joyce8/EMBER2024-capa huggingface dataset:
Function at 0x171b6
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edi, 0x1a8a0
mov ecx, edi
mov esi, eax
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
cmp byte [0x1a8b0], 0
je 0x171e7
mov esi, dword [ebp + 8]
mov dword [esi + 0x18], 0xc0000010
jmp 0x171fb
mov dword [0x1a8b4], esi
mov esi, dword [ebp + 8]
mov byte [0x1a8b0], 1
and dword [esi + 0x18], 0
mov dl, al
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
cmp dword [esi + 0x18], 0
jne 0x17210
call fcn.00011810
and dword [esi + 0x1c], 0
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [esi + 0x18]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1732c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
push esi
mov esi, 0x1a8a0
mov ecx, esi
call ebx
mov ecx, dword [0x1a850]
cmp ecx, 0x1a850
mov dl, al
je 0x1739a
push edi
mov edi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [eax], edi
mov dword [edi + 4], eax
lea edi, [ecx - 0x58]
xor eax, eax
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
test eax, eax
je 0x1738b
mov ecx, esi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
and dword [edi + 0x1c], 0
xor dl, dl
mov ecx, edi
mov dword [edi + 0x18], 0xc0000120
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, esi
call ebx
mov dl, al
mov ecx, dword [0x1a850]
cmp ecx, 0x1a850
jne 0x17350
pop edi
mov ecx, esi
pop esi
pop ebx
jmp dword [sym.imp.HAL.dll_KfReleaseSpinLock]

Function at 0x176b8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0xc]
test esi, esi
je 0x17720
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x20
jb 0x17720
cmp dword [0x19b80], 0
mov ebx, 0x19b68
jne 0x176f6
push 0
push 0x640000
push 0x19b80
call fcn.00017520
test eax, eax
jl 0x17710
cmp dword [0x19b68], 0
jne 0x17730
push 0
push 0x40000
push ebx
call fcn.00017520
test eax, eax
jge 0x17730
push 0x19b80
call fcn.00017642
push ebx
call fcn.00017642
and dword [edi + 0x1c], 0
mov eax, 0xc0000001
mov dword [edi + 0x18], eax
mov esi, eax
jmp 0x17773
mov eax, dword [0x19b84]
cdq
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [0x19b90]
mov dword [esi + 8], eax
mov eax, dword [0x19b94]
mov dword [esi + 0xc], eax
mov eax, dword [0x19b6c]
cdq
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0x19b78]
mov dword [esi + 0x18], eax
mov eax, dword [0x19b7c]
mov dword [esi + 0x1c], eax
xor esi, esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], 0x20
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x17ef4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ebx, 0x1a810
push edi
mov ecx, ebx
call esi
mov edi, 0x1a8a0
jmp 0x17feb
cmp edx, eax
mov ecx, dword [edx]
mov dword [0x1a850], ecx
mov dword [ecx + 4], eax
je 0x17ffa
add edx, 0xffffffa8
lea ecx, [edx + 0x58]
mov dword [ebp - 0xc], edx
mov dword [ecx + 4], ecx
mov dword [ecx], ecx
xor ecx, ecx
add edx, 0x38
xchg dword [edx], ecx
test ecx, ecx
je 0x17ffa
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x60]
mov eax, dword [eax + 4]
test byte [eax + 6], 5
mov dword [ebp - 0x10], ecx
je 0x17f5f
mov eax, dword [eax + 0xc]
jmp 0x17f6f
push 0x10
xor ecx, ecx
push ecx
push ecx
push 1
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test eax, eax
mov dword [ebp - 8], eax
je 0x17fbf
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 8
jb 0x17fbf
push dword [0x19b90]
push dword [0x19b88]
call fcn.00017cac
mov ecx, dword [ebp - 8]
and dword [ecx + 4], 0
mov dl, byte [ebp - 1]
mov dword [ecx], eax
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dl, byte [ebp - 2]
mov ecx, ebx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp - 0xc]
and dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 8
jmp 0x17fdf
mov dl, byte [ebp - 1]
mov ecx, edi
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov dl, byte [ebp - 2]
mov ecx, ebx
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x18], 0xc000009a
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov ecx, ebx
call esi
mov ecx, edi
mov byte [ebp - 2], al
call esi
mov byte [ebp - 1], al
mov eax, 0x1a850
mov edx, dword [0x1a850]
cmp edx, eax
jne 0x17f18
mov dl, byte [ebp - 1]
mov esi, dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
call esi
mov dl, byte [ebp - 2]
mov ecx, ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x18164
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00018934
mov esi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ebx, 0x1a810
mov ecx, ebx
call esi
mov edi, 0x1a8a0
mov ecx, edi
mov byte [ebp - 2], al
call esi
and dword [0x1a8b4], 0
mov byte [ebp - 1], al
mov byte [0x1a8b0], 0
call fcn.0001722c
mov dl, byte [ebp - 1]
mov esi, dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, edi
call esi
mov dl, byte [ebp - 2]
mov ecx, ebx
call esi
call fcn.0001732c
call fcn.0001725c
push 0x19b80
call fcn.00017642
push 0x19b68
call fcn.00017642
mov ecx, dword [ebp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x181f6
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
test byte [eax + 6], 5
push edi
je 0x18210
mov ebx, dword [eax + 0xc]
jmp 0x18222
push 0x10
xor ecx, ecx
push ecx
push ecx
push 1
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov ebx, eax
test ebx, ebx
je 0x18306
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 8
jb 0x18306
mov edi, dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov ecx, 0x1a810
call edi
mov ecx, 0x1a8a0
mov byte [ebp + 0xf], al
call edi
push dword [0x19b90]
mov byte [ebp + 0xb], al
push dword [0x19b88]
call fcn.00017cac
and dword [ebx + 4], 0
mov dword [ebx], eax
cmp byte [esi + 0x24], 0
mov edi, 0x103
je 0x18287
xor eax, eax
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
test eax, eax
je 0x18287
mov dword [ebp - 4], 0xc0000120
jmp 0x182cd
mov eax, dword [ebx]
or eax, dword [ebx + 4]
jne 0x182c9
mov edx, 0x1a850
cmp dword [0x1a850], edx
jne 0x182c9
mov eax, dword [esi + 0x60]
or byte [eax + 3], 1
mov dword [esi + 0x18], edi
mov ecx, dword [0x1a854]
lea eax, [esi + 0x58]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [ecx], eax
mov dword [0x1a854], eax
mov eax, 0x173aa
lea ecx, [esi + 0x38]
xchg dword [ecx], eax
mov dword [ebp - 4], edi
jmp 0x182cd
and dword [ebp - 4], 0
mov dl, byte [ebp + 0xb]
mov ebx, dword [sym.imp.HAL.dll_KfReleaseSpinLock]
mov ecx, 0x1a8a0
call ebx
mov dl, byte [ebp + 0xf]
mov ecx, 0x1a810
call ebx
mov ebx, dword [ebp - 4]
cmp ebx, edi
je 0x18302
xor dl, dl
mov ecx, esi
mov dword [esi + 0x1c], 8
mov dword [esi + 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
jmp 0x1831a
mov edi, 0xc000009a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x18856
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [eax + 4]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
xor edi, edi
test byte [eax + 6], 5
je 0x18877
mov eax, dword [eax + 0xc]
jmp 0x18885
push 0x10
push edi
push edi
push 1
push edi
push eax
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
cmp eax, edi
je 0x188af
cmp ebx, 8
jb 0x188af
push dword [eax]
push dword [0x19b70]
call fcn.00018736
xor dl, dl
mov ecx, esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x188c3
mov edi, 0xc000009a
xor dl, dl
mov ecx, esi
mov dword [esi + 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd7c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd7c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x657260
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x600e32
Capabilities:
Encode data using xor

Disassembly:
hlt
push edx
sbb dword [eax], 0x41d08996
xchg byte [ecx + 0x750bf4c8], ch
std
inc ebp
clc
sbb dword [ebp + 0x3e4b3c5f], ecx
cmp al, 0x4b
xor bh, al
cmp al, 0x4b
xor bh, al
mov dword [esi - 0x41b7a54c], ecx
push ss
cmp dh, ah
or byte [eax - 0x3b], bh
xchg esp, eax
stosd dword es:[edi], eax
dec eax
jl 0x600e1f
fcomp dword [edx]
loop 0x600e0f
adc eax, 0x6a9c2bdc
out dx, al
push esp
mov ah, byte [ecx + 0x3c]
hlt

Function at 0x60ada2
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx - 0x5630959b], ecx
insb byte es:[edi], dx
add byte [esi + ebp + 0x5d], 0xfe
sub bh, byte [esi + 0x7f]
stc
fcomp qword [edi + edi*4]
imul edx, dword [edi + 0x7559c778], 0x3a7ba30b
push esp
inc ebx
mov byte fs:[0x71148ea8], al
cdq
out dx, al
mov edx, 0x338af7ef
sbb eax, ecx
sbb ebx, esi
fsub dword [ecx - 0x60e811c5]
sbb eax, dword [edi]
dec esp
mov edi, 0x2b180e8b
pop ecx
lcall 0xb2e, 0xeae68e23
push es
sbb ebx, esi
shl dl, 0x70
out 0x1e, al
fisubr dword [esi]
or al, ch
rol bh, cl
mov byte [0x2cf2486a], al
xor al, 0x99
pop edx
jp 0x60ade1
wait
retf 0x3fb4
Function at 0x1008058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010081a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x100807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x100806a
add dl, dl
jne 0x1008089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10080dc
xor eax, eax
add dl, dl
jne 0x1008096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x100817d
add dl, dl
jne 0x10080a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10080b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10080bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10080c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10080d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1008075
mov eax, 1
add dl, dl
jne 0x10080ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10080f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10080e1
sub eax, ebx
mov ebx, 1
jne 0x1008128
mov ecx, 1
add dl, dl
jne 0x100810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1008119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1008105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1008075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x100813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x100814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1008136
cmp eax, 0x7d00
jae 0x100816d
cmp eax, 0x500
jb 0x1008168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1008075
cmp eax, 0x7f
ja 0x1008170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1008075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x100819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1008075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x800e5a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07efe94
jmp 0x800f2b
pushal
call fcn.00800d6c
lea esp, [esi - 0x77]
pop esp
and al, 0xb
pop word [esp + 0xc]
mov word [esp + 4], bp
jmp 0x800dbc
lea esp, [esp + 2]
xchg dword [esp + 8], edi
call fcn.00800d99
lea esp, [esp + 2]
mov dword [esp + 0x20], edx
call fcn.00800dec
mov dh, 0x43
sal dword [esi + reloc.MSVFW32.dll_DrawDibDraw], cl
lcall 0xff30, 0x31bb0cfd
je 0x800dfe
add cl, byte [ebp + 0x5566017f]
lea esp, [esp]
mov byte [esp], bh
mov word [esp], cx
jmp 0x800daf
mov dword [esp], ecx
push dword [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x24], ebx
push edi
jmp 0x800e1a
mov word [esp], dx
push ax
lea esp, [esp + 2]
mov dword [esp + 0x24], esp
jmp 0x800e51
mov dword [esp + 0x20], ebp
call fcn.00800e3b
mov word [esp + 1], bp
push dword [esp]
jb 0x800f11
jae 0x800ee4
adc eax, 0x691e3784
mov byte [ecx - 0x17dfdb8c], cl
loope 0x800e76
invalid
invalid
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
call 0x800e9c
adc al, 0x66
push word [esp + 0x16]
jmp 0x800ecb
lea esp, [esp + 2]
xchg dword [esp + 0x24], ebp
push sp
mov word [esp], ax
lea esp, [esp + 1]
pushal
jmp 0x800ef2
push word [esp + 7]
pop dword [esp]
lea esp, [esp + 2]
jmp 0x800eb2
lea esp, [esp + 1]
lea ebp, [ebp + 0x66]
call fcn.00800f83
mov edi, 0x35c6a333
mul dword [edi + reloc.MSVFW32.dll_DrawDibDraw]
clc
mov bl, 0x21
mov cl, 0xd0
and ebx, dword [edi + reloc.MSVFW32.dll_DrawDibDraw]
and al, 7
push word [esp + 7]
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x8009da
jmp 0x800f53
inc al
jle 0x800fc8
sub esp, 5
bswap edi
lea esp, [esp + 1]
jmp 0x800fa9
lea ebp, [esp + 4]
push ax
mov dh, byte [esp]
clc
jno 0x801075
jo 0x800fe5
inc esi
jno 0x801015
lea esp, [esp + 1]
mov edi, dword [esp + 0x30]
mov al, cl
not ecx
jmp 0x800f8f
sub esp, 5
bswap edi
jmp 0x800fa5
btc ecx, eax
mov ebx, edi
clc
jo 0x800feb
lea eax, [esi + 0xe5]
not edx
jmp 0x801051
lea esp, [esp + 2]
jmp 0x80102f
jmp 0x801008
jle 0x800fcf
btc ecx, eax
jmp 0x800fd2
lea eax, [esi + 0xe5]
not edx
dec eax
mov dh, ch
mov ah, 0xfa
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x80103b
lea esp, [esp + 2]
sub esp, 0xbc
mov esi, esp
inc bl
jmp 0x801001
clc
jg 0x801058
sbb bh, byte [esi + 0x18]
jle 0x801058
jbe 0x80103d
imul ecx, dword [esi], reloc.MSVFW32.dll_DrawDibDraw
cmp bl, byte [esp + ebx*8 + 0x72]
adc eax, 0xc8a921e4
imul eax, dword [edx - reloc.MSVFW32.dll_DrawDibDraw], 0xffffffb4
cli
dec eax
mov dh, ch
mov ah, 0xfa
jmp 0x801015
ror edi, 0
mov ah, byte [esp]
mov edx, dword [esp]
jmp 0x8010dc
jmp 0x80102b
mov ax, 0x3790
lea ecx, [esi*4]
sub esp, 3
jnp 0x8010b9
xchg byte [esp + 1], dh
rdtsc
xchg word [esp], dx
jmp 0x8010bf
inc cx
sub edi, 0x317dd9d6
jmp 0x801077
rdtsc
xchg word [esp], dx
lea esp, [esp + 3]
jmp 0x8010fc
xchg byte [esp + 1], dh
jmp 0x8010a3
lea esp, [esp + 3]
call fcn.008010e6
out 0x61, eax
int1
nop
arpl di, dx
daa
mov byte [0x10a25730], al
imul esp, edi, 0x77
adc ah, cl
pop edx
lcall 0x7ad2, 0xb30f66f5
mov bh, 0x66
inc ecx
btr dx, dx
jp 0x801099
inc cx
jmp 0x80109b
xor edi, 0x1c25f226
jmp 0x801149
Function at 0x800ec0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07efe94
jmp 0x800f2b
pushal
call fcn.00800d6c
lea esp, [esi - 0x77]
pop esp
and al, 0xb
pop word [esp + 0xc]
mov word [esp + 4], bp
jmp 0x800dbc
lea esp, [esp + 2]
xchg dword [esp + 8], edi
call fcn.00800d99
lea esp, [esp + 2]
mov dword [esp + 0x20], edx
call fcn.00800dec
mov dh, 0x43
sal dword [esi + reloc.MSVFW32.dll_DrawDibDraw], cl
lcall 0xff30, 0x31bb0cfd
je 0x800dfe
add cl, byte [ebp + 0x5566017f]
lea esp, [esp]
mov byte [esp], bh
mov word [esp], cx
jmp 0x800daf
mov dword [esp], ecx
push dword [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x24], ebx
push edi
jmp 0x800e1a
mov word [esp], dx
push ax
lea esp, [esp + 2]
mov dword [esp + 0x24], esp
jmp 0x800e51
mov dword [esp + 0x20], ebp
call fcn.00800e3b
mov word [esp + 1], bp
push dword [esp]
jb 0x800f11
jae 0x800ee4
adc eax, 0x691e3784
mov byte [ecx - 0x17dfdb8c], cl
loope 0x800e76
invalid
invalid
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
call 0x800e9c
adc al, 0x66
push word [esp + 0x16]
jmp 0x800ecb
lea esp, [esp + 2]
xchg dword [esp + 0x24], ebp
push sp
mov word [esp], ax
lea esp, [esp + 1]
pushal
jmp 0x800ef2
push word [esp + 7]
pop dword [esp]
lea esp, [esp + 2]
jmp 0x800eb2
lea esp, [esp + 1]
lea ebp, [ebp + 0x66]
call fcn.00800f83
mov edi, 0x35c6a333
mul dword [edi + reloc.MSVFW32.dll_DrawDibDraw]
clc
mov bl, 0x21
mov cl, 0xd0
and ebx, dword [edi + reloc.MSVFW32.dll_DrawDibDraw]
and al, 7
push word [esp + 7]
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x8009da
jmp 0x800f53
inc al
jle 0x800fc8
sub esp, 5
bswap edi
lea esp, [esp + 1]
jmp 0x800fa9
lea ebp, [esp + 4]
push ax
mov dh, byte [esp]
clc
jno 0x801075
jo 0x800fe5
inc esi
jno 0x801015
lea esp, [esp + 1]
mov edi, dword [esp + 0x30]
mov al, cl
not ecx
jmp 0x800f8f
sub esp, 5
bswap edi
jmp 0x800fa5
btc ecx, eax
mov ebx, edi
clc
jo 0x800feb
lea eax, [esi + 0xe5]
not edx
jmp 0x801051
lea esp, [esp + 2]
jmp 0x80102f
jmp 0x801008
jle 0x800fcf
btc ecx, eax
jmp 0x800fd2
lea eax, [esi + 0xe5]
not edx
dec eax
mov dh, ch
mov ah, 0xfa
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x80103b
lea esp, [esp + 2]
sub esp, 0xbc
mov esi, esp
inc bl
jmp 0x801001
clc
jg 0x801058
sbb bh, byte [esi + 0x18]
jle 0x801058
jbe 0x80103d
imul ecx, dword [esi], reloc.MSVFW32.dll_DrawDibDraw
cmp bl, byte [esp + ebx*8 + 0x72]
adc eax, 0xc8a921e4
imul eax, dword [edx - reloc.MSVFW32.dll_DrawDibDraw], 0xffffffb4
cli
dec eax
mov dh, ch
mov ah, 0xfa
jmp 0x801015
ror edi, 0
mov ah, byte [esp]
mov edx, dword [esp]
jmp 0x8010dc
jmp 0x80102b
mov ax, 0x3790
lea ecx, [esi*4]
sub esp, 3
jnp 0x8010b9
xchg byte [esp + 1], dh
rdtsc
xchg word [esp], dx
jmp 0x8010bf
inc cx
sub edi, 0x317dd9d6
jmp 0x801077
rdtsc
xchg word [esp], dx
lea esp, [esp + 3]
jmp 0x8010fc
xchg byte [esp + 1], dh
jmp 0x8010a3
lea esp, [esp + 3]
call fcn.008010e6
out 0x61, eax
int1
nop
arpl di, dx
daa
mov byte [0x10a25730], al
imul esp, edi, 0x77
adc ah, cl
pop edx
lcall 0x7ad2, 0xb30f66f5
mov bh, 0x66
inc ecx
btr dx, dx
jp 0x801099
inc cx
jmp 0x80109b
xor edi, 0x1c25f226
jmp 0x801149
Function at 0x800f83
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bl
xchg dword [esp + 0x48], ebp
call fcn.00800f69

Function at 0x823cea
Capabilities:
Encode data using xor

Disassembly:
shl edi, cl
clc
jmp 0x823bde
movzx edi, byte [eax + edi]
clc
push dx
lea esp, [esp + 2]
jmp 0x823a80
or esi, edi
call 0x823aa3
lea esp, [esp + 4]
add ecx, 8
push ax
mov word [esp], si
lea esp, [esp + 2]
jmp 0x823abd
lea esp, [esp + 2]
jmp 0x823a96

Function at 0x89ffff
Capabilities:
Hash data using murmur3

Disassembly:
pushal
bsr di, dx
mov edi, dword [esp + 0xb]
jmp 0x8a0135
and edi, 0xe9c60e7c
xchg byte [esp + 8], bl
pop word [esp + 4]
sub esp, 0x12
add esp, 0x17
not si
mov esi, dword [esp + 0x34]
lea esp, [esp + 0x2f]
not di
mov bx, 0x5ad1
mov bx, sp
lea esi, [edi + ebp]
jmp 0x8a0060
stc
std
mov word [esp + 0xb], ax
not edi
mov bx, dx
mov si, 0xb20f
jmp 0x8a00af
Function at 0x8a52a2
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.008a4187
stc
lea esp, [esp + 2]
mov ecx, edx
xchg word [esp], bx
sub esp, 6
jmp 0x8a5100
mov dword [esp], esi
jmp 0x8a50e5
xchg word [esp + 4], cx
mov bl, al
pop dword [esp]
jmp 0x8a517c
stc
ror bx, cl
lea ebx, [edx + edi]
bswap ebx
mov byte [esp], dh
mov cx, word [esp]
jmp 0x8a5155
pop word [esp]
inc ecx
pop cx
clc
mov cx, word [esp]
lea esp, [esp]
jmp 0x8a512e
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
lea ecx, [edx*4]
push bx
adc ecx, 0x9c497e77
xchg word [esp], bx
mov ecx, dword [esp]
jmp 0x8a55b6
lea ecx, [eax*4]
mov byte [esp], dh
std
bsf cx, dx
mov ebx, dword [esp + 1]
mov cl, 0xc1
jmp 0x8a5144
mov bx, word [esp]
mov ebx, dword [esp + 0x18]
lea esp, [esp + 0x24]
popfd
jmp 0x8a51fa
mov ecx, dword [esp + 6]
pushfd
xchg dword [esp], ebx
pop ebx
mov ebx, dword [esp]
mov bx, word [esp]
jmp 0x8a5193
push edi
pushal
jmp 0x8a51dd
adc ah, byte [eax]
mov bh, 0x27
inc edx
mov cl, 0x4e
test al, 0x3e
pop ecx
test al, 0x1d
inc ebp
call fcn.008a51c2
lea esp, [esp + 2]
mov dword [esp + 0x20], ecx
call fcn.008a5219
loope 0x8a5262
in al, 0x83
jle 0x8a51c7
int1
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fmul dword [esi]
cdq
clc
fisttp dword [ebp - reloc.MSVFW32.dll_DrawDibDraw]
aad 0xff
invalid
lea esp, [esp + 4]
call 0x8a51d8
mov byte [esp + 2], ah
jmp 0x8a526d
add cl, byte [eax - 0x76fadb9c]
push esp
and al, 0x24
call 0x8a5203
fld dword [edx - 0x30]
mov bh, 0x42
jmp 0x8a51ca
lea esp, [esp]
cmc
lea esp, [esp + 1]
ror ch, 6
inc cx
stc
jmp 0x8a51b0
push edi
call 0x8a5299
mov word [esp], bx
mov word [esp + 1], dx
mov dword [esp + 0x28], ebp
push esi
jmp 0x8a5283
lea esp, [esp + 2]
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x20], ebx
pushfd
mov byte [esp], ch
jmp 0x8a524e
push dword [esp + 2]
mov dword [esp + 0x2c], esi
call 0x8a52a2
loope 0x8a530f
in eax, dx
je 0x8a521c
add cl, ah
pop edi
cmpsb byte [esi], byte es:[edi]
mov dword [esp + 0x28], esp
call 0x8a5254
mov byte [esp + 2], dh
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x8a5433
bsf ecx, esi
mov byte [esp + 1], dh
pop ecx
lea esp, [esp]
ror bx, 0
mov ecx, dword [esp]
jmp 0x8a523b
out 0xbd, eax
xor al, 0xaa
int 0x3c
shr dword [ebp + reloc.MSVFW32.dll_DrawDibDraw], cl
iretd
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8a4182
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8a53c9
mov bh, byte [esp + 2]
bswap ebx
neg cx
push dx
mov bl, 0x38
xchg bx, cx
jmp 0x8a52c3