joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435490
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46eb08
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x4354c9
inc eax
mov dword [esi + 0x10], eax
jmp 0x4355dc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x4354dd
mov eax, 0xffffffc7
jmp 0x4355de
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x4354ee
cmp dword [esi + 8], eax
jne 0x4354dd
cmp dword [esi + 8], eax
jne 0x435507
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x435507
mov eax, 0xffffffc7
jmp 0x4355de
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x43551b
push eax
mov ecx, ebx
call fcn.00434cc0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00405cc0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x43554c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00405ce0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00434430
test eax, eax
mov dword [esp + 0x38], eax
je 0x43557f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x474138
call fcn.00405ec0
mov eax, dword [esp + 0x38]
jmp 0x4355de
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.004352f0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x4355c3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00435310
mov esi, eax
test esi, esi
jne 0x4355f3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.004352f0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x435595
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x474138
call fcn.00405ec0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x474138
call fcn.00405ec0
mov eax, esi
jmp 0x4355de

Function at 0x438700
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x438760
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x438760
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x438760
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x438760
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4387a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x43e8f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46f138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00467bb2
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0043e290
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00467ae0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0046439e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0046439e
push 1
push 0
push 0
mov ecx, esi
call fcn.00464346
push 1
push 0
push 1
mov ecx, esi
call fcn.00464346
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00467c24
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x43ea70
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46f158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00467bb2
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0043e290
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00467ae0
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x43eb34
cmp dword [esp + 0x40], 1
jne 0x43eb32
cmp ecx, eax
jge 0x43eb34
mov eax, ecx
cmp eax, 0xc8
jge 0x43eb40
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0043e8f0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00467c24
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x43f2c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46f1c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004627bc
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00467e5a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00469376
test eax, eax
je 0x43f3dc
mov ecx, dword [esp + 0x3c]
call fcn.00467e87
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43f3a0
push edi
mov ecx, esi
call fcn.004654ec
mov ecx, esi
call fcn.0043f540
cmp dword [esp + 0x38], 1
jne 0x43f3d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00465627
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x441e10
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x441e43
push esi
call fcn.00444f00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x441e3c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441ec9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441eb2
mov eax, dword [esi + 8]
test eax, eax
je 0x441e67
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x441eae
cmp eax, 2
je 0x441eb2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x441e5a
cmp eax, 3
je 0x441e8d
cmp eax, 1
jne 0x441e5a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x441e5a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x441e5a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441ef0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441ed8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441ef0
add esp, 4
pop esi
ret
Function at 0x44d860
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x44d8a9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x44dd20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044d8d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044d950
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044d950
lea ecx, [esi + 0xc]
call fcn.00461198
lea ecx, [esi + 0x10]
call fcn.00461198
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044eee0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044eee0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044eee0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046120d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046120d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x44f0d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44f136
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44f136
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44f117
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4635b1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4635e9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00461668
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461640
jmp 0x4635f5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x464ca6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x464ce8
call fcn.0046a816
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x464ce8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x464cdf
xor eax, eax
jmp 0x464cf0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00464cf6
pop edi
pop esi
pop ebx
ret 4

Function at 0x46ad46
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46ad74
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46ad92
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046acac
jmp 0x46ad92
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46ad92
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046acac
test edi, edi
mov eax, edi
jne 0x46ad7c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x7f0a66
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7f0aaa
lea esp, [esp + 0x18]
neg esi
jmp 0x7f0acd
bswap ecx
lea edx, [edx + 0xf0]
jmp 0x7f0ab7
lea eax, reloc.MSVBVM60.DLL___vbaVarTstGt
sub esp, 0x10
jo 0x7f0a8c
jno 0x7f0a8c
cmp edx, 0xcf787be3
rdtsc
cmc
jmp 0x7f0ae9
neg ax
jle 0x7f0a94
bswap ecx
lea edx, [edx + 0xf0]
cmp edx, 0xcf787be3
rdtsc
cmc
jmp 0x7f0ae9
dec esi
xchg ecx, eax
push ebx
lea ecx, [ebp*4]
mov word [esp], ax
jmp 0x7f0b2c
mov dx, word [esp + 0x18]
rcr ecx, 0x11
jbe 0x7f0b93
ja 0x7f0b93
lahf
push es
xchg esp, eax
push cs
mov al, 0x37
push ds
imul ecx, dword [eax - reloc.MSVBVM60.DLL___vbaVarTstGt], 0x24648d09
add al, 0x81
invalid
not dx
mov dl, 9
lea esp, [esp + 4]
add esi, 0x1b69d0e0
pushal
jmp 0x7f0b16
not dh
setb ah
lea ecx, [ebx + edi]
jmp 0x7f0b9a
mov dx, word [esp]
mov eax, ebp
rdtsc
add esi, dword [edi]
inc dx
jmp 0x7f0bba
lea ecx, [ebx + edi]
jmp 0x7f0b9a
lea esp, [esp + 0x20]
inc esi
jmp 0x7f0b6c
jge 0x7f0b56
not dh
setb ah
jmp 0x7f0b7a

Function at 0x7f27ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x38], esi
push cx
lea esp, [esp]
push word [esp]
jmp 0x7f2802
jae 0x7f27d9
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x7f29ae
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x7f28eb

Function at 0x7f28ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07dcb60
jmp 0x7f286b
call 0x7f27bc
push word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x38], edi
jmp 0x7f28e7
push dword [esp + 1]
jl 0x7f27d4
jge 0x7f27d4
jns 0x7f2844
neg si
lea eax, [ebx + edi]
jmp 0x7f284a
neg si
lea eax, [ebx + edi]
jmp 0x7f28a3
neg si
jmp 0x7f2855
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x7f2888
lea esi, [ecx + edx]
neg edi
jmp 0x7f282e
sub esp, 0xa4
jmp 0x7f28c2
lea edi, [esp + 0x1c]
mov bx, di
lea esi, [ecx + edx]
jmp 0x7f2872
mov ebp, dword [esp + 0x2c]
lea ecx, [ebx*4]
and ecx, 0x7d9f11ea
ja 0x7f284c
neg si
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x7f2888
mov esi, esp
call 0x7f28ca
push ecx
pop eax
shl dx, cl
je 0x7f297a
jne 0x7f2927
leave
push edx
shl byte [edi - 0x28b618ae], 0x47
and dl, cl
sbb ecx, edx
xchg esp, eax
pop es
scasb al, byte es:[edi]
lea esp, [esp + 0x38]
pushfd
jmp 0x7f16ae
lea edx, [ecx + ecx]
jmp fcn.007f297d
lea edx, [ecx + ecx]
jmp 0x7f2826
Function at 0x7f2aad
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07dcb60
jmp 0x7f286b
call 0x7f27bc
push word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x38], edi
jmp 0x7f28e7
push dword [esp + 1]
jl 0x7f27d4
jge 0x7f27d4
jns 0x7f2844
neg si
lea eax, [ebx + edi]
jmp 0x7f284a
neg si
lea eax, [ebx + edi]
jmp 0x7f28a3
neg si
jmp 0x7f2855
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x7f2888
lea esi, [ecx + edx]
neg edi
jmp 0x7f282e
sub esp, 0xa4
jmp 0x7f28c2
lea edi, [esp + 0x1c]
mov bx, di
lea esi, [ecx + edx]
jmp 0x7f2872
mov ebp, dword [esp + 0x2c]
lea ecx, [ebx*4]
and ecx, 0x7d9f11ea
ja 0x7f284c
neg si
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x7f2888
mov esi, esp
call 0x7f28ca
push ecx
pop eax
shl dx, cl
je 0x7f297a
jne 0x7f2927
leave
push edx
shl byte [edi - 0x28b618ae], 0x47
and dl, cl
sbb ecx, edx
xchg esp, eax
pop es
scasb al, byte es:[edi]
lea esp, [esp + 0x38]
pushfd
jmp 0x7f16ae
lea edx, [ecx + ecx]
jmp fcn.007f297d
lea edx, [ecx + ecx]
jmp 0x7f2826

Function at 0x7fbf38
Capabilities:
Hash data with md5

Disassembly:
jmp 0x7fcad7
jmp 0x7df4bc
jmp 0x7df4db
and dword [eax + 4], 0
jmp 0x830c71

Function at 0x83b6e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [ebp + 8]
dec dl
jmp 0x83b7bf
sub esp, 2
lea esp, [esp + 2]
jmp 0x83b6ca
mov eax, dword [ebx]
pop ebx
dec dh
lea ebp, [ebx + ebx]
mov bh, 0x4e
pushfd
jmp 0x83b706
push ebx
mov ebx, ebp
add ebx, 0xfffffff8
jmp 0x83b731
mov eax, 0x25ff
lea esp, [esp + 4]
stosw word es:[edi], ax
cpuid
jmp 0x83b775

Function at 0x83c786
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x83c7c9
push ecx
jmp 0x83c7d7
mov ebx, dword [esi + 0x24]
lea esp, [esp + 0xc]
and dword [ebp - 8], edi
add eax, ecx
jmp 0x83c7b3
mov dword [ebp - 0x10], eax
mov ah, ch
mov ah, 0xfd
sub esp, 0xc
jmp 0x83d614
push word [esp + 2]
mov dword [esp + 2], ebx
lea esp, [esp + 8]
js 0x83c448
jmp 0x83c4e2
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], eax
pushfd
push word [esp + 2]
jmp 0x83c98a
pop edi
add ebx, ecx
lea esp, [esp + 0x10]
dec eax
jmp 0x83ca88
push edi
mov edi, esi
add edi, 0x18
mov eax, dword [edi]
jmp 0x83d344

Function at 0x83c8f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x83c4c8
pushfd
mov eax, dword [ebp - 0xc]
mov edi, 0x595b04da
dec di
xchg cl, ch
jmp 0x83ca64
lea esp, [esp + 4]
jmp 0x83c952
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x83c8da
je 0x83c4ad
lea ecx, [eax*4]
mov ch, byte [esp]
neg cl
jmp 0x83c916
call 0x7fbcf5
sub esp, 0x1e
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
test eax, eax
jmp 0x83c92c
lea ebx, [eax + ebx]
movzx eax, word [ebx]
pop ebx
pushfd
mov word [esp], ax
jmp 0x83ca6c
push ebx
mov ebx, ebx
lea ebx, [ebx + ebx]
jmp 0x83ca4e
cmc
mov ecx, dword [esi + 0x1c]
btr di, sp
call fcn.0083d00b
adc eax, 0xa455329c
sbb ah, byte [ebp - 0x17]
jns 0x83ca9b
jmp 0x83cab0
pushfd
lea esp, [esp + 0x1c]
jne 0x83c41c
je 0x83c496
invalid
xchg dword [eax], esi
ret 0xdc4e

Function at 0x83ca19
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 8], ebx
lea esp, [esp + 4]
jmp 0x83c4c3
Function at 0x8b4d2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xe], sp
xchg word [esp + 0xa], ax
mov ebx, 0x35dcf050
jmp 0x8b4d48
Function at 0x8b5164
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg esi
ror ebx, cl
bts ebp, esp
mov ch, byte [esp + 6]
xchg edx, ebp
jmp 0x8b5183
pop eax
mov bl, 0xad
pushfd
bsf ebp, ecx
mov dword [esp], esp
mov byte [esp + 4], al
jmp 0x8b512b
pop ax
pushfd
bts cx, dx
jmp 0x8b5141
rcr cl, cl
mov esi, 0x32dbd8e7
bswap edx
btr cx, dx
jmp 0x8b5271
mov ecx, 0x4bb31580
mov dword [esp], esp
push dword [esp + 4]
xor bl, ah
add esp, 9
cpuid
jmp 0x8b516d
popal
sub esp, 0x14
cmc
xchg ch, ah
xchg byte [esp + 0xe], bl
pop word [esp + 0xe]
jmp 0x8b51c3
xchg byte [esp + 0x12], ch
push word [esp + 0x12]
push dword [esp + 0x1b]
mov dl, 0x74
mov dl, ch
xchg ecx, ebx
jmp 0x8b5198
xchg byte [esp + 5], al
lea ebx, [ebp + 0xc9]
xchg bx, ax
lea esp, [esp + 1]
jmp 0x8b51f1
rdtsc
sub esp, 0x12
pop word [esp + 9]
mov dword [esp + 2], edi
mov edi, edx
mov ch, ah
jmp 0x8b51ae
push dword [esp + 0xc]
mov ebx, esp
inc edx
call fcn.008b5230
add dword [edx], reloc.MSVBVM60.DLL___vbaVarTstGt
test dword [edx], reloc.MSVBVM60.DLL___vbaVarTstGt
xor al, cl
cli
aad 0x8b
retf
mov ecx, ebx
pop ebp
neg bx
xor ebp, eax
bswap ebp
xchg dx, ax
jmp 0x8b51dd
xchg word [esp], si
lea ecx, reloc.MSVBVM60.DLL___vbaVarTstGt
sub esp, 0xc
rdtsc
mov byte [esp + 4], ch
lea esi, [esi - 0x86]
jmp 0x8b520b

Function at 0x8b57af
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts cx, bp
stc
rdtsc
xchg dx, bp
stc
pushal
jmp 0x8b5786
inc di
xchg al, ah
stc
push dword [esp + 0x18]
cpuid
lea edx, [ecx*4]
jmp 0x8b5757
lea esp, [esp + 0x45]
clc
lea ecx, reloc.MSVBVM60.DLL___vbaVarTstGt
std
xchg di, cx
stc
jmp 0x8b57c9
mov bp, word [esp]
mov dx, 0x97a8
xchg bl, dh
btc di, cx
jmp 0x8b57b3
mov esi, edx
jmp 0x8b5772
bsr di, bp
dec dh
mov edi, edx
bt edx, edx
ror ecx, cl
mov ecx, esp
jmp 0x8b57f4
neg ebx
sbb edi, 0x89087a35
mov dh, 0xe0
mov cx, word [esp]
mov edx, edi
rcl si, cl
jmp 0x8b5798
sub eax, esi
bsr esi, edi
not cl
xchg cx, si
stc
bsf si, ax
jmp 0x8b5a1a
cpuid
mov ecx, 0xebdbe880
mov ch, 0x40
bsf ecx, ebx
not cl
bsr esi, ecx
jmp 0x8b57de
mov bh, byte [esp + 2]
cmc
lea eax, [esi*4]
xchg word [esp], bp
bts eax, esp
jmp 0x8b581d
pop ebx
mov eax, dword [esp + 3]
cmc
rcr dx, cl
neg ax
lea edx, [esi + ebp]
jmp 0x8b5833
mov byte [esp + 2], ah
xchg di, cx
lea ebp, [esi + esi]
lea esp, [esp + 2]
push edi
cpuid
jmp 0x8b584f
lea edi, reloc.MSVBVM60.DLL___vbaVarTstGt
stc
lea edx, [eax + esi]
lea edi, reloc.MSVBVM60.DLL___vbaVarTstGt
push dx
add esp, 0xd
jmp 0x8b587f
rdtsc
sub esp, 0x12
push word [esp + 1]
xchg word [esp + 7], bp
dec bx
lea esp, [esp + 3]
jmp 0x8b58e2
cmc
xchg dl, bl
cpuid
mov cx, bx
xchg si, ax
cpuid
jmp 0x8b595f
Function at 0x8b5c8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 0x18]
bswap ebx
bswap edi
bswap edi
xchg dword [esp + 0x10], ebx
jmp 0x8b5c48
xchg si, ax
mov dh, 0xb7
pop cx
rdtsc
cpuid
cpuid
jmp 0x8b5be7
lea ebp, [eax + edx]
bts si, si
push si
bswap esi
xchg byte [esp + 8], cl
jmp 0x8b5c32
mov edx, esi
not ecx
rdtsc
pop dword [esp + 2]
not ch
mov dl, dh
jmp 0x8b5c0c
pop dword [esp + 6]
bsf di, di
xchg si, dx
pop bx
jmp 0x8b5c71
setnp cl
bswap edi
cpuid
neg bl
pop dword [esp + 0x10]
mov bx, 0xf841
jmp 0x8b5c22
lea esp, [esp + 2]
lea esp, [esp + 0xc]
popal
pushal
push dword [esp + 0x13]
call fcn.008b5c5b
mov ebx, 0x45b6d343
stosb byte es:[edi], al
xchg byte [ecx], dh
setbe bl
rdtsc
xchg word [esp + 9], ax
pop word [esp + 1]
jmp 0x8b5bfd

Function at 0x8b5d46
Capabilities:
Access peb ldr_data

Disassembly:
mov byte [esp + 3], bl
mov byte [esp + 2], dh
mov dword [esp + 4], ebp
pushfd
mov dword [esp + 4], esi
jmp 0x8b5d30