmp 0x7fd1cd
lea esi, [esp + 0x28c]
call fcn.004411c0
lea esi, [esp + 0x25c]
cmovb di, cx
movsx edi, bx
mov edi, eax
jmp 0x7a1f00
je 0x839866
mov eax, dword [esp + 0x14]
mov cx, di
push eax
lea ecx, [esp + 0x6d8]
cwd
cwde
push ecx
cwde
lea edx, [esp + 0xb14]
push edx
lea eax, [esp + 0x950]
not ecx
push eax
xchg ecx, ecx
push 0x12
lea ecx, [esp + 0x2e0]
jmp 0x42910c
Function at 0x806824
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x874], esi
jmp 0x795b5f
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
jmp 0x856cee
push ecx
jmp 0x796b76
mov byte [ebp - 0x1f], 0x6c
jmp 0x7a1bfb
mov byte [ebp - 0x20], 0x65
jmp 0x6d1fd6
push eax
setno al
lea esp, [esp - 0x8e0]
add eax, edx
cmc
mov eax, dword [0x520628]
stc
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
and bl, 1
adc bx, dx
shr bh, cl
push edi
or bx, 0x355d
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
clc
mov dword [ebp - 0x888], eax
adc eax, eax
shrd ax, bp, 0x5f
lea eax, [ebp - 0x38]
bts ebx, eax
mov dword [ebp - 0x898], ecx
push eax
lea ecx, [ebp - 0x24]
shl bx, cl
cmp bp, 0x6997
mov ebx, 0x25776b58
sub esi, esi
cmovg bx, si
mov ebx, 0x69
jmp 0x677318
mov byte [ebp - 0x24], 0x6b
jmp 0x649ec1
mov dword [ebp - 0x890], edx
jmp 0x64120e
mov byte [ebp - 0x1e], 0x33
jmp loc.0041cd8e
push ebp
mov ebp, esp
sar eax, 0x49
bsr ax, si
shrd eax, ebx, 0xc1
push 0xffffffffffffffff
btc ax, cx
btc eax, 0x45
push 0x4e4288
mov eax, dword fs:[0]
jmp 0x75d0c1
mov byte [ebp - 0x21], 0x6e
jmp 0x72eb67
Function at 0x845508
Capabilities:
Execute anti-debugging instructions
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cbw
push 0xffffffffffffffff
setae ah
cmova eax, edx
push 0x4e5b32
cwde
jmp 0x7b565d
push ebx
cmp ecx, edx
test bx, 0x4b92
push esi
stc
push edi
cmp al, 0x60
stc
push eax
add ah, 0x81
cmp bp, 0x7954
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
not eax
mov eax, dword [0x52bfc0]
test edi, 0x64762bb0
clc
sub ebx, ebx
push ebx
jmp 0x81142d
mov eax, dword fs:[0]
push eax
cwde
mov eax, 0x1054
jmp 0x845508
push eax
call fcn.007357bb
test eax, eax
jmp loc.00419ebb
call fcn.00474d50
mov eax, dword [0x520628]
test bl, 0xb3
xor eax, ebp
test edx, eax
cmp ebx, 0x4257661f
mov dword [ebp - 0x10], eax
jmp 0x6b232e
Function at 0x852e71
Capabilities:
Reference processor manufacturer constants

Disassembly:
pop edi
and si, di
bts ebx, ecx
pop esi
cmp di, 0x6bcc
pop ebx
shr ch, 0xf7
movsx ecx, di
mov ecx, dword [ebp - 4]
clc
xor ecx, ebp
jmp 0x88d348
push esi
jmp 0x8ca16d
jne 0x73ea62
cmp dword [ebp - 0x28], 0x666f736f
jmp 0x69e203
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0
call fcn.0080dfd0
lea edx, [ebp - 0x20]
mov esi, edi
mov esi, eax
push edx
jmp 0x56cad1
mov byte [ebp - 0x28], 0x2e
jmp 0x7afbb5
jne 0x73ea62
cmp dword [ebp - 0x24], 0x76482074
jmp 0x844b64
push ecx
jmp 0x834526
mov byte [ebp - 0x2e], 0x72
jmp 0x8025b5
mov al, 1
jmp 0x539a14
mov byte [ebp - 0x27], 0x64
jmp 0x86edda
je 0x7dcb5c
xor eax, eax
mov dword [ebp - 0x2c], eax
dec ecx
mov dword [ebp - 0x28], eax
bsr cx, bx
add bx, 0x1bef
rol dl, cl
mov dword [ebp - 0x24], eax
cdq
mov eax, 0x40000000
cpuid
mov dword [esi], eax
cmp ah, 0x91
mov dword [esi + 4], ebx
stc
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp bx, ax
cmp dword [ebp - 0x2c], 0x7263694d
jmp 0x600b94
lea ecx, [ebp - 0x30]
mov ebx, 0x65
jmp 0x6db2bf
mov byte [ebp - 0x2f], bl
jmp 0x717850
mov byte [ebp - 0x2a], 0x33
jmp 0x82752d
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], bl
jmp 0x840402
mov byte [ebp - 0x29], 0x32
jmp 0x69be0b
mov byte [ebp - 0x30], 0x6b
jmp 0x7dd797
mov byte [ebp - 0x2b], 0x6c
jmp 0x7e2130
jne 0x73ea62
mov eax, 0x40000003
cpuid
test esp, 0x742d5466
mov dword [ebp - 0x2c], 0
mov dword [esi], eax
cmp sp, 0x73f9
clc
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
jmp 0x851578
mov dword [esi + 0xc], edx
test esi, ebp
test byte [ebp - 0x2c], 1
je 0x73ea62
xor al, al
mov di, cx
pop edi
pop esi
or bx, bp
movzx ebx, di
pop ebx
sub cx, 0x345d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
mov bp, sp
pop ebp
jmp loc.0040d441
push ebp
adc cl, 0x75
bts ecx, esi
mov ebp, esp
ror cx, cl
sub esp, 0x94
shrd ax, bp, 6
rol edx, 0x79
bsf cx, bx
mov eax, dword [0x520628]
xor eax, ebp
sub dl, 0x21
dec dl
mov dword [ebp - 4], eax
xadd dh, dl
inc eax
add cl, dh
push ebx
rcr eax, 0xad
mov eax, 1
cpuid
push esi
adc si, bp
lea esi, [ebp - 0x30]
mov dword [esi], eax
cmc
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
bts ax, bp
adc eax, ebp
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x28]
sar eax, 0x1f
stc
push edi
cmp dx, sp
jmp 0x88a61e
mov byte [ebp - 0x26], 0x6c
jmp 0x69697d
test al, 1
jmp 0x7caa7b
call fcn.0046e186
mov esp, ebp
mov ebp, edi
pop ebp
ret
mov byte [ebp - 0x6d], 0
mov byte [ebp - 0x20], 0x45
jmp loc.0043343e