joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009ff7
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x1000a044
mov al, cl
cmp al, 0x61
jb 0x1000a01f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x1000a044
mov al, cl
cmp al, 0x61
jb 0x1000a037
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x1000a010
cmp edx, dword [esp + 0x18]
je 0x1000a054
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x1000a009
xor eax, eax
jmp 0x1000a057
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x1000a05f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x1000a146
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x1000a14c
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x1000a0ab
cmp al, 0x61
jb 0x1000a0a3
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1000a096
cmp edx, dword [esp + 0x14]
je 0x1000a0bb
dec ecx
jne 0x1000a08b
xor eax, eax
jmp 0x1000a146
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x1000a146
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x1000a146
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x1000a0f7
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x1000a106
jmp 0x1000a0ee
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.10009ff7
test eax, eax
je 0x1000a146
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x1000a141
cmp al, 0x61
jb 0x1000a139
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1000a12c
call fcn.1000a05f
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x1000a164
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x1000a164
sub edx, ecx
mov ecx, edx
jmp 0x1000a0bb
xor eax, eax
jmp 0x1000a146
Function at 0x1002432d
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.100244dd
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x1002442b
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x100243ce
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x10024411
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x100243e5
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10024400
test al, 0x40
je 0x100243f7
mov ecx, dword [edi + 0x20]
jmp 0x100243fe
test al, 0x80
je 0x10024411
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x10024411
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x1002439d
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x10025260
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1edb9
jmp fcn.10001058

Function at 0x1002526a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ea65
jmp fcn.10001058

Function at 0x10025274
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed4d
jmp fcn.10001058

Function at 0x1002527e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed59
jmp fcn.10001058

Function at 0x10025288
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ecd5
jmp fcn.10001058

Function at 0x10025292
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ea71
jmp fcn.10001058

Function at 0x1002529c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eca5
jmp fcn.10001058

Function at 0x100252a6
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1efed
jmp fcn.10001058

Function at 0x100252b0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eda1
jmp fcn.10001058

Function at 0x100252ba
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee9d
jmp fcn.10001058

Function at 0x100252c4
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1efe1
jmp fcn.10001058

Function at 0x100252ce
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb01
jmp fcn.10001058

Function at 0x100252d8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1f041
jmp fcn.10001058

Function at 0x100252e2
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec75
jmp fcn.10001058

Function at 0x100252ec
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec81
jmp fcn.10001058

Function at 0x100252f6
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee31
jmp fcn.10001058

Function at 0x10025300
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec09
jmp fcn.10001058

Function at 0x1002530a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee19
jmp fcn.10001058

Function at 0x10025314
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee01
jmp fcn.10001058

Function at 0x1002531e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1edf5
jmp fcn.10001058

Function at 0x10025328
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed89
jmp fcn.10001058

Function at 0x10025332
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eed9
jmp fcn.10001058

Function at 0x1002533c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eddd
jmp fcn.10001058

Function at 0x10025346
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ebe5
jmp fcn.10001058

Function at 0x10025350
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ede9
jmp fcn.10001058

Function at 0x1002535a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee6d
jmp fcn.10001058

Function at 0x10025364
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eaf5
jmp fcn.10001058

Function at 0x1002536e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee3d
jmp fcn.10001058
Function at 0x10025378
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ecc9
jmp fcn.10001058

Function at 0x10025382
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ecb1
jmp fcn.10001058

Function at 0x1002538c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee91
jmp fcn.10001058

Function at 0x10025396
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed7d
jmp fcn.10001058

Function at 0x100253a0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed65
jmp fcn.10001058

Function at 0x100253aa
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed71
jmp fcn.10001058

Function at 0x100253b4
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed05
jmp fcn.10001058

Function at 0x100253be
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee0d
jmp fcn.10001058

Function at 0x100253c8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec69
jmp fcn.10001058

Function at 0x100253d2
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee85
jmp fcn.10001058

Function at 0x100253dc
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eced
jmp fcn.10001058

Function at 0x100253e6
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ece1
jmp fcn.10001058

Function at 0x100253f0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eef1
jmp fcn.10001058

Function at 0x100253fa
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1efa5
jmp fcn.10001058

Function at 0x10025404
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb9d
jmp fcn.10001058

Function at 0x1002540e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1edc5
jmp fcn.10001058

Function at 0x10025418
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1f011
jmp fcn.10001058

Function at 0x10025422
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1efc9
jmp fcn.10001058

Function at 0x1002542c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ecbd
jmp fcn.10001058

Function at 0x10025436
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed29
jmp fcn.10001058

Function at 0x10025440
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed1d
jmp fcn.10001058

Function at 0x1002544a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed95
jmp fcn.10001058

Function at 0x10025454
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1f035
jmp fcn.10001058

Function at 0x1002545e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec21
jmp fcn.10001058

Function at 0x10025468
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eec1
jmp fcn.10001058

Function at 0x10025472
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eecd
jmp fcn.10001058

Function at 0x1002547c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec15
jmp fcn.10001058

Function at 0x10025486
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec8d
jmp fcn.10001058
Function at 0x10025490
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee55
jmp fcn.10001058

Function at 0x1002549a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef15
jmp fcn.10001058

Function at 0x100254a4
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eeb5
jmp fcn.10001058

Function at 0x100254ae
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eea9
jmp fcn.10001058

Function at 0x100254b8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eefd
jmp fcn.10001058

Function at 0x100254c2
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eee5
jmp fcn.10001058

Function at 0x100254cc
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1edad
jmp fcn.10001058

Function at 0x100254d6
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ebfd
jmp fcn.10001058

Function at 0x100254e0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ebf1
jmp fcn.10001058

Function at 0x100254ea
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ebd9
jmp fcn.10001058

Function at 0x100254f4
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1f005
jmp fcn.10001058

Function at 0x100254fe
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee61
jmp fcn.10001058

Function at 0x10025508
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee25
jmp fcn.10001058

Function at 0x10025512
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee49
jmp fcn.10001058

Function at 0x1002551c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ee79
jmp fcn.10001058

Function at 0x10025526
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1f01d
jmp fcn.10001058

Function at 0x10025530
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1efd5
jmp fcn.10001058

Function at 0x1002553a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1f029
jmp fcn.10001058

Function at 0x10025544
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1efb1
jmp fcn.10001058

Function at 0x1002554e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1efbd
jmp fcn.10001058

Function at 0x10025558
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef39
jmp fcn.10001058

Function at 0x10025562
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb31
jmp fcn.10001058

Function at 0x1002556c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef2d
jmp fcn.10001058

Function at 0x10025576
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb19
jmp fcn.10001058

Function at 0x10025580
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb25
jmp fcn.10001058

Function at 0x1002558a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef99
jmp fcn.10001058

Function at 0x10025594
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb61
jmp fcn.10001058

Function at 0x1002559e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ecf9
jmp fcn.10001058
Function at 0x100255a8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb49
jmp fcn.10001058

Function at 0x100255b2
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb3d
jmp fcn.10001058

Function at 0x100255bc
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb55
jmp fcn.10001058

Function at 0x100255c6
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ebc1
jmp fcn.10001058

Function at 0x100255d0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb91
jmp fcn.10001058

Function at 0x100255da
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ebcd
jmp fcn.10001058

Function at 0x100255e4
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb79
jmp fcn.10001058

Function at 0x100255ee
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb6d
jmp fcn.10001058

Function at 0x100255f8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb85
jmp fcn.10001058

Function at 0x10025602
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef45
jmp fcn.10001058

Function at 0x1002560c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef75
jmp fcn.10001058

Function at 0x10025616
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef69
jmp fcn.10001058

Function at 0x10025620
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef8d
jmp fcn.10001058

Function at 0x1002562a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef51
jmp fcn.10001058

Function at 0x10025634
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef81
jmp fcn.10001058

Function at 0x1002563e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef5d
jmp fcn.10001058

Function at 0x10025648
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec99
jmp fcn.10001058

Function at 0x10025652
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eba9
jmp fcn.10001058

Function at 0x1002565c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ebb5
jmp fcn.10001058

Function at 0x10025666
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef09
jmp fcn.10001058

Function at 0x10025670
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed35
jmp fcn.10001058

Function at 0x1002567a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed41
jmp fcn.10001058

Function at 0x10025684
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec5d
jmp fcn.10001058

Function at 0x1002568e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec51
jmp fcn.10001058

Function at 0x10025698
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec45
jmp fcn.10001058

Function at 0x100256a2
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eff9
jmp fcn.10001058

Function at 0x100256ac
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ea95
jmp fcn.10001058

Function at 0x100256b6
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ea89
jmp fcn.10001058
Function at 0x100256c0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eae9
jmp fcn.10001058

Function at 0x100256ca
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eab9
jmp fcn.10001058

Function at 0x100256d4
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eac5
jmp fcn.10001058

Function at 0x100256de
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ea7d
jmp fcn.10001058

Function at 0x100256e8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eadd
jmp fcn.10001058

Function at 0x100256f2
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec2d
jmp fcn.10001058

Function at 0x100256fc
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eaa1
jmp fcn.10001058

Function at 0x10025706
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eaad
jmp fcn.10001058

Function at 0x10025710
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ead1
jmp fcn.10001058

Function at 0x1002571a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ec39
jmp fcn.10001058

Function at 0x10025724
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1eb0d
jmp fcn.10001058

Function at 0x1002572e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ef21
jmp fcn.10001058

Function at 0x10025738
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1ed11
jmp fcn.10001058

Function at 0x10025742
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1edd1
jmp fcn.10001058
Function at 0xc1f38e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], esp
call 0xc1f39d
push dword [esp]
jns 0xc1f378
mov dword [esp + 8], esp
jmp 0xc1f43f
call fcn.00c1f413
push bp
jmp 0xc1f3b5

Function at 0xc1f3ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0c10898
jmp 0xc1f446
mov byte [esp + 2], al
push word [esp + 3]
jl 0xc1f420
lea esp, [esp + 2]
jmp 0xc1f425
jmp 0xc1f4ce
mov dword [esp + 8], esi
push si
lea esp, [esp + 2]
jmp 0xc1f461
mov ah, byte [esp]
mov di, word [esp]
jmp 0xc1f492
mov dword [esp + 4], edi
jmp 0xc1f4e0
mov ebp, dword [esp + 0x2c]
neg dh
jmp 0xc1f4ad
mov ecx, esp
rcr ebx, cl
lea edi, reloc.KERNEL32.DLL_WriteFile
jmp 0xc1f4b5
clc
jg 0xc1f467
jle 0xc1f467
lea edi, reloc.KERNEL32.DLL_WriteFile
jmp 0xc1f4b5
jge 0xc1f473
mov ecx, esp
rcr ebx, cl
jmp 0xc1f497
lea esi, [esp]
mov al, 0x6f
sete bl
mov dx, word [esp]
jmp 0xc1f4ea
lea esp, [esp + 2]
mov dword [esp + 8], esi
push si
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0xc1f381
sub esp, 0xc0
mov edi, esp
xchg bh, ah
bsr edx, esp
jmp 0xc1f514
jp 0xc1f52a
sub esp, 7
lea esp, [esp + 3]
jmp 0xc1f531
sub esp, 7
lea esp, [esp + 3]
mov ebx, ebp
jmp 0xc1f70c
ror ebp, 0
lea eax, [edi*4]
jmp 0xc1f57b
lea eax, [ebp*4]
jmp 0xc1f61a
inc ebp
mov cl, 0xbe
lea eax, [esp - 0xf]
neg ax
jl 0xc1f5c7
mov al, 0xba
rol ax, 1
add eax, esi
call fcn.00c1f5c9
mov cl, 0xb0
mov bl, 0xf
leave
bswap ecx
lea eax, reloc.KERNEL32.DLL_WriteFile
lea edx, [edx*4]
jmp 0xc1f56f
mov al, 0xba
rol ax, 1
add eax, esi
jmp 0xc1f5df
jmp 0xc1f5a8
mov ax, word [esp]
xor ebp, 0x1f777fb6
pushfd
bsr eax, edi
jno 0xc1f65c
mov ecx, esp
xchg byte [esp + 2], dh
jmp 0xc1f65e
neg ax
bswap ecx
lea eax, reloc.KERNEL32.DLL_WriteFile
lea edx, [edx*4]
lea eax, [ebp*4]
mov dx, bx
rdtsc
mov edx, 0xd8e29115
seto cl
mov ecx, 0xa1296e43
jmp 0xc1f559
jmp 0xc1f6a3
mov eax, 0x716b5f51
btr dx, ax
mov cl, byte [esp + 1]
jmp 0xc1f6b6
lea esp, [esp + 4]
add ebp, 0x46185273
mov eax, dword [esp]
sub esp, 4
jmp 0xc1f736
mov ecx, esp
xchg byte [esp + 2], dh
mov eax, 0x716b5f51
btr dx, ax
mov cl, byte [esp + 1]
jmp 0xc1f68d
inc ecx
mov dx, word [esp + 2]
xchg word [esp], dx
jmp 0xc1f71d
xchg word [esp], dx
push dword [esp]
pushal
jmp 0xc1f756
pushfd
neg cl
jl 0xc1f600
neg ax
jmp 0xc1f596
push dword [esp]
pushal
jmp 0xc1f756
jb 0xc1f6e4
inc ecx
mov dx, word [esp + 2]
jmp 0xc1f6f4
add ebp, dword [esi]
xchg al, dh
mov eax, 0x3cf1815d
jmp 0xc1f7c7
lea esp, [esp + 0x28]
not ebp
lea eax, [ebx*4]
mov ax, 0x2114
mov ecx, 0x2e77b75
jmp 0xc1f740

Function at 0xc1f413
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 8], ebp
call fcn.00c1f3ba

Function at 0xc1f549
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
lea esp, [esp + 2]
mov dword [esp], ecx
push edx
call fcn.00c1f40d

Function at 0xc1f76e
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
js 0xc1f7ac
not ah
xchg dx, ax
lea eax, reloc.KERNEL32.DLL_WriteFile
jmp 0xc1f817
jmp 0xc1f796
pop dx
Function at 0xc234a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov byte [esp], ah
lea esp, [esp + 2]
mov dword [esp + 0x14], esp
call fcn.00c2348c
lea esp, [esp + 2]
push word [esp + 1]
ja 0xc234eb
mov dword [esp + 0x14], ebp
jmp 0xc2373d
mov dword [esp + 0x14], ebp
push dx
mov byte [esp], bh
lea esp, [esp]
call fcn.00c23632
add ecx, 0x21730eec
jmp 0xc25ddd
add ecx, 0x7ad14498
call fcn.00c25e12
dec ecx
pushal
lea edx, reloc.KERNEL32.DLL_WriteFile
pushfd
xchg dword [esp + 0x4c], edx
call fcn.00c2351c
push dword [esp + 0x4c]
ret 0x50
push dx
mov byte [esp], bh
lea esp, [esp]
call fcn.00c2359b
lea edx, [ebx + esi]
mov dl, byte [esp]
mov edx, 0xa032efba
mov edx, eax
jmp 0xc25ea6
jmp 0xc23526
mov ecx, dword [ecx - reloc.KERNEL32.DLL_WriteFile]
lea edx, [ecx*4]
setae dl
inc edx
jne 0xc25e67
je 0xc23526

Function at 0xc25453
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, 0x78
push si
lea esp, [esp + 2]
xchg dword [esp + 4], ecx
adc esi, eax
jmp 0xc25459
xchg esi, eax
xchg ebx, eax
push esp
jmp 0xc2543d
mov si, bp
cmp bh, dl
mov dl, cl
lea ecx, [ecx + 0x18]
pushfd
btc dx, bp
jmp 0xc255b2
mov al, 0x1e
rdtsc
xchg dword [esp + 8], ecx
call fcn.00c2551a

Function at 0xc255bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, edi
rdtsc
add esp, 2
lea esp, [esp + 2]
jmp 0xc25608
inc ax
je 0xc2559b
mov ecx, edi
jmp 0xc255cb
rdtsc
add esp, 2
lea esp, [esp + 2]
jmp 0xc25608
neg dh
neg ax
bswap eax
mov ah, 0xed
lea eax, [edi + 0xd2]
push edx
jmp 0xc256cc
rol edi, 0
je 0xc255f2
neg dh
jmp 0xc25650
lea eax, [edi + 0xd2]
jmp 0xc25601
neg ax
bswap eax
mov ah, 0xed
jmp 0xc2563a
ror dh, cl
rol cx, cl
jmp 0xc2569f
xchg dl, cl
stc
mov dx, bx
jmp 0xc25659
xchg ecx, eax
pushal
jmp 0xc256b3
jmp 0xc2589f
xchg dl, cl
stc
mov dx, bx
ror dh, cl
rol cx, cl
sub edi, 0x3a63a15
neg edx
jmp 0xc256ad
je 0xc25677
xchg ecx, eax
pushal
jmp 0xc25679
add edi, dword [ebp]
lea edx, [edx + edx]
mov ecx, dword [esp]
lea eax, [ebx + edi]
bsr dx, di
jmp 0xc256dc
lea esp, [esp + 8]
add edi, 0x4938b56
neg eax
jns 0xc25694
js 0xc2566f
jnp 0xc2567b
jp 0xc2589f
mov dh, dl
mov dx, 0xc528
not dh
bsr ecx, esp
jmp 0xc25eed
bt dx, bp
call int.00c25ed7
sub dword [ebp + reloc.KERNEL32.DLL_WriteFile], esi
cmp dword [esi + reloc.KERNEL32.DLL_WriteFile], esp
push edi
push ecx
ret
jbe 0xc25ebf
bt dx, bp
jmp 0xc25ec3

Function at 0xc2db46
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0xc13bcb
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0xc13be5
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0xc13bd4
pop esi
jmp 0xc13bf0
ret 4
lea eax, reloc.KERNEL32.DLL_WriteFile
mov si, 0x5f4c
mov ax, word [esp]
lea eax, reloc.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x1e]
call fcn.00c2d388
jmp 0xc13bbe
bswap esi
xchg dh, dl
xchg dx, si
rdtsc
mov edx, dword [esp + 0x18]
lea esi, [edx - 0x78]
jmp 0xc2d8dc
mov ax, bx
lea eax, [esi + ebp]
xchg dl, al
jmp 0xc2da29