joyce8/EMBER2024-capa huggingface dataset:
Function at 0x936452
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [edi], ax
or dl, dh
mov eax, 0xc80f048f
lea ecx, [eax + 0x32217b30]
sbb esi, 4
xadd cx, dx
jle 0x8985af
mov edx, dword [esi]
bswap ecx
lea eax, [eax + ecx*2 + 0x2e96b028]
xor edx, ebx
lea ecx, [eax + ecx*8 - 0x22d87bfa]
inc cx
sub edx, 0x760616b2
dec ecx
shl eax, cl
sar eax, cl
xor edx, 0xf1242432
bt cx, cx
bswap edx
adc cx, cx
sal ax, 0xa1
lea edx, [edx + ecx - 0xc434e7d]
not edx
xchg al, cl
adc ecx, 0xcfa50a0d
adc ax, 0xea3b
xor ebx, edx
call fcn.009c7c74
dec cx
sal ecx, 0x7f
xor bl, dl
mov dword [esp + ecx*2], 0xf2283689
sar ecx, 0xb4
add ecx, ecx
lea edx, [esp + edx + 4]
shl ecx, 0x55
mov byte [ecx + edx], al
jb 0x9418d2
mov edx, dword [ecx + esi]
sar dword [esp + ecx*2], 0x99
lea esi, [esi + ecx*8 + 4]
btc cx, 0x27
xor edx, ebx
lea eax, [ecx*4 + 0x12a91a9a]
rol edx, 3
ror ax, 0xae
xadd ecx, eax
jp 0x84698a
movsx eax, dl
add esi, ecx
shl ax, 0xe6
btc dx, 2
jae fcn.00880f1a
shl ecx, 0x22
neg al
bts edx, edx
shr cl, 0x42
btr edx, ecx
add al, dl
imul dx, cx
not al
xchg dl, cl
xchg dh, dl
sub ecx, 0xa3bdcb27
ror al, 1
xor edx, edx
xor bl, al
push edx
shl dword [esp + ecx - 0x5c420c9f], 0xae
cmovns edx, ecx
lea edi, [edi + edx - 0x5c420ca1]
mov word [ecx + edi - 0x5c420c9f], ax
inc ecx
jl 0x93b2eb
imul edx, ecx
lea ebp, [ebp + ecx - 0x5c420ca4]
xadd edx, ecx
mov edx, dword [ebp + ecx*2 - 0x4dbaaec0]
movsx eax, word [esp + ecx*2 - 0x4dbaaec0]
sbb ecx, ecx
inc ecx
xor edx, ebx
lea ecx, [ecx*8 + 0x2ae7f0b]
xor ax, cx
adc dword [esp + ecx*2 - 0x55cfe26], ecx
bswap edx
bswap eax
js 0x96b46a
sbb ax, 0x78c
lea edx, [edx + eax*2 + 0x66027118]
ror eax, 0x2c
adc eax, eax
rol byte [esp + ecx*8 - 0x1573f898], 0x87
push ecx
xor edx, ebx
btr eax, eax
lea edx, [edx + ecx + 0x3790df8d]
bswap edx
neg dword [esp + eax - 0xe2ea]
lea eax, [eax*8 + 0x4c154334]
dec edx
bt eax, 0x1b
ror edx, 2
xor ebx, edx
ror cx, 0xa8
shl dword [esp + eax - 0x4c1c5a84], cl
shr word [esp + eax - 0x4c1c5a84], cl
lea edi, [edi + eax - 0x4c1c5a88]
mov dword [edi + eax - 0x4c1c5a84], edx
or eax, dword [esp + eax - 0x4c1c5a84]
mov eax, dword [esi + eax - 0x5f5f5b8c]
xor word [esp + 1], cx
mov dword [esp], ecx
adc esi, 4
neg cl
mov edx, 0xf005a68d
xor eax, ebx
sub dx, 0xd20c
pop edx
dec dx
xor eax, 0x14a10d17
rol ecx, 0x3a
neg edx
shl edx, 0x7e
bswap eax
rol ecx, 0xcd
call fcn.00933453
sar eax, cl
mov ecx, dword [ebp + eax - 1]
lea ebp, [ebp + eax*4]
movzx edx, ax
rol dx, 0x2e
push eax
xor ecx, ebx
bt ax, 6
jb 0x8e843b
inc dword [esp + eax - 1]
neg ecx
bswap ecx
not ecx
btc ax, ax
dec ecx
cwde
push edx
ror ecx, 1
add dword [esp + eax*4 - 8], 0x2115db1a
and dx, dx
dec dx
xor ecx, 0xb1370802
mul dl
dec eax
mul dword [esp + eax*2 - 0x5f7]
xor ebx, ecx
sar dx, 0x8a
adc esi, ecx
mov dword [esp + edx*2], esi
ret 4
Function at 0x9364b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax*2 - 0x18f09bd7]
mov dword [ebp + ecx - 0x80000000], edx
jbe 0x88de56
mov bp, word [ebp + edx*2 - 0xaafb80e]
movzx ecx, ax
cmove cx, dx
pop edx
pop ecx
pop ecx
jbe fcn.008f8cf2
mov eax, 0xff8baa0d
movzx edx, ax
sub ax, ax
lea esi, [edx + esi - 0xaa11]
sbb edx, 0xc82f5696
mov ecx, dword [esi + edx*2 - 0x6fa2a6ee]
cbw
sub edx, edx
xor ecx, ebx
sar eax, 0xcf
cmovs eax, edx
xchg edx, eax
rol ecx, 2
lea ecx, [ecx + eax + 0x36822aaf]
mul eax
xadd eax, edx
rol ecx, 1
shl edx, 0xd8
push eax
dec ecx
imul dx
or byte [esp + eax*2], al
setbe byte [esp + eax]
neg ecx
pop edx
xadd al, ah
inc eax
xor ebx, ecx
sar dl, 0xc3
bt edx, edx
push eax
adc edi, ecx
movsx ecx, ax
lea esi, [esi + eax*8 - 0xc]
pop edx
mov edx, dword [eax + esi - 1]
btr ecx, 0x92
xor edx, ebx
dec ecx
and eax, 0x799f423e
sbb edx, 0xcd0ea81c
not eax
xor edx, 0x521390b7
bswap edx
push eax
sub edx, eax
pop eax
or ecx, ecx
cbw
bswap edx
xor ebx, edx
xchg cx, ax
shr eax, cl
sal ecx, cl
lea ebp, [ebp + eax*2 - 6]
jne 0x91bea8
mov ecx, 0x222f82be
movsx edx, cx
mov ecx, dword [esi + ecx - 0x222f82be]
add esi, 4
xor ecx, ebx
neg ecx
call fcn.008cfedd
call fcn.0093b365

Function at 0x9393de
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esp + edx + 8]
je 0x852e5b
call fcn.0092876a
mov ecx, 0xf93b933f
lea eax, [ecx*4 + 0x1f24d197]
movzx eax, byte [eax + esi - 0x4131e93]
mov edx, 0xe51ad7b9
add esi, 1
call fcn.0086cf5f
neg dx
not dx
ror eax, 2
shr cl, 0x65
inc dl
adc cl, cl
xor eax, 0xae2e28af
add cx, cx
shl cx, 0x81
xor ebx, eax
inc cl
add ebp, eax
shl edx, cl
sbb edi, 3
mov eax, dword [edi]
inc dl
shr ecx, cl
sar ecx, cl
xor eax, ebx
rol ecx, 0xfc
neg eax
neg cl
btr edx, 0xa9
inc eax
jmp 0x8cc9bc
and edx, dword [esp + eax*2 - 0x3f1f880c]
lea ecx, [ecx + eax + 0x67f9a07c]
bts eax, eax
jb 0x921d3b
inc eax
not ecx
dec dx
dec ecx
rol ecx, 1
sub ecx, 0xde1375bf
or eax, 0x5d0b16bc
or al, ah
ror ecx, 1
sar edx, 0xf5
xor ebx, ecx
add edi, ecx
mov eax, dword [ebp + eax - 0x5f8fd7ff]
mov dword [esp + edx*4 - 0x3f0], 0x438f9888
shr dx, 0x25
shl dword [esp + edx - 3], 0xe1
mov edx, dword [edx + ebp - 3]
mov cl, byte [ebp + 8]
jg 0x8caf01

Function at 0x93ac6b
Capabilities:
Encode data using base64

Disassembly:
sal al, 0x26
add ebp, edx
jmp ebp
mov ecx, dword [esi + edx*2 - 0x43fe]
dec dl
lea esi, [edx + esi - 0x21fa]
call fcn.009aa06c
mov edx, 0x72015d21
ror edx, 0x9a
mov dx, word [ebp]
mov eax, 0x2e374e13
neg eax
mov cx, word [ebp + 2]
bt eax, eax
jae 0x8fc39b
adc ebp, 1
add dx, cx
movsx ecx, ax
add al, ch
mov word [ebp], dx
shr eax, cl
jne 0x9246ae
Function at 0x93cf30
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx dx, byte [ebp]
call fcn.008aee58
sub esi, 4
mov eax, 0xb4135a91
mov ecx, dword [esi]
xor ecx, ebx
dec ecx
rol ecx, 1
cwde
mov edx, eax
not ecx
lea edx, [edx + edx*2 + 0x49b7c9a3]
not al
rol ecx, 1
imul eax
xor ebx, ecx
call fcn.0087ee38
mov ecx, 0x548e2f8d
mov eax, ecx
mov edx, dword [ecx + esi - 0x548e2f8d]
call fcn.008eafea
sub esi, 4
mov ecx, 0xe2af2fb9
lea eax, [ecx + ecx*4 - 0x71738b5f]
movsx edx, ax
mov eax, dword [esi + edx*2 - 0xc67c]
or edx, edx
xor eax, ebx
call fcn.0091fcf1

Function at 0x93d745
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, byte [esi + edx*2 - 0x56296]
xor edx, edx
mov dword [esp + edx*2], 0xbd136ea7
je 0x97dfcf
xor cl, bl
sar edx, 0x9c
inc cl
and byte [esp + edx + 3], dl
xor cl, 0xb7
neg edx
rol cl, 1

Function at 0x941393
Capabilities:
Encode data using base64

Disassembly:
jae 0x86cb1c
adc edi, 5
sar al, 0xc6
rol eax, 0xe5
setbe al
mov byte [ecx + eax - 0x4bebff01], dl
js 0x94d3dc
ror edx, 3
mov dword [esp + ecx*2 - 0x5143c2b6], eax
add byte [esp + ecx*2 - 0x5143c2b6], 0xa6
dec edx
and dword [esp + ecx - 0x28a1e15b], 0xa039931b
bswap edx
xor ebx, edx
add ebp, edx
lea ecx, [eax + eax - 0x39f8264a]
sal dword [esp], cl
sal eax, 0xc1
mov ecx, dword [edi]
movzx edx, byte [esp]
add dl, byte [edx + edi + 4]
ror al, 0x82
jb 0x921a77

Function at 0x942850
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esi]
pop ecx
call fcn.00842c9d
mov dword [esp], 0xb998d33f
jmp 0x932c9b
Function at 0x944f55
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dl, 1
bts ax, 0x3a
xor al, ah
xor dl, 0xb6
call fcn.0086fea2
mov dword [esp + eax*2 - 0xb476b66], edi
ret
and edx, dword [esp + 0xd]
or edx, edx
lea edi, [edx + edi - 0x9039ec]
xchg word [esp + edx*2 - 0x12073d8], dx
lock xchg dword ss:[ecx + edx*4 - 0x243fffc], eax
mov dword [edi + edx - 0x90ffff], eax
mov ecx, 0x90095ea5
mov dword [esp + edx - 0x90ffff], ebp
ret 0x10
xor ebx, eax
push edx
add ebp, eax
not byte [esp + ecx*8 - 0x7ec]
push edx
mov ecx, dword [ecx + edi - 0xff]
lea eax, [edx*4 - 0x2e6cb87e]
mov eax, dword [edi + 4]
jmp 0x8e951f
jb 0x8fb1b7
rol edx, 1
or ecx, 0x1a2a7b28
bswap ecx
sub eax, eax
xor ebx, edx
add edi, edx
not eax
dec ecx
pop eax
pop edx
pop ecx
jne fcn.009338ec
mov eax, 0x9039f09b
dec al
movsx edx, ax
sub esi, 4
cdq
push edx
push eax
mov eax, dword [esi]
xor eax, ebx
push edx
movzx ecx, dl
shl dl, 0xa4
xor eax, 0x38b65e24
rol eax, 1
xor eax, 0xf2b4f22e
neg eax
btr edx, 0x95
bt ecx, 9
jae 0x9240eb
mov ecx, dword [ebp]
mov edx, 0x8ea2adb4
add ebp, 4
movsx eax, dl
bswap eax
xor ecx, ebx
not ecx
btr eax, eax
sal edx, 0xee
lea edx, [edx*8 - 0x68d13f72]
neg ecx
imul dx, dx
ror al, 0xc3
not ecx
bt dx, ax
sub edx, edx
sub edx, 0xab285808
rol ecx, 1
sal edx, 0x27
sal edx, 0x8a
not dl
xor ebx, ecx
shl dx, 0xef
add esi, ecx
mov cx, word [edx + edi - 0x4ff08000]
lea eax, [edx*4 - 0x48701776]
bt eax, 0x2a
lea edi, [edx + edi - 0x4ff07ffe]
movzx edx, byte [ebp + edx - 0x4ff08000]
adc al, 0x85
lea eax, [eax + eax*2 - 0x31cc2ace]
adc ebp, 0
rol eax, 0x87
xor dl, bl
inc ax
jl 0x89892f
mov ecx, 0x6b1ee880
movsx edx, cl
lea eax, [edx + ecx*8 - 0x4c4027d1]
mov eax, dword [ebp + ecx - 0x6b1ee880]
lea ebp, [ebp + ecx - 0x6b1ee87c]
inc ecx
shr cx, 0x49
xor eax, ebx
neg dx
not dl
push edx
dec eax
neg eax
sal edx, cl
lea eax, [ecx + eax + 0x7d19a741]
bswap eax
xor ebx, eax
pop edx
rol dx, 6
adc esi, eax
lea eax, [ecx*8 - 0x575827e]
rol al, 0xc3
mov eax, dword [ecx + edi - 0x6b1e0074]
push ecx
bswap edx
adc dx, 0x9821
mov cl, byte [edi + ecx - 0x6b1e0070]
setp dl
xor dl, 0x2c
push edx
adc edi, 2
neg byte [esp + 3]
shr eax, cl
movsx ecx, dl
call fcn.0099e997

Function at 0x9464fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edx
pop eax
jmp esi
cbw
pop eax
pop eax
pop ecx
pop ecx
pop ecx
jae fcn.009338ec
and eax, eax
xchg dx, ax
inc ecx
xchg edx, eax
shr al, 0xe1
xor ecx, 0xea0aac97
neg eax
bts eax, 0xa7
push eax
sbb ecx, 0xdc962284
idiv ax
neg ecx
xor ebx, ecx
cdq
and edx, edx
adc dx, dx
add esi, ecx
neg dword [esp]
jb 0x875c1a
Function at 0x947f99
Capabilities:
Execute anti-debugging instructions

Disassembly:
and byte [esp + eax*2 - 0xc], 0x82
mov dword [esp + eax - 8], eax
ror ecx, 2
mov dword [esp + edx - 0x77220406], eax
or word [esp + edx - 0x772203fe], dx
xor ecx, 0x13a232a8
cwd
lea ecx, [ecx + eax*4 - 0x2628442e]
sal word [esp + eax*2 - 0xd], 0xab
xor ebx, ecx
add edi, ecx
mul dl
inc dword [esp + edx - 0x7721fffd]
pop edx
pop eax
pop eax
jg fcn.009338ec
xchg esi, eax
mov eax, dword [0x9895643d]
scasd eax, dword es:[edi]
add byte [esi - 0x6b], ah
pop esp
out 0x89, al
push 0xffffffffffffffaf
arpl word [eax + eax*4], dx
test byte [edx + 0x6f], ch
sti
sub dword [edx - 0x3f], 0xffffff9d
pop edx
sbb al, 0x7e
xchg ebp, eax
and eax, 0x846a81df
fistp qword [ebp - 0x21926a82]
movsb byte es:[edi], byte [esi]
invalid

Function at 0x94a544
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [edi + eax*2 - 0x69757754]
sal eax, 0x90
mov eax, dword [edi + 4]
mov dword [esp], 0x1d8a5127
adc dword [esp], 0x6c0f64be
seta byte [esp]
imul ecx
mov ecx, dword [esp]
or byte [esp], cl
inc cl
mov dword [edi], edx
mov dword [edi + 4], eax
js 0x9c418f
dec byte [esp + 3]
mov eax, dword [esi]
movsx edx, cx
adc byte [esp + 1], cl
adc byte [esp + 1], dh
adc esi, 3
rol cx, 0xe
xor eax, ebx
ror eax, 1
not eax
inc dword [esp]
dec byte [esp + 1]
bswap eax
xor dl, dh
not ecx
dec eax
sar dword [esp + ecx - 0x766652bf], 0xa9
xor ebx, eax
and dl, 0x35
sub dword [esp + ecx - 0x766652bf], ecx
seta byte [esp + ecx - 0x766652bc]
adc ebp, eax
neg byte [esp + ecx - 0x766652bd]
jl 0x8dedc5
mov eax, 0x5104ff94
cdq
sal ax, 0xc4
mov eax, dword [edi + eax - 0x5104f940]
sub edx, edx
jge 0x9a4575
mov ecx, edi
sub edi, 4
mov dword [edi], ecx
mov edx, dword [esi]
push 0x3c3c8dbc
sar dword [esp], 0x8f
adc esi, 4
xor edx, ebx
xor edx, 0xa1bfc62c
sal dword [esp], 0x4f
ror edx, 2
push 0x3c2466bc
call fcn.0090b5de
ret 0xad16

Function at 0x94e9ae
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add byte [esp + 0xd], al
neg cl
rol al, 0x46
xadd al, ah
call fcn.008b0878
mov ecx, 0x2c1e5b8d
lea esi, [ecx + esi - 0x2c1e5b91]
mov eax, ecx
imul eax
mov eax, dword [esi + eax*8 - 0x6e4c5d48]
xadd dx, cx
jo 0x93cd48

Function at 0x953547
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ebx, ebx
sub bl, 1
call fcn.009278d3
Function at 0x954a21
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + ecx - 0x1e0]
pop ebx
jmp 0x89a45a
mov ebx, dword [esp + ebx - 0x7d3a861a]
lea esp, [esp + 0x18]
ret
mov dword [esp + ecx*8 - 0xf9c], 0x9227a98c
mov esi, dword [esp + ecx - 0x1e4]
jmp 0x8918c8
dec edx
mov dword [esp + ecx - 0x10a6f300], ecx
xor ebx, edx
sar cx, 0x88
adc ebp, edx
lea edx, [eax + eax*2 + 0x11abaea4]
mov eax, dword [esi + ecx*4 - 0x429bffcc]
call fcn.008e4cf1
movzx cx, byte [edi]
mov eax, 0xd724b78c
mov edx, eax
call fcn.009bbd86
lea edx, [edi]
mov dword [ecx + 0x131ce1bf], 0xa75d7c
push 0x682c96a2
dec dword [ebx - 7]
adc al, 0xb
in al, dx
adc al, 0x7e
adc al, byte [ebx]
adc ebp, dword [ecx]
push 0xffffffffffffffff
das
push 0xf8ee99f3
in al, dx
mov esi, 0xfb130f2d
or al, 0x94
sub byte [eax + 0x24], ch
or eax, 0xf8f94752
sahf
xor eax, 0x1d753788
push ecx
xchg esp, eax
movsb byte es:[edi], byte [esi]
and dh, byte [edi - 0x7869c252]
dec esp
aaa
mov byte [0x52e59977], al
mov dh, 0x68
jg 0x954a83
mov dl, 0x89
xchg edi, eax
je 0x954ade
jae 0x954b2a
loop 0x954aef
sbb bh, byte [edi - 0x1048bab]
mov edi, 0xfefb7455
out 0x90, eax
lahf
test ah, bl
inc ebx
sbb ebx, esp
inc ebx
pop ebx
xchg esp, eax
arpl word [edi + 0x1b], di
or byte [ecx + 0x79d20c8c], 0xc5
or byte [ebx + 0x79da0cbc], 0xc5
or byte [ebp + 0x5caac9b4], 0x2e
jge 0x954aaf
jmp 0x250a4ac9
salc
push dword [esp + 0xc]
popfd
mov dword [esp + ecx - 0x1ec], ecx
jmp 0x8b5d60
je 0x954ad7
movzx eax, word [esp + ecx - 0x548b9200]
mov eax, dword [esi + ecx - 0x548b9200]
push ecx
mov edx, ecx
shl word [esp + edx - 0x548b91fc], 0xa5
lea esi, [esi + edx - 0x548b91fc]
shr dword [esp + ecx - 0x548b9200], 0xd5
sar edx, 0xcd
and ecx, dword [esp + ecx - 0x548b91ff]
xor eax, ebx
shl dword [esp + ecx], 0x39
push edx
xor eax, 0x19c2591
dec eax
shr edx, 0x37
not eax
add ecx, dword [esp + ecx*4 + 8]
lea eax, [eax + edx - 0x6bbd7732]
btr cx, cx
shl cl, 0xa2
xchg word [esp + edx + 3], dx
not eax
ror dx, 0xa6
dec eax
add byte [esp + edx*8 + 4], ch
xor ebx, eax
add ebp, eax
and dword [esp + edx*2 + 5], edx
push edx
xor dword [esp + edx*8], ebp
ret 0xc

Function at 0x954ccf
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ecx
add esi, ecx
sub ebp, edx
sar dl, 0x41
dec ax
pop edx
mov dl, byte [ebp + edx*2 - 2]
rol eax, 0x7b
or eax, eax
xor dl, bl
movzx ecx, ax
jmp 0x402324
lea esi, [esi + edx*4 - 0x3181002]
movzx edx, word [esi + edx*2 - 0x18c0800]
mov eax, ecx
xchg cx, ax
sbb eax, 0xfc8106a5
xor dx, bx
ror dx, cl
neg ax
sbb ax, ax
adc dx, 0x1384
sar ax, cl
shr eax, cl
neg dx
call fcn.009c7776
mov dword [ecx + ebp - 0x2002], edx
pop edx
jle fcn.009338ec
mov eax, 0x1e1d801b
mov ecx, dword [eax + ebp - 0x1e1d801b]
ror eax, 0xc5
not eax
sbb ax, ax
lea ebp, [ebp + eax - 0x270ffffb]
jo 0x83b068
xor eax, eax
xor ecx, ebx
or ax, ax
add eax, eax
xor ecx, 0x789f0a08
btr eax, eax
push eax
call fcn.0084c1cb
movsx ecx, dx
lea eax, [eax + edx*2 - 0x7c2b212d]
or cl, 3
bt dx, dx
or ecx, edx
neg eax
shr cl, 0x66
inc dx
bswap eax
xor ebx, eax
sar cx, 0x4e
btr cx, cx
btr cx, dx
adc ebp, eax
inc edx
shl edx, 9
jne 0x8c881a
Function at 0x957e7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr cx, 0xe4
mov edx, dword [esi]
rol ax, 0xa6
sub cx, cx
sbb ax, ax
xor edx, ebx
add ecx, ecx
add al, 0x22
btr ecx, 0xb0
rol edx, 3
cwde
imul ax, cx
not edx
lea ecx, [eax*2 - 0x349f655]
jo 0x9b66d0
inc edx
cwde
bswap edx
dec eax
lea edx, [edx + ecx - 0x721851f7]
cbw
ror edx, 2
add edx, eax
dec al
xor ebx, edx
add edi, edx
sal al, 7
jmp edi
shl edx, 0x4c
not ax
shr edx, 0xa1
mov dword [esp + edx - 0x49378800], edx
not cx
call fcn.0091b43c
mov edx, 0x7ebe152d
mov ecx, edx
not ecx
mov edx, dword [ebp + edx - 0x7ebe152d]
movsx eax, cx
and cl, ch
sal ax, 0xc8
mov cl, byte [ebp + 4]
adc ebp, 6
inc ax
mov byte es:[edx], cl
mov ecx, eax
js 0x959ac6
shr cx, cl
sbb esi, 3
sal eax, 0x22
jne 0x8f2111
xor ecx, edx
adc edi, eax
btc cx, cx
movsx eax, cx
jmp edi
bswap ecx
btc eax, 0x1e
dec eax
setns al
inc ecx
neg ecx
lea edx, [eax*8 - 0x9ed9375]
sar edx, 0xc4
xor ebx, ecx
bts dx, 0x8e
inc edx
neg dl
add esi, ecx
jmp 0x9bd526
neg al
jge 0x920431
pop edx
pop eax
jmp fcn.009338ec

Function at 0x95e2f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mul eax
pop ecx
pop ecx
jo fcn.009338ec

Function at 0x960f6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl al, 0x81
pop eax
pop eax
jp fcn.009338ec
mov eax, 0x1c208b22
fsub qword [eax + edi - 0x1c208b22]
movzx ecx, al
lea esi, [esi + eax*4 - 0x70822c8c]
sal ax, 0x65
xor cx, 0x39ac
lea edx, [eax + eax*8 + 0x529e43a8]
mov edx, dword [esi + eax*2 - 0x3840c880]
bt ax, 0x1f
sal eax, 0xba
neg eax
xor edx, ebx
neg eax
cmovge eax, ecx
lea edx, [edx + eax*4 - 0x623c0a71]
adc ecx, eax
push eax
not edx
dec edx
xor edx, 0x3806c39d
or word [esp + eax - 0x398e], cx
push eax
inc edx
neg cx
xor ebx, edx
shr ax, 0x23
add ebp, edx
neg dword [esp + ecx*4 - 0x2338f]
pop edx
mov dword [esp + eax - 0x731], ebp
ret

Function at 0x96111e
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc esi, 1
lea edx, [edx + 0x6c192688]
xor dl, dl
lea edx, [edx*4 + 0x7716e2ab]
mov word [esi + edx - 0x6ffdb2ab], cx
call fcn.009a2d74

Function at 0x96cb53
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr byte [esp + ecx - 0x7fc], 5
xor eax, ebx
inc dword [esp + ecx - 0x7fc]
mov dword [esp + ecx*4 - 0x2000], 0x19f553d
lea eax, [eax + ecx*2 + 0x6581b52b]
call fcn.00865efc
dec ax
mov edx, dword [esi]
sub ax, 0x2600
movsx ecx, al
dec ax
xor edx, ebx
call fcn.00877fba
mov ecx, 0x812f96af
mov ecx, dword [esi]
add esi, 4
mov edx, 0xdf8dbfaa
lea eax, [edx*2 + 0x7320438d]
xor ecx, ebx
neg eax
push edx
call fcn.009855f0

Function at 0x96cbb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror eax, 3
neg eax
rol byte [esp + ecx - 0x5e0f0c0a], 0xa7
bt cx, 0xaa
mov dword [esp + ecx - 0x5e0f0c11], edx
dec eax
xor ebx, eax
add edi, eax
or dword [esp + ecx - 0x5e0f0c0d], ecx
btr ecx, edx
pop edx
pop eax
jb fcn.009338ec

Function at 0x96db75
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, ecx
mov dword [esp + edx - 0x350004c9], eax
mov edx, ebp
lea ebp, [ebp + eax*8 - 2]
mov ecx, eax
dec eax
mov word [ebp + ecx*2], dx
pop ecx
jle fcn.009338ec
Function at 0x970b0a
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
ror al, 1
imul ecx, dword [esp]
btr ecx, 0x89
adc al, 0x20
imul ecx, ecx
dec cx
inc ecx
not al
js 0x997da4
bt ecx, ecx
jae 0x98db84
bt ecx, ecx
lea ecx, [ecx*2 - 0x5dc07243]
bswap eax
lea ecx, [ecx + ecx*8 + 0x3b2d988a]
add cl, 0x19
sbb eax, 0x8591ee94
movzx edx, cl
xadd dx, cx
rol eax, 1
shl cx, cl
lea eax, [edx + eax - 0x3509b099]
bt cx, 0xa6
sar edx, 0x73
inc dl
xor ebx, eax
sal dx, 0xa9
jnp 0x8698b7
adc esi, eax
and cl, ch
rol edx, 0x74
jbe fcn.00880f1a
add byte [ecx + 0x1d6], al
add byte [ecx + 0x3200244c], cl
ret
adc esi, 1
mov dword [esp], ecx
xor al, bl
or ecx, ecx
xor al, 0x93
dec al
sar dword [esp], 0x1a
sbb ecx, 0xe348290
jne 0x8b7db3
inc edx
dec ebp
fucompi st(2)
enter 0x512a, 0x72
mov esp, eax
mov dword [0x6b1ec265], eax
sbb eax, 0x25c4d6d6
imul eax, ecx, 0x7343e4ec
jo 0x98db83
stosd dword es:[edi], eax
or dword [ebx + ebx*2], edx
mov dword [eax + ecx*8 - 0x8178885], esi
sbb eax, 0x3ee4f9a7
cmp dword [ebx - 0x3b], esi
inc ebx
sbb byte [ebx + ecx*4 + 0x25448b4d], dl
add byte [ecx + 0x2e35c698], bh
mov ecx, dword fs:[ecx + eax - 0x2e35c698]
mov edx, 0x36a68a2d
xor edx, edx
mov dword [ebp + edx], ecx
lea esi, [esi + edx - 4]
movsx eax, dx
mov ecx, dword [edx + esi]
xor ecx, ebx
shr eax, 0xf9
imul edx, edx
dec ecx
call fcn.008e0d73
sal cl, 0x63
rol al, 1
shl word [esp + 2], 0xe
dec cx
lea ecx, [ecx + ecx*2 - 0x376ecbdf]
xor bl, al
dec dword [esp]
pop ecx
add eax, esp
or cx, 0xe637
mov dword [eax], edx
mov ecx, dword [esi]
call fcn.00912cf7
xor ebx, edx
call fcn.0087cce8

Function at 0x973b92
Capabilities:
Execute anti-debugging instructions

Disassembly:
ja 0x9b4fb8
mov dword [esp + edx*4], eax
add edi, ecx
movsx ecx, word [esp + edx + 4]
mul ecx
sal eax, 0x43
pop eax
pop edx
jns fcn.009338ec
sar eax, 0x65
shr edx, 0x2d
lea ecx, [ecx + eax*4 + 0x42ffc2ef]
sar ax, 0xc
add dword [esp + eax - 0xc6ffff], edx
xor ebx, ecx
shl byte [esp + eax - 0xc6fffa], 0x27
inc dx
add edi, ecx
imul byte [esp + eax*2 - 0x18dfffa]
mov edx, dword [ebp + eax - 0xc6ffe8]
shr word [esp + eax - 0xc6ffe6], 0x84
mov ax, word [ebp + eax*2 - 0x18dffcc]
sar dword [esp + 4], 0xe8
jae 0x908983
jmp 0x940d18
adc ebp, 6
mov word ss:[edx], ax
mov edx, 0x8384fdab
pop edx
pop edx
jmp edi

Function at 0x974450
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esi]
add esi, 4
xor eax, ebx
mov edx, 0xac8069b6
dec eax
mov ecx, edx
bswap edx
not eax
xadd dx, cx
rol eax, 2
push ecx
xor eax, 0x5c24293c
inc eax
xor ebx, eax
inc edx
dec ecx
xadd dl, dh
add edi, eax
bts ecx, 0x26
mov ebp, dword [ebp]
neg edx
setg cl
pop ecx
jbe fcn.009338ec
bt edx, eax
rol ecx, 3
bswap ecx
add edx, eax
neg ecx
dec edx
ror ecx, 1
add al, al
xor ebx, ecx
add ebp, ecx
mov ecx, dword [esi]
cdq
neg eax
shr dl, 0xc3
xor al, byte ss:[eax + ecx - 0x10da0000]
lea ecx, [edx + edx*2 - 0x245c0c8]
add esi, 2
add cx, cx
bts ecx, 0x1e
inc cl
mov word [esi], ax
xchg dx, cx
xchg edx, ecx
jmp ebp
inc dx
pop eax
jno fcn.008ac5bb
mov eax, 0xaf15f014
jmp 0x9272d0
Function at 0x97dc0f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xa863038
lea edx, [ecx*4 + 0x4c3d3295]
lea ebp, [ebp + ecx*2 - 0x150c6072]
mov word [ecx + ebp - 0xa863038], ax
lea ecx, [ecx + ecx*8 - 0x7fe75253]
mov dword [esp + edx - 0x7655f375], ecx
or dword [esp + edx - 0x7655f374], edx
mov eax, dword [esi + edx - 0x7655f375]
sar word [esp + edx - 0x7655f370], 0xaf
lea esi, [esi + edx - 0x7655f371]
sal dword [esp + edx - 0x7655f371], 0x5d
sar ecx, cl
xor eax, ebx
lea edx, [ecx*4 - 0x46c4a9c7]
add cl, dh
sal cl, 0x62
sbb eax, 0x618e4014
rol byte [esp + 5], 3
sub cl, 0
ror eax, 1
dec dl
dec dword [esp]
neg edx
lea eax, [eax + ecx - 0x61ee6ade]
lea ecx, [ecx*4 - 0x18e10cda]
btc edx, 0xa9
shr ecx, cl
xor eax, 0xce0190b4
not edx
inc dl
ror eax, 3
or cx, dx
xor ebx, eax
add edi, eax
and cx, dx
pop ecx
pop eax
jno fcn.009338ec

Function at 0x97ff78
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0xa8985c32
lea esp, [esp + 4]
call fcn.0092ae79

Function at 0x98a768
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov edi, 0x8619aa0b
add ecx, ecx
mov ecx, dword [esp + edi + 0x79e65601]
mov dword [esp + 0xc], 0xafd3b772
mov edi, dword [esp + edi + 0x79e655f5]
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00987eba