joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54e398
Capabilities:
Execute anti-debugging instructions

Disassembly:
or ecx, ecx
mov byte [esp + 4], 0x4b
pushfd
lea esp, [esp + 0xc]
je 0x54fa48
xadd di, bx
shrd bx, bp, cl
call fcn.0055d158

Function at 0x54e805
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], 0x7009b355
push 0x9d98a2a6
push ebp
lea esp, [esp + 0x2c]
jmp 0x5a65e9
jmp 0x5a75f9
mov byte [esp + 8], dh
mov dword [esp + 8], 0xc1b2da7c
jmp fcn.005a5dec
pushfd
push 0xef832394
pushal
mov dword [esp + 0x28], edx
push dword [esp]
mov dword [esp + 0x28], edi
jmp 0x5a5232
pushfd
push 0x11c4470c
mov dword [esp + 4], ebx
pushfd
pushfd
pop dword [esp + 4]
jmp 0x5a54d3
mov dword [esp + 0x24], eax
jmp 0x5a529a

Function at 0x550a9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, 2
jmp 0x5515e5
cmp ebx, 1
pushfd
lea esp, [esp + 8]
je 0x551242
jp 0x5627b2
test ax, dx
cmp ebx, 2
call 0x55ddbe
js 0x550abf
cmc
sahf
adc al, 2
add ah, byte [esi + eax*8]
add al, byte [edx]
and al, 0xc6
inc eax
or ch, byte [esi + 0x5e6ca278]
nop
push edx
and al, 0xb0
mov edi, 0x8d15d233
add dword [bp + di], 0x9b7959bf
xor eax, 0x48bb544f
aas
xchg ebp, eax
scasd eax, dword es:[edi]
jmp 0x550ae9
invalid
pushfd
lea esp, [esp + 4]
je 0x5a39f8
cmp ax, bx
cmp ebx, 3
pushfd
lea esp, [esp + 4]
je 0x54c9ed
pushfd
pushal
pushal
mov word [esp + 8], bx
lea esp, [esp + 0x44]
jmp 0x570006
jmp 0x54c3b9

Function at 0x55bfa4
Capabilities:
Execute anti-debugging instructions

Disassembly:
and ebx, 0xfff
cmp sp, dx
jmp 0x56fffe
pushal
clc
add dword [ebx + edi], edx
add esp, 0x28

Function at 0x55d147
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x3c], 0x5708ee
push dword [esp]
pushfd
call fcn.00551564

Function at 0x55d158
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x10], bh
lea esp, [esp + 0x30]
je 0x551242
clc
bt esi, edi
pushal
test bh, bh
cmp ebx, 2
push dword [esp + 4]
jmp 0x55e1ca
rol bl, cl
bsf bx, cx
clc
mov bx, word [esi]
call fcn.0055edef
enter 0xffffffffffffa774, 0x14
add ch, bh
inc ecx
wait
mov ch, 0x57
add ebx, ecx
std
outsd dx, dword [esi]
test eax, 0xd0e67c2a
cld
retf
mov bx, 0x7728
add dword [ebp - 4], ecx
stc
shr bl, cl
dec di
adc edi, 0x562a99ce
sub ecx, 8
cmc
pushfd
shr bx, 2
bsf bx, bx
shr ecx, 1
pushal
mov edi, dword [esi]
neg bh
test bh, bl
add edi, dword [ebp + 0x10]
bswap bx
movsx bx, al
add esi, 8
inc bl
movsx bx, dl
and bl, 0x61
mov bx, word [esi]
push dword [esp + 4]
test cx, dx
shr ebx, 0xc
clc
stc
test ch, 0xe4
cmp ebx, 1
pushfd
jmp 0x54d359
mov byte [esp], 0x5d
lea esp, [esp + 0x24]
je 0x5a39f8
call fcn.005702f0
clc
test bl, ah
call fcn.00562136
sar bh, 1
pushal
mov bx, word [esi]
test bh, dh
stc
and ebx, 0xfff
stc
add word [ebx + edi], dx
push dword [esp + 4]
push esi
lea esp, [esp + 0x28]
jmp 0x570006

Function at 0x55edef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], 0xfd9f
and ebx, 0xfff
pushal
clc
add word [ebx + edi], ax
push edi
lea esp, [esp + 0x28]
jmp 0x570006
Function at 0x562136
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
lea esp, [esp + 0x24]
jne 0x562df5
or cl, al
lea ecx, [esi - 0x37ebe9b0]
or ch, 0xa8
mov ecx, dword [ebp - 4]
test dh, 5
cmc
cmp dword [ebp + 0x14], ecx
pushfd
pushal
lea esp, [esp + 0x24]
ja 0x562da6
mov esi, 0xe9fa577a
pushal
call fcn.005a3e89
add byte [eax], al
dec edi
insb byte es:[edi], dx
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x69], 0x6c616974
imul edi, dword [edx + 0x65], 0xe99dcc00
inc edx
add word [eax], ax
bsr bx, sp
bsf ebx, eax
mov ebx, eax
pushfd
push dword [esp]
call fcn.0054d959
add esi, 2
pushal
dec ecx
lea esp, [esp + 0x24]
jp 0x54d496
pushal
push ebp
lea esp, [esp + 0x24]
jne 0x562df5
not ch
pushal
mov ecx, dword [ebp - 4]
call fcn.0055b82a
pop ds
sub cl, dh
mov ch, 0x15
add ch, byte [ecx]
fstp xword [0x75431907]
cmpsd dword [esi], dword es:[edi]
push ecx
or ecx, dword [ebx + 0x42]
mov al, byte [0x6321a720]
stc
sbb byte [esi], dh
cmp al, 0x94
inc edi
enter 0xffffffffffffcb7e, 0x51
mov word [edx + 0x11], gs
cwde
cmpsb byte [esi], byte es:[edi]
pushal
sbb ch, ah
sub eax, 0xaabb536f
sub al, 7
adc byte [edi - 0x6882d420], dh
and ah, byte [edi + 0x3d86ffbd]
lodsb al, byte [esi]
push 0x6a
mov esp, 0x69694f8e
invalid
ror ecx, cl
bsr ecx, ebp
or cl, ch
mov ecx, dword [esi + 4]
cmp ah, 0xe9
stc
stc
clc
or ecx, ecx
pushfd
lea esp, [esp + 4]
je 0x54fa48
btr di, 4
add dword [ebp - 4], ecx
sub di, 0xeea4
rcl bl, 4
sub ecx, 8
and bx, bx
shr ecx, 1
stc
bsr di, bx
setae bh
bsr bx, bp
mov edi, dword [esi]
xor bl, 0xc1
add edi, dword [ebp + 0x10]
and bl, 0xe2
add esi, 8
not bl
bt esi, edx
inc bx
mov bx, word [esi]
jmp 0x5a484e
mov byte [0x106fa6d4], al
push ebx
pop esp
cld
mov bh, 0x27
fnsave dword [eax + 0x20]
sbb edx, dword [esi + ebp*4 + 0x17739ddb]
pop ss
loop 0x5a4865
invalid
cmc
shr ebx, 0xc
cmc
call fcn.00550a9b
sub esi, esi
add bl, ch
sbb dword [edx], eax
cmc
pop ds
mov dword [ebx + 0x65], ebx
dec edi
test eax, 0x79ff7d9b
wait
wait
jge 0x5a4867
invalid
jns 0x5a4805
dec ebp
aas
push ebp
sbb byte [ecx - 0x627e64ed], dh
sbb ebx, dword [eax + ebx*4 - 0x4eff21c8]
aas
pop esp
je 0x5a4819
and al, 0xc
invalid

Function at 0x56f9e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
test edi, 0xc67b0801
jmp 0x5a5143
add esp, 4
jae 0x54ef0a
add ecx, 0xffffffff
push edi
lea esp, [esp + 4]
je 0x551c12
pushfd
mov byte [esp], 0x4b
push 0x79c50b9f
test di, 0xc517
add edx, 0x11c
mov word [esp + 4], bx
push 0x86798728
mov word [esp + 4], 0xef85
mov byte [esp], 0x3d
lea esp, [esp + 0xc]
jmp 0x55c1fd
pushal
add ecx, 0xffffffff
call fcn.0056002b
mov dword [esp + 0x1c], 0x5a001f0e
push 0xe078501
push 0x252f7e39
call fcn.0054e805

Function at 0x57000e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
mov dword [esp + 0x24], 0x5d15e15e
push edi
push esi
pushfd
lea esp, [esp + 0x30]
jmp 0x5a5de7
mov dword [esp], 0x57009c02
pushal
jmp 0x54fb14
call fcn.005a5e56
Function at 0x5719cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005500c9
jp 0x55d523
in al, dx
push 0xa9770215
dec ebx
pop ebp
daa
and dword [ebx - 0x6df75113], eax
add al, 0x6e
sbb byte [esp + ebx*8 - 0x62], bh
invalid
sar dword [edi + 0x46], cl
sbb eax, 0xd5521040
call 0x52c544a4
xlatb
ret
lea esp, [esp + 0x38]
jne 0x54d5df
pushal
push dword [esp + 8]
jmp 0x5a5123
clc
not al
cmc
pushal
mov byte [ecx], al
cmc
add ecx, 1
pushfd
test ah, ah
pushfd
jmp 0x55e20c
push esp
mov dword [esp + 0x24], edi
pushfd
jmp 0x55d4cc

Function at 0x5a30a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xb9
mov dword [esp + 0x20], 0x4002ffeb
pushfd
pushal
mov word [esp + 0xc], 0x681f
mov byte [esp + 4], ah
lea esp, [esp + 0x44]
jmp 0x5a55c8
call fcn.005a6901

Function at 0x5a3d62
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebp, 0xabe672f1
or eax, eax
pushfd
jmp 0x562500
pushfd
xchg dword [esp + 0x10], eax
cwde
pop eax
push dword [ebp - 4]
pop dword [esp + 8]
call fcn.005a35c2
jmp 0x4fe123

Function at 0x5a510a
Capabilities:
Execute anti-debugging instructions

Disassembly:
shrd edi, edi, 0x19
movzx di, cl
mov edi, ebx
adc al, 0x21
stc
mov al, 0x2e
call fcn.00552702
call fcn.005a3238

Function at 0x5a513e
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc esi
push ebp
inc edi
pushal
lea esp, [esp + 0x28]
jmp fcn.00551598
jmp 0x54d059

Function at 0x5a5163
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], ebp
pushfd
lea esp, [esp + 0x2c]
jmp fcn.005a7827

Function at 0x5a51bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
jg 0x5a6b9a
push eax
push edi
pushal
mov byte [esp], 0x51
call fcn.005a77bb
call fcn.005a5fcd

Function at 0x5a527b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt ebx, edx
add ebp, 2
pushfd
mov byte [esp + 4], dl
push dword [esp]
jmp 0x5a7033

Function at 0x5a5337
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x14], bl
pushfd
mov dword [ebp], edx
push 0x62e130ff
push ecx
push dword [esp + 4]
lea esp, [esp + 0x38]
jmp fcn.005a653d

Function at 0x5a537c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
not al
bt ax, dx
clc
cmc
xor bl, al
cmp ah, al
cbw
mov byte [esp], cl
cwde
mov word [esp], bp
test dl, 0x74
push dword [esp]
mov byte [esp + 0xc], ah
sub ebp, 4
jmp 0x5a6d3c
pushfd
mov byte [esp], dl
mov dword [ebp], eax
pushfd
lea esp, [esp + 0x4c]
jmp fcn.005a653d

Function at 0x5a5468
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5a5b98
mov dword [esp + 0x38], ebp
push 0xbb8de226
pushfd
lea esp, [esp + 0x40]
jmp fcn.005a7827

Function at 0x5a54a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x50], ebp
mov byte [esp + 0x18], 0x58
mov word [esp], 0x904e
mov byte [esp], 8
mov dword [esp], edi
lea esp, [esp + 0x50]
jmp fcn.005a7827
Function at 0x5a5530
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ebp
mov byte [esp], 0xf
pushfd
mov byte [esp], 0x4d
mov byte [esp], dh
lea esp, [esp + 8]
jmp fcn.005a7827

Function at 0x5a554e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
jmp 0x5a6458

Function at 0x5a5597
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp + 4], eax
mov byte [esp + 4], bh
pushal
push dword [esp + 4]
pushfd
pop dword [esp + 0x2c]
mov word [esp], bp
mov byte [esp + 4], 0x89
jmp 0x5a5b79
push dword [esp + 0x2c]
pop dword [ebp]
pushfd
pushfd
lea esp, [esp + 0x38]
jmp fcn.005a789b

Function at 0x5a55cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [ebp], edx
mov dword [esp], ecx
mov byte [esp + 8], 0xd9
push dword [esp + 0x10]
lea esp, [esp + 0x3c]
jne 0x5a5a26
cmp eax, ebx
clc
mov ebx, eax
call fcn.005a59f2
jmp 0x5a66c4
movsx dx, cl
add bl, al
lea edx, [eax - 0xb299185]
shld edx, eax, cl
pop edx
push 0x7d34fda
movzx eax, al
inc edx
push ecx
mov edx, dword [eax*4 + 0x5a5ffd]
stc
pushfd
test dh, bl
not edx
call fcn.005a5563
bswap dx
mov edi, esp
rol edx, 1
mov ebx, esi
push 0x1bf11b13
shl al, cl
sub al, 0x88
add esi, dword [ebp]
or al, 0xe0
inc al
rol al, 5
sub dh, 0x11
mov al, byte [esi]
and dx, 0xea72
add al, bl
clc
xor al, 0x62
cmp bl, 0xd3
xor dh, 0xf1
bswap dx
clc
add al, 0xb0
movsx dx, cl
not al
inc dh
mov word [esp], 0x544d
movzx dx, dl
movzx dx, cl
inc esi
jmp 0x5a5c37

Function at 0x5a5744
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pop dword [esp + 0x40]
jmp 0x5a6676
push dword [esp + 0x40]
pop dword [ebp]
push 0x3c520122
pushfd
push dword [esp]
mov byte [esp], bl
lea esp, [esp + 0x50]
jmp fcn.005a653d

Function at 0x5a57c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
push dword [esp + 0x48]
pop dword [ebp]
pushfd
mov byte [esp], 0xcf
mov byte [esp], dh
lea esp, [esp + 0x50]
jmp fcn.005a653d

Function at 0x5a57dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt sp, 0xb
xor bl, al
push 0xd6aa6b1e
cmp al, bl
bt sp, cx
cmc
mov al, byte [eax + edi]
jmp 0x5a7372
mov word [esp + 4], bx
sub ebp, 2
pushfd
lea esi, [esi + 1]
call fcn.005a5f34
rol dl, cl
ror al, cl
pushal
pushal
mov al, byte [esi]
push 0xbbe9299f
xor al, bl
and dl, 0x5d
xor al, 0x60
bswap dx
ror dl, cl
stc
rol al, 1
jmp 0x5a59d4

Function at 0x5a5841
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi + 2]
mov byte [esp], dl
lea esp, [esp + 0x50]
jmp fcn.005a653d

Function at 0x5a58cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5a763c
push dword [esp + 0x24]
pop dword [ebp]
mov dword [esp + 8], esp
mov byte [esp + 0x10], bl
lea esp, [esp + 0x28]
jmp fcn.005a789b
pushfd
pop dword [esp + 0x24]
jmp 0x5a6fdc
Function at 0x5a58d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt ax, 0xe
xor al, 0x7a
setne dh
bt bp, bx
push ecx
ror al, 4
shrd dx, dx, cl
sal dl, cl
ror dx, cl
xor bl, al
sal dx, 0xf
rcr dh, 6
pushfd
cmc
mov dx, word [ebp]
mov byte [esp + 4], dh
add ebp, 2
mov dword [esp], 0xbc2943cd
push dword [esp]
push dword [esp]
mov byte [eax + edi], dl
pushfd
mov byte [esp + 0xc], ah
lea esp, [esp + 0x40]
jmp fcn.005a789b

Function at 0x5a5980
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 8], bh
rep movsb byte es:[edi], byte [esi]
ror si, cl
bswap si
btr si, 0xf
mov edi, dword [esp + 0x30]
neg esi
movzx si, al
bsr si, ax
mov esi, dword [esp + 0x34]
bt ax, 4
mov word [esp + 4], bx
clc
jmp 0x5a756c
push dword [esp + 0x38]
popfd
push esp
pushfd
lea esp, [esp + 0x44]
jmp fcn.005a789b

Function at 0x5a59f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 4]
mov byte [esp], dl
push ecx
push 0xda6f4776
mov byte [esp], 0xe
lea esp, [esp + 0x10]
jmp fcn.005a653d
sub esp, 0xfffffffc
jp 0x5a742f
and ebx, 0xff0
bt di, bp
cmp ebx, 0xfe0
push 0x4328bfb3
lea esp, [esp + 4]
jne 0x5a5a26
shl bh, 1
mov bh, ah
bsr bx, bx
xor byte [ebp + 0xc], 0x20
bswap bx
movzx ebx, bl
movzx ebx, al
pop ebx
push edi
pushfd
push dword [esp + 4]
pushal
lea esp, [esp + 0x2c]
jmp fcn.005a653d
pushfd
and ebx, 0xff0
pushal
push 0xc57a899
cmc
cmp ebx, 0xfe0
mov byte [esp + 8], 0xff
lea esp, [esp + 0x28]
jne 0x5a5a26
neg bl
neg bl
test eax, ecx
shr bh, 6
xor byte [ebp + 0xc], 0x20
bswap bx
pushfd
jmp 0x5a5261

Function at 0x5a5a55
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x44]
pop dword [ebp]
mov byte [esp], dh
lea esp, [esp + 0x48]
jmp fcn.005a653d

Function at 0x5a5a83
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x48], edi
jmp 0x5a6c40
mov dword [esp + 0x4c], edx
jmp 0x5a5878
push dword [esp + 4]
jmp 0x5a654e

Function at 0x5a5a8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5a5c94
mov byte [esp + 4], 0x69
lea esp, [esp + 0x14]
jl 0x5a528e
mov word [ebp], ax
pushal
pushfd
push edx
pushfd
lea esp, [esp + 0x2c]
jmp fcn.005a789b
mov word [ebp], ax
push 0xe3674db6
lea esp, [esp + 4]
jmp fcn.005a789b

Function at 0x5a5b53
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
mov dword [esp + 0xc], edi
push dword [esp + 0x40]
pop dword [ebp]
mov byte [esp], bh
push eax
lea esp, [esp + 0x48]
jmp fcn.005a789b
pushfd
pop dword [esp + 0x3c]
mov dword [esp], edx
jmp 0x5a5a68

Function at 0x5a5bf6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [ebp + 4], ax
call fcn.005a68fc
jmp 0x5a54a0

Function at 0x5a5db7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x10]
pop dword [ebp]
mov byte [esp], bl
pushal
mov word [esp], dx
push 0x3affe804
lea esp, [esp + 0x38]
jmp fcn.005a653d

Function at 0x5a5dd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x2e
mov dword [esp + 0x38], eax
jmp 0x5a69e6
Function at 0x5a5e56
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
mov dword [esp + 0x20], esi
pushal
jmp 0x5a5f94
mov dword [esp + 4], eax
mov byte [esp], ch
pushal
jmp 0x5a5254
push 0x9481c73e
mov dword [esp + 4], ebx
jmp 0x5a5f6e
pushfd
pushfd
pushfd
pop dword [esp + 8]
pushfd
mov dword [esp + 8], edx
push 0x42423d7f
mov dword [esp + 8], edi
jmp 0x5a5d2f
mov dword [esp + 0x3c], ebp
pushfd
lea esp, [esp + 0x40]
jmp fcn.005a7827

Function at 0x5a5e69
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [ebp], eax
mov byte [esp], cl
lea esp, [esp + 0x28]
jmp fcn.005a653d

Function at 0x5a5f11
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x14], edi
mov byte [esp + 4], 0xa4
pushal
call fcn.005a51bd
mov dword [esp + 0x18], edx
jmp 0x5a5459

Function at 0x5a5fa2
Capabilities:
Execute anti-debugging instructions

Disassembly:
div cx
jmp 0x5a774f
push 0xb3c3055f
mov word [ebp + 6], ax
pushfd
pushfd
pop dword [esp + 0x1c]
pushfd
pushal
call fcn.005a5a55
mov byte [esp], 0x23
mov byte [esp + 8], 0xc1
mov byte [esp], 0xf9
mov word [ebp + 4], dx
jmp 0x5a7626

Function at 0x5a5fcd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x76b4c3e5
jmp 0x5a5f39
mov dword [esp + 0x24], ebp
mov word [esp], di
pushfd
push esi
pushfd
lea esp, [esp + 0x30]
jmp fcn.005a7827
mov dword [esp], eax
pushfd
mov byte [esp], bl
pushal
lea esp, [esp + 0x24]
jb 0x5a7602
push esi
pushfd
pushal
mov dword [esp + 0x20], ebp
mov byte [esp], bh
mov word [esp + 4], si
pushal
lea esp, [esp + 0x40]
jmp fcn.005a7827
pushal
pushfd
mov dword [esp + 0x20], esi
pushfd
jmp 0x5a5cef

Function at 0x5a6434
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [ebp], ax
mov byte [esp + 4], dl
mov dword [esp + 8], 0xab02ffa8
pushfd
lea esp, [esp + 0x2c]
jmp fcn.005a653d

Function at 0x5a64ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [eax + edi], dx
mov byte [esp], 0xe9
mov byte [esp + 8], 0x57
push 0x4d510859
mov byte [esp + 0xc], 0xda
lea esp, [esp + 0x10]
jmp fcn.005a789b

Function at 0x5a6518
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5a548b
mov dword [esp + 0x24], ebp
pushfd
pushfd
pushfd
push 0xd890000b
lea esp, [esp + 0x34]
jmp fcn.005a7827
mov dword [esp + 4], 0x53ac303e
mov dword [esp + 0x28], eax
jmp 0x5a766e
pushfd
mov dword [esp + 0x28], esi
jmp 0x5a52ff

Function at 0x5a6560
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
push dword [esp + 0x30]
pop dword [ebp]
pushfd
mov word [esp], cx
lea esp, [esp + 0x38]
jmp fcn.005a653d

Function at 0x5a6692
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x36
mov dword [esp + 0x28], esi
pushfd
mov dword [esp + 0x28], ebp
pushfd
pushfd
lea esp, [esp + 0x30]
jmp fcn.005a7827

Function at 0x5a67d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jbe 0x5a5e82
mov word [ebp], ax
pushfd
push dword [esp]
push eax
lea esp, [esp + 0xc]
jmp fcn.005a653d
Function at 0x5a6815
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xd4
pushfd
push dword [esp + 0x28]
pop dword [ebp]
push eax
push edx
lea esp, [esp + 0x34]
jmp fcn.005a653d

Function at 0x5a68fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp], 0x46
pushfd
pop dword [esp + 8]
push 0xef5f7837
call fcn.005a5db7
lea esp, [esp + 0x30]
jno 0x5a720a
pushal
pushfd
pop dword [esp + 0x1c]
push 0xf9c169fc
pushfd
push dword [esp + 0x24]
pop dword [ebp]
mov byte [esp + 4], 0xbb
lea esp, [esp + 0x28]
jmp fcn.005a653d
jmp 0x5a6577
pushfd
mov byte [esp], ch
pushfd
pop dword [esp]
pushal
call fcn.005a6815

Function at 0x5a6901
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
pushal
call 0x5a690a
push 0x2229533b
pushfd
pushfd
pop dword [esp + 0x28]
push eax
mov dword [esp + 0x28], edx
pushfd
mov word [esp], di
pushfd
push esp
mov dword [esp + 0x30], edi
push 0x1fb39214
push eax
call fcn.005a5dd4
neg al
cmp cl, 0xd7
and al, 0x3c
shr dh, cl
pushal
dec dx
mov edx, dword [eax + edi]
test dl, dh
cmp eax, 0xcf4292cb
stc
sub ebp, 4
call fcn.005a5337

Function at 0x5a6b3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], edi
pushal
mov dword [esp + 0x40], eax
push 0xdfff2fba
mov dword [esp + 0x40], esi
push 0x3c1730ac
mov dword [esp + 4], ebx
mov dword [esp + 0x40], ebp
push 0xa611c886
push 0x141d2e58
mov byte [esp + 8], 0x8b
push dword [esp + 0xc]
lea esp, [esp + 0x4c]
jmp fcn.005a7827

Function at 0x5a6d0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x34], ebp
pushfd
mov byte [esp + 4], 0xee
push dword [esp]
lea esp, [esp + 0x3c]
jmp fcn.005a7827

Function at 0x5a6da6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jge 0x5a755c
push ebp
pushal
push 0x1a7316ae
push dword [esp + 8]
lea esp, [esp + 0x28]
jmp fcn.005a7827
call fcn.005a6e03
cmc
add ebp, 2
cmp al, 0xf5
call fcn.005a76b0

Function at 0x5a6e03
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
pushal
mov word [esp], 0x46c0
lea esp, [esp + 0x20]
jmp fcn.005a7827

Function at 0x5a6fa6
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
test cx, 0x70d7
push eax
bt sp, cx
shr al, cl
call fcn.005a6ff9
cmc
add bx, ax
cmc
cmp bh, al
cwde
call fcn.005a5d16
cmc
test bh, 0x93
sub esp, 0xffffffbc
jb 0x5a53a5
shr al, cl
call fcn.005a5bf6

Function at 0x5a6fba
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x38], ebp
pushfd
mov dword [esp + 4], ecx
pushfd
pushfd
lea esp, [esp + 0x44]
jmp fcn.005a7827
jmp 0x5a6802
push esi
jmp 0x5a7314
pushfd
call fcn.005a55cd
mov word [esp], bp
mov dword [esp + 0x24], eax
lea esp, [esp + 0x24]
jbe 0x5a648f
pushal
mov dword [esp + 0x1c], esi
jmp 0x5a5cf9
call fcn.005a6887

Function at 0x5a71be
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [ebp]
pushal
push dword [esp + 0xc]
push esp
lea esp, [esp + 0x30]
jmp fcn.005a653d
Function at 0x5a7218
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005a5757
pushfd
lea esp, [esp + 0x2c]
ja fcn.005a789b
bswap ax
add dl, 0xd8
mov edx, esp
add ecx, ebp
cmc
lea ecx, [edi + 0x40]
test dl, dl
bsr di, ax
bsr ax, cx
sub ecx, edx
call fcn.005a5faa
setne ah
or dl, 0x41
mov eax, dword [ebp]
mov dl, ah
mov dl, byte [ebp + 4]
clc
push 0x13c454e9
pushfd
call fcn.005a682d
mov dword [ebp + 4], eax
jmp 0x5a5377

Function at 0x5a7280
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x14]
pop dword [ebp]
pushfd
lea esp, [esp + 0x1c]
jmp fcn.005a653d

Function at 0x5a72ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005a71be
call fcn.005a6560
pushfd
pop dword [esp + 0x40]
call fcn.005a57c0
pushfd
jmp 0x5a6dfe

Function at 0x5a7364
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 0x44], esi
push dword [esp + 4]
mov dword [esp + 0x44], ebp
mov byte [esp + 4], dl
lea esp, [esp + 0x44]
jmp fcn.005a7827
pushfd
mov dword [esp + 0x40], edi
push dword [esp]
mov byte [esp], 0x8a
mov word [esp + 4], 0x2bf0
pushfd
mov dword [esp + 0x44], eax
mov byte [esp], 0xa0
mov al, byte [0xffffc5e9]
invalid
jmp 0x5a6a77
mov dword [esp + 0x40], edx
mov byte [esp + 8], 0x69
jmp 0x5a6c49

Function at 0x5a7518
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005a5980
mov edi, eax
std
pushal
pushfd
cld
cld
jmp 0x5a52fa

Function at 0x5a752b
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ch, 0xde
call fcn.005a527b
cwde
movzx ax, al
mov eax, dword [ebp]
pushfd
pushal
mov eax, dword fs:[eax]
pushal
pushfd
pushfd
mov dword [ebp], eax
pushfd
mov word [esp], di
mov byte [esp], 0x4f
lea esp, [esp + 0x50]
jmp fcn.005a789b
cmp edx, 0x9677a7fd
mov dx, word [ebp]
stc
push dword [esp]
cmc
add esp, 0x4c
jno 0x5a6dd1
add ebp, 2
pushfd
inc esi
call fcn.005a5700

Function at 0x5a75a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x4c], ebp
mov byte [esp], 6
lea esp, [esp + 0x4c]
jmp fcn.005a7827

Function at 0x5a75d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec al
pushfd
xor al, 0x7a
bt ax, 6
ror al, 4
call fcn.005a57dc
bt edi, 0xc
clc
xor al, bl
jmp 0x5a6e8c

Function at 0x5a76b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
shrd eax, edx, cl
mov dword [esp], edx
mov dword [ebp + 4], eax
pushfd
pushfd
pop dword [esp + 4]
pushal
push dword [esp + 0x24]
pop dword [ebp]
pushfd
mov byte [esp], 0xd3
pushfd
lea esp, [esp + 0x30]
jmp fcn.005a789b

Function at 0x5a7726
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005a6518
clc
sub ebp, 2
call fcn.005a6fa6
mov dword [esp + 0x38], esi
push ecx
mov dword [esp + 0x38], ebp
mov word [esp], 0x5427
pushfd
pushfd
pushfd
lea esp, [esp + 0x44]
jmp fcn.005a7827

Function at 0x5a77bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], esi
push 0x6d27dad8
push dword [esp]
mov dword [esp + 0x28], ebp
mov byte [esp + 4], 0x69
push 0x1b6ce3fe
push 0xba3705f3
mov word [esp], ax
lea esp, [esp + 0x30]
jmp fcn.005a7827