joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c4dc
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.0041c416
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x41c550
cmp dword [ebp + 0xc], ecx
je 0x41c550
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x41c550
xor edx, edx
mov edi, 0x1bb
cmp dword [esi + 0x21c], edi
setne dl
dec edx
and edx, 0x800000
add edx, 0x100
push edx
push 0x4397a4
push ecx
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [0x42e4d0]
mov dword [esi + 8], eax
test eax, eax
jne 0x41c558
call dword [sym.imp.p_GetLastError]
push eax
push str.open_request_failed___d_
add esi, 0x468
push esi
call fcn.00401229
add esp, 0xc
xor al, al
pop edi
pop esi
leave
ret 8
cmp dword [esi + 0x454], 0
je 0x41c5a5
cmp dword [esi + 0x458], 0
je 0x41c5a5
mov edx, dword [esi + 0x45c]
test edx, edx
je 0x41c5a5
mov ecx, dword [esi + 0x460]
test ecx, ecx
je 0x41c5a5
push ecx
push edx
push dword [esi + 0x458]
push dword [esi + 0x454]
push eax
call dword [0x42e4cc]
test eax, eax
jne 0x41c5a5
call dword [sym.imp.p_GetLastError]
push eax
push str.set_timeouts_failed___d_
jmp 0x41c541
cmp byte [esi + 0x220], 0
je 0x41c5fe
lea ecx, [esi + 0x334]
call fcn.0040b7fa
test al, al
jne 0x41c5fe
lea ecx, [esi + 0x3c4]
call fcn.0040b7fa
test al, al
jne 0x41c5fe
mov eax, dword [esi + 0x3c8]
mov ecx, dword [esi + 0x338]
push 0
push eax
push ecx
push 1
push 1
push dword [esi + 8]
call dword [0x42e4c8]
test eax, eax
jne 0x41c5fe
call dword [sym.imp.p_GetLastError]
push eax
push str.set
jmp 0x41c541
push str.HEAD
push dword [ebp + 8]
call fcn.00423091
pop ecx
pop ecx
test eax, eax
jne 0x41c618
mov al, 1
jmp 0x41c552
cmp dword [esi + 0x21c], edi
mov edi, dword [0x42e4c4]
jne 0x41c64f
push 4
lea eax, [ebp - 4]
push eax
push 0x1f
push dword [esi + 8]
mov dword [ebp - 4], 0x100
call edi
test eax, eax
jne 0x41c64f
call dword [sym.imp.p_GetLastError]
push eax
push str.set_ignore_unknown_CA_failed___d_
jmp 0x41c541
cmp byte [esi + 0x464], 0
jne 0x41c611
push 4
lea eax, [ebp - 4]
push eax
push 0x3f
push dword [esi + 8]
mov dword [ebp - 4], 2
call edi
test eax, eax
jne 0x41c611
call dword [sym.imp.p_GetLastError]
push eax
push str.set_disable_redirects_failed___d_
jmp 0x41c541
Function at 0x41c681
Capabilities:
Read http header
Receive http response
Set http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov edx, dword [esi + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], 4
cmp edx, edi
jne 0x41c6a4
xor eax, eax
jmp 0x41c74c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
push 0xa0000000
push ecx
push eax
push edx
call dword [0x42e4e0]
test eax, eax
jne 0x41c6dc
call dword [sym.imp.p_GetLastError]
push eax
push str.add_headers_failed___d_
add esi, 0x468
push esi
call fcn.00401229
add esp, 0xc
jmp 0x41c69d
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push edi
push dword [esi + 8]
call dword [0x42e4dc]
test eax, eax
jne 0x41c703
call dword [sym.imp.p_GetLastError]
push eax
push str.send_request_failed___d_
jmp 0x41c6cb
push edi
push dword [esi + 8]
call dword [0x42e4d8]
test eax, eax
jne 0x41c71f
call dword [sym.imp.p_GetLastError]
push eax
push str.receive_response_failed___d_
jmp 0x41c6cb
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x20000013
push dword [esi + 8]
call dword [0x42e4d4]
test eax, eax
jne 0x41c749
call dword [sym.imp.p_GetLastError]
push eax
push str.get_status_failed___d_
jmp 0x41c6cb
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0xc

Function at 0x41c752
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea edi, [ecx + 0x468]
mov eax, dword [edi + 4]
xor edx, edx
mov dword [edi + 8], edx
cmp eax, edx
je 0x41c76f
xor esi, esi
mov word [eax], si
mov ecx, dword [ecx + 8]
cmp ecx, edx
je 0x41c7b9
cmp dword [ebp + 8], edx
je 0x41c7b9
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0xc]
push edx
lea eax, [eax + eax - 2]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push eax
push dword [ebp + 8]
push 0xffff
push ecx
call dword [0x42e4d4]
test eax, eax
jne 0x41c7c1
call dword [sym.imp.p_GetLastError]
push eax
push str.get_header_failed___d_
push edi
call fcn.00401229
add esp, 0xc
xor al, al
pop edi
pop esi
leave
ret 8
mov ecx, esi
call fcn.0040120b
mov al, 1
jmp 0x41c7bb

Function at 0x41c7cc
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x41c814
cmp dword [ebp + 0xc], 1
jb 0x41c814
mov eax, dword [esi + 8]
test eax, eax
je 0x41c814
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [0x42e4e4]
test eax, eax
jne 0x41c81b
call dword [sym.imp.p_GetLastError]
push eax
push str.read_failed___d_
add esi, 0x468
push esi
call fcn.00401229
add esp, 0xc
xor al, al
pop esi
pop ebp
ret 0xc
mov al, 1
jmp 0x41c816
Function at 0x41cbeb
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0x468]
xor ebx, ebx
mov dword [ebp - 4], eax
mov dword [eax + 8], ebx
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x41cc0d
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp + 8], ebx
jne 0x41cc19
xor al, al
jmp 0x41cd14
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 4], ebx
je 0x41cc4b
push dword [ebp + 8]
lea ecx, [esi + 0xc]
call fcn.0041c498
test eax, eax
jne 0x41cc4b
cmp dword [esi + 0x21c], edi
jne 0x41cc4b
mov al, byte [ebp + 0x10]
cmp byte [esi + 0x220], al
jne 0x41cc4b
mov al, 1
jmp 0x41cd13
mov ecx, esi
call fcn.0041c4c0
mov eax, dword [esi]
cmp eax, ebx
je 0x41cc6c
mov cl, byte [ebp + 0x10]
cmp cl, byte [esi + 0x220]
je 0x41cc6c
push eax
call dword [0x42e4c0]
mov dword [esi], ebx
mov al, byte [ebp + 0x10]
mov byte [esi + 0x220], al
cmp dword [esi], ebx
jne 0x41ccb7
push ebx
push ebx
cmp al, bl
je 0x41cc8a
mov eax, dword [esi + 0x228]
push eax
push 3
jmp 0x41cc8d
push ebx
push 1
push str.MetaTrader_5_1.0
call dword [0x42e4e8]
mov dword [esi], eax
cmp eax, ebx
jne 0x41ccb7
call dword [sym.imp.p_GetLastError]
push eax
push str.create_HTTP_session_failed___d_
push dword [ebp - 4]
call fcn.00401229
add esp, 0xc
jmp 0x41cd08
push dword [ebp + 8]
lea ecx, [esi + 0xc]
call fcn.0040b814
mov eax, dword [esi + 0x10]
push ebx
movzx ecx, di
push ecx
push eax
push dword [esi]
mov dword [esi + 0x21c], edi
call dword [0x42e4b8]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x41cd0c
push dword [esi + 0x21c]
push dword [esi + 0x10]
cmp byte [esi + 0x220], bl
je 0x41ccf8
push str._s:_d_via_proxy_failed
jmp 0x41ccfd
push 0x433cb4
push dword [ebp - 4]
call fcn.00401229
add esp, 0x10
xor al, al
jmp 0x41cd13
mov ecx, esi
call fcn.0041c93b
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41eaca
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.base_constructor_iterator_RegOpenKeyExW]
test eax, eax
je 0x41eaf3
xor al, al
leave
ret
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
add eax, eax
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4340c0
push dword [ebp - 4]
call dword [sym.imp.base_constructor_iterator_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x41eb2a
call dword [sym.imp.base_constructor_iterator_RegCloseKey]
jmp 0x41eb3d
call dword [sym.imp.base_constructor_iterator_RegCloseKey]
mov ecx, esi
call fcn.0040120b
cmp dword [ebp - 0xc], 1
je 0x41eb41
xor al, al
jmp 0x41eb76
push 0x4340bc
mov ecx, esi
call fcn.0041370c
test eax, eax
jl 0x41eb5c
inc eax
push eax
push 0
mov ecx, esi
call fcn.00413014
push 0x4340b8
mov ecx, esi
call fcn.0041370c
test eax, eax
jl 0x41eb74
push eax
mov ecx, esi
call fcn.00401270
mov al, 1
pop esi
leave
ret

Function at 0x41efa7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
push ebx
push esi
xor ebx, ebx
push 0x88
lea eax, [ebp - 0x94]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x98], ebx
call fcn.00420470
add esp, 0xc
lea ecx, [ebp - 0x2b0]
call fcn.00401a37
call dword [sym.imp.p_GetTickCount]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
cmp dword [esi + 0x850], ebx
je 0x41f0e5
cmp dword [esi + 0x854], 1
jl 0x41f0e5
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push 0x3f
push eax
mov dword [ebp - 0x98], ebx
call fcn.0040abe6
add esp, 0xc
push dword [esi + 0x848]
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
call fcn.0041e911
push dword [ebp + 8]
mov ecx, esi
call fcn.0041e6f0
mov byte [ebp - 1], al
cmp al, bl
je 0x41f0d5
push edi
push str._files_metaquotes.cdn.present.png
lea ecx, [ebp - 0x2b0]
call fcn.0040b814
push ebx
push ebx
push ebx
push dword [ebp - 0x2ac]
lea edi, [esi + 4]
mov ecx, edi
call fcn.0041cdb4
cmp eax, 0xc8
je 0x41f072
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x41f0d4
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x854]
dec eax
push eax
push dword [esi + 0x850]
mov ecx, edi
call fcn.0041c7cc
mov byte [ebp - 1], al
cmp al, bl
je 0x41f0d4
push ebx
push esi
call dword [sym.imp.p_InterlockedExchangeAdd]
test eax, eax
je 0x41f0ba
cmp dword [ebp - 8], ebx
je 0x41f0bd
cmp dword [ebp - 8], 0x459
sete byte [ebp - 1]
cmp byte [ebp - 1], bl
jne 0x41f077
jmp 0x41f0bd
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x41f0d4
call dword [sym.imp.p_GetTickCount]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x84], eax
pop edi
lea ecx, [ebp - 0x2b0]
call fcn.00401924
mov al, byte [ebp - 1]
jmp 0x41f0f2
lea ecx, [ebp - 0x2b0]
call fcn.00401924
xor al, al
pop esi
pop ebx
leave
ret 8
Function at 0x41fc2a
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x41fc47
push 0
push eax
call dword [sym.imp.p_TerminateThread]
push dword [esi]
call dword [sym.imp.p_CloseHandle]
and dword [esi], 0
pop esi
ret

Function at 0x420174
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x43b370], 0
push esi
jne 0x4200e7
call fcn.0042000d
test eax, eax
je 0x42012a
mov eax, dword [0x43b370]
cmp eax, 1
jne 0x420108
push 0xd
push 0
call dword [sym.imp.p_GetProcessHeap]
push eax
call dword [sym.imp.p_HeapAlloc]
test eax, eax
je 0x42012a
pop esi
ret
push eax
call dword [0x43b378]
test eax, eax
jne 0x420172
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.p_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42012e
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x43b370]
call dword [0x43b378]
mov edi, eax
test edi, edi
je 0x420153
push 0x8000
push 0
push esi
call dword [sym.imp.p_VirtualFree]
jmp 0x42016f
mov edi, esi
add esi, 0xff0
push edi
push dword [0x43b370]
call dword [0x43b374]
add edi, 0x10
cmp edi, esi
jb 0x42015b
mov eax, edi
pop edi
pop esi
ret
jmp 0x4200d4

Function at 0x42a4bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43aba8]
jne 0x42a4c5
repz ret
jmp fcn.0042cb47
Function at 0x42bc85
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00427b18
and dword [ebp - 4], 0
cmp dword [0x43bbd4], 0
mov ebx, eax
jne 0x42bd36
push str.USER32.DLL
call dword [sym.imp.p_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42bde7
mov esi, dword [sym.imp.p_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42bde7
push eax
call fcn.00427aa6
mov dword [esp], 0x434d3c
push edi
mov dword [0x43bbd4], eax
call esi
push eax
call fcn.00427aa6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43bbd8], eax
call esi
push eax
call fcn.00427aa6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43bbdc], eax
call esi
push eax
call fcn.00427aa6
pop ecx
mov dword [0x43bbe4], eax
test eax, eax
je 0x42bd36
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00427aa6
pop ecx
mov dword [0x43bbe0], eax
mov eax, dword [0x43bbe0]
cmp eax, ebx
je 0x42bd8e
cmp dword [0x43bbe4], ebx
je 0x42bd8e
push eax
call fcn.00427b21
push dword [0x43bbe4]
mov esi, eax
call fcn.00427b21
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42bd8e
test edi, edi
je 0x42bd8e
call esi
test eax, eax
je 0x42bd85
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42bd85
test byte [ebp - 0xc], 1
jne 0x42bd8e
or dword [ebp + 0x10], 0x200000
jmp 0x42bdc7
mov eax, dword [0x43bbd8]
cmp eax, ebx
je 0x42bdc7
push eax
call fcn.00427b21
pop ecx
test eax, eax
je 0x42bdc7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42bdc7
mov eax, dword [0x43bbdc]
cmp eax, ebx
je 0x42bdc7
push eax
call fcn.00427b21
pop ecx
test eax, eax
je 0x42bdc7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43bbd4]
call fcn.00427b21
pop ecx
test eax, eax
je 0x42bde7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42bde9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ee23
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x4223d8
call fcn.0041fd98
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x423e5c
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41ee75
cmp eax, esi
jne 0x41ee68
xor esi, esi
inc esi
mov edi, esi
jmp 0x41ee78
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41ee4c
xor esi, esi
inc esi
cmp dword [0x423e60], esi
jne 0x41ee8a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x41eec4
cmp dword [0x423e60], ebx
jne 0x41eebe
mov dword [0x423e60], esi
push 0x401028
push 0x401018
call fcn.0041effe
pop ecx
pop ecx
test eax, eax
je 0x41eec4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41efee
mov dword [0x423ae0], esi
cmp dword [0x423e60], esi
jne 0x41eee7
push 0x401014
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x423e60], 2
test edi, edi
jne 0x41eef4
xor eax, eax
mov ecx, 0x423e5c
xchg dword [ecx], eax
cmp dword [0x423e70], 0
je 0x41ef20
push 0x423e70
call fcn.0041fbf0
pop ecx
test eax, eax
je 0x41ef20
push ebx
push 2
push ebx
mov esi, dword [0x423e70]
mov ecx, esi
call dword [0x42486c]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x41eead
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x41ef8b
test ax, ax
je 0x41ef5a
test edx, edx
jne 0x41ef8b
test ax, ax
je 0x41ef5a
cmp ax, si
ja 0x41ef5a
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x41ef45
test byte [ebp - 0x3c], 1
je 0x41ef66
movzx eax, word [ebp - 0x38]
jmp 0x41ef69
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x423adc], eax
cmp dword [0x423af4], 0
jne 0x41efd3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x41ef9c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x41ef34
cmp dword [0x423ae0], 0
jne 0x41efe7
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x423adc]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.0059f000
jmp 0x41ee23

Function at 0x41fad4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x422418
call fcn.0041fd98
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41fb34
cmp eax, 0xffffffff
je 0x41fb34
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41fb2d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41fb2d
cmp edx, 0x10000000
jae 0x41fb2d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41fb2a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x407ea0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc ecx
push 0xffffffffffffffd2
in eax, dx
int3
aaa
jnp 0x407def
mov esp, 0x14b7095b
add dword [ecx + ebx*8], eax
invalid
fild word [edx - 0x4ab079ba]
push ss
pop esi
lodsb al, byte [esi]
sahf
idiv byte [eax + 0x3601f88]
mov dh, 0x2b
mov ebx, 0x605397b4
mov esp, 0x601f8860
pushal
mov byte [edi], bl
pushal
add esi, dword [esi - reloc.Util.dll__SetGBKtoFZRelease__YAXXZ]
push ebx
pushal
invalid
dec esi
fistp word [eax + edx*2]
mov ecx, 0x5a1ace6c
jbe 0x407ead
inc esi
je 0x407e4c
sahf
mov dh, 0x33
sbb eax, 0x7d859a00
adc eax, 0x3e2f1c1a
xchg ecx, eax
outsb dx, byte [esi]
jp 0x407e5a
scasd eax, dword es:[edi]
ja 0x407ece
nop
xor eax, 0x96d6bd28
loope 0x407e65
jae 0x407e66
xor bl, cl
mov dword [ecx - 0x29], eax
bound eax, qword [ecx + 0x7c]
add eax, 0x11db26bf
lodsd eax, dword [esi]
mov al, 0x54
ret
Function at 0x7f0199
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07dc194
jmp 0x7f02da
jmp 0x7f01b9
pushfd
mov dword [esp], esp
mov word [esp], bp
mov dword [esp], eax
pushal
push word [esp + 0x1c]
jmp 0x7f021e
pushal
lea esp, [esp + 0x42]
push ecx
jmp 0x7f0208
push ecx
pushfd
lea esp, [esp + 1]
jmp 0x7f020d
pushfd
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 3]
jmp 0x7f0227
js 0x7f01d9
pushal
lea esp, [esp + 0x42]
jmp 0x7f01e5
push edx
pushfd
mov dword [esp], ebx
pushfd
push dword [esp + 2]
jmp 0x7f0271
pop dword [esp]
push word [esp + 2]
push word [esp + 5]
jmp 0x7f02b4
push word [esp + 5]
pop word [esp]
jmp 0x7f02b8
jbe 0x7f0237
pop dword [esp]
push word [esp + 2]
jmp 0x7f025b
pop word [esp]
call fcn.007f0297
mov word [esp + 2], cx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
pushfd
jmp 0x7f02f5
mov dl, bl
jmp 0x7f033f
xchg bl, ah
xchg cx, dx
bsf cx, bp
jl 0x7f031d
jge 0x7f031d
scasd eax, dword es:[edi]
inc ebx
sal dword [esi + reloc.Util.dll__SetGBKtoFZRelease__YAXXZ], cl
xor byte [ebx], dh
mov byte [esp + 2], dl
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0x7eee25
bsf edx, edi
js 0x7f0322
jns 0x7f0322
cmp ebp, dword [eax + reloc.Util.dll__SetGBKtoFZRelease__YAXXZ]
push edi
lds edx, [ebp + 0x3c]
iretd
lea esi, [esp]
jmp 0x7f0307
call 0x7f0365
add byte ds:[eax], al
add byte [ebx + 0xf310ffc], cl
mov esp, 0x761f77d7
sbb eax, 0xe889198a
mov edi, esp
rdtsc
bsf edx, edi
ja 0x7f034f
jbe 0x7f034f
mov bl, byte [ecx]
mov eax, ebp
sbb ebx, edx
in al, dx
jp 0x7f0323
invalid
mov edi, dword [esp]
mov ecx, dword [esp]
cpuid
mov ebp, dword [esp + 0x2c]
rdtsc
jmp 0x7f02de
call fcn.007f0372
daa
mov al, 0x26
inc ecx
mov al, 0x71
cmp ebp, dword [ebp + reloc.Util.dll__SetGBKtoFZRelease__YAXXZ]
cmp al, 0xf
xchg esi, eax
add eax, eax
mov eax, 0x49f35b5
sub esp, 0xbc
jmp 0x7f0327

Function at 0x7f264f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
push si
mov word [esp], di
mov word [esp], si
jmp 0x7f2687
mov dword [esp + 0x88], esi
push sp
jmp 0x7f2639
mov dword [esp + 0x88], edi
lea esp, [esp + 0x88]
pushfd
jmp 0x7f0dab
Function at 0x7f3444
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
jmp 0x7f344c
mov byte [esp], cl
call fcn.007f3474
cmc
jl 0x7f3481
mov dh, 0x46
bswap edx
not dx
mov dx, 0x21b6
xchg dh, dl
jmp 0x7f34a4
mov dh, 0x46
bswap edx
jmp 0x7f34ba
dec al
mov dx, word [esp]
mov dx, 0xc27
mov dx, word [esp]
jmp 0x7f34c5
not dx
mov dx, 0x21b6
xchg dh, dl
jmp 0x7f34a4
mov edx, dword [esp]
jmp 0x7f3777
mov word [esp + 6], bx
sub esp, 0x1e
jmp 0x7f35b8
lea esp, [esp + 0x3c]
add al, 0x7a
bswap edx
adc dx, 0x62e7
jmp 0x7f35d2
lea edx, [ebx*4]
bts dx, dx
sub esp, 8
rol dl, 6
call fcn.007f3657
pop eax
fisttp dword [ebx + 0x2e]
fstp qword [edi]
mov esi, 0x75b27489
mov al, 0x83
in al, dx
or al, al
ret 0xeb06
je 0x7f356c
jne 0x7f356c
sub esp, 8
rol dl, 6
jmp 0x7f35e1
jbe 0x7f359a
lea edx, [ebx*4]
bts dx, dx
jmp 0x7f35bc
rol al, 0
lea edx, [ecx + ebx]
not edx
jmp 0x7f367d
mov dl, bh
call 0x7f34fc
pop dx
mov dx, di
sub esp, 0
xchg dword [esp], ecx
bswap edx
shr dx, cl
jmp 0x7f363f
lea edx, [edi*4]
btr dx, ax
push dword [esp]
ret 4
lea edx, [ecx + ebx]
xchg byte [esp + 0xd], dh
lea esp, [esp + 1]
jmp 0x7f36c4
mov edx, ecx
sub esp, 0x19
jne 0x7f3667
lea edx, [ecx + ebx]
jmp 0x7f3740
lea eax, [eax + ebp]
mov ax, word [esp]
call fcn.007f36f8
salc
push ebx
ret
lea eax, [eax + ebp]
mov ax, word [esp]
inc edi
call fcn.007f374d
loopne 0x7f3729
out dx, al
mov dword [eax - 0x36], edi
into
push ebp
lds ebp, [edi + ebx*2 + 0x54c6589c]
xor ecx, esi
jns 0x7f36b9
pop edi
pushfd
pop eax
invalid
fisubr word [ecx]
add cl, al
lea eax, reloc.Util.dll__SetGBKtoFZRelease__YAXXZ
bsf dx, cx
jno 0x7f36a2
jo 0x7f368c
mov ax, word [esp]
rdtsc
sub esp, 0xb
lea esp, [esp + 3]
xchg dword [esp + 8], ebp
mov ax, di
jmp 0x7f3714
xchg dword [esp + 8], ebp
not dx
inc ah
lea edx, [edi + 0x49]
rdtsc
jmp 0x7f3729
lea ebp, [ebp + 0x11]
mov eax, dword [esp]
btr ax, di
rcr ax, cl
bswap eax
mov dx, word [esp]
jmp 0x7f36fe
push dword [esp + 8]
ret 0xc
xchg byte [esp + 0xd], dh
lea esp, [esp + 1]
jmp 0x7f36c4
ror al, 0
sbb dl, ch
jle 0x7f35ff
mov dl, bh
sub esp, 0x1e
mov dx, 0x5394
mov byte [esp + 0x16], dh
lea edx, [edi*4]
jmp 0x7f3556

Function at 0x7f3474
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
not al
mov dl, byte [esp]
xchg dl, dh
jmp 0x7f3454
Function at 0x7f4789
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr eax, eax
je 0x7f47a9
jne 0x7f47a9
dec edi
into
pop esp
cmp edx, esi
invalid
jmp 0x7f4827
not eax
jmp fcn.007f47f1
lea esp, [esp + 4]
sub bl, 0x15
sub esp, 0xd
jo 0x7f47ab
not eax
pop edx
mov dh, 0xa9
mov dl, byte [esp + 6]
lea esp, [esp + 1]
jmp fcn.007f47db

Function at 0x94ef2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 6], esi
xchg di, si
jmp 0x94ef74
rdtsc
mov ax, word [esp + 0xc]
sub esp, 0x14
xchg word [esp + 7], di
inc ah
rdtsc
call fcn.0094ef8a
out 0x64, eax
cli
popfd
insb byte es:[edi], dx
mov dl, byte [ecx]
nop
adc eax, dword [esi + reloc.Util.dll__SetGBKtoFZRelease__YAXXZ]
xor edx, 0xff668696
je 0x94efa5
xchg dh, bl
mov ch, 0xc9
xor dx, 0x8696
push word [esp + 8]
xchg si, bp
or byte [esi - 0x79], ah
out dx, al
mov bx, di
jmp 0x94ef53
or cl, ch
and eax, 0x878a908d
add byte [eax], al

Function at 0x94ef8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x94efc9
xchg ebx, edx
pop word [esp + 3]
bt esi, edx
mov dword [esp + 0x1b], ebp
popal
mov byte [esp + 2], dl
jmp 0x94efb3
xchg di, dx
bsr bx, sp
xchg byte [esp + 0x16], ch
pop word [esp + 0x18]
cpuid
mov esi, 0xb6a4615e
jmp 0x94ef8c

Function at 0x950c70
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x950ccf
pushal
xchg byte [esp + 0x15], ah
mov byte [esp + 0xc], ch
mov word [esp + 8], ax
mov dx, 0xb0b4
push word [esp + 0x1e]
jmp 0x950c99
xchg word [esp + 3], si
cpuid
neg bp
mov edi, esp
lea esp, [esp]
mov word [esp + 3], cx
jmp 0x950caf