joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdf8a47
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dl, cl
mov ecx, dword [ebp - 0x40]
not dx
bsf dx, ax
mov edx, dword [ecx + eax + 0xc]
adc ah, al
btr cx, 2
aam 0x7c
add edx, dword [ebp - 0xbc]
lahf
lea eax, [eax*2 - 0x3f3b4067]
mov dword [ebp - 0x44], edx
bts ecx, edi
mov eax, dword [ebp - 0x38]
rcr ecx, cl
seto cl
imul eax, eax, 0x14
bswap cx
movsx dx, dl
xchg dh, ch
bswap dx
mov ecx, dword [ebp - 0x40]
neg dl
lea edx, [edx - 0x3dadaab9]
mov edx, dword [ebp - 0xbc]
push dword [esp]
add edx, dword [ecx + eax + 0x10]
cwde
stc
push edi
mov dword [ebp - 0x8c], edx
cwde
lahf
mov eax, dword [ebp - 0x38]
bts cx, bp
clc
sets ch
imul eax, eax, 0x14
btc cx, 4
bswap dx
ror dl, 3
mov ecx, dword [ebp - 0x40]
add dx, sp
mov edx, dword [ebp - 0xbc]
clc
bt sp, bx
add edx, dword [ecx + eax]
aas
mov dword [ebp - 0x64], edx
shrd ax, si, 1
lahf
mov eax, dword [ebp - 0x44]
mov byte [esp + 8], 0x8a
test bx, cx
stc
cmc
sub ecx, ecx
neg cl
sal cl, cl
shl cl, 1
clc
mov cl, byte [eax]
test ebx, edi
clc
cmp ecx, 0x75
mov byte [esp], bl
jmp 0xdf6c2d

Function at 0xdf8b21
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], esp
push dword [esp]
lea esp, [esp + 0x34]
je 0xdf8e34
rcr cx, 0xe
mov eax, dword [ebp - 0x100]
jmp 0xdf8e06

Function at 0xdf8b51
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
jmp 0xdf7ce7
bswap ax
bts cx, 0xb
bts ax, sp
mov ax, 0xcd9b
mov eax, dword [ebp - 0x104]
stc
pushfd
mov ecx, dword [eax + 0x30]
pushal
test bx, 0x196c
push 0x895ca859
test al, 0x68
sub edx, edx
shr dh, cl
bsr dx, dx
jmp 0xdfac2c
xor edx, edx
cmc
and dx, 0x62ae
shr dl, 5
mov dx, word [ecx]
test sp, 0x6701
pushal
cmp edx, 0x6b
pushfd
jmp 0xdfe567
lea esp, [esp + 0x28]
je 0xdf6391
neg ch
bsr cx, bx
test al, bh
mov eax, dword [ebp - 0x104]
inc cx
movzx ecx, cl
mov ecx, dword [eax + 0x30]
bt bp, 0xb
jmp 0xdf1882

Function at 0xdf8bb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xdfa225
lea esp, [esp + 0x10]
je 0xdf3fcd
sal dh, cl
sub dx, 0x20b6
bsr dx, cx
sal dx, cl
mov edx, dword [ebp - 0x44]
clc
pushal
clc
sub eax, eax
rcr al, 1
not al
mov al, byte [edx + 9]
mov word [esp], ax
bt edi, esp
cmp eax, 0x4c
mov byte [esp + 4], cl
lea esp, [esp + 0x20]
jne fcn.00dfd2f9
mov ch, bh
dec cl
push esi
mov ecx, dword [ebp - 0x44]
call fcn.00dfb129

Function at 0xdf9043
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x33
call fcn.00df6a30
lea esp, [esp + 0xc]
jne 0xdfcdfe
cmp ax, ax
sal ax, cl
bts ax, 0xb
call fcn.00df7451
test cl, 0x19
stc
xor ecx, ecx
cmc
rol cl, cl
mov cl, byte [eax + 3]
push 0x6cf4ab80
cmc
bt ax, ax
cmp ecx, 0x72
mov byte [esp], 0x31
push 0x71fbeb14
lea esp, [esp + 8]
je 0xdf6643
neg dl
bsr edx, eax
and dh, bh
mov edx, dword [ebp - 0x44]
stc
bt dx, cx
test bp, 0xedf0
clc
sub eax, eax
inc al
sal al, cl
push ebx
rol al, 2
mov al, byte [edx + 3]
cmp bh, bl
test bl, 0x7a
cmp eax, 0x52
jmp 0xdfd40e
lea esp, [esp + 4]
jne fcn.00dfd2f9
rcr cl, 4
pushal
mov ecx, dword [ebp - 0x44]
clc
sub edx, edx
sal dl, 5
mov dl, byte [ecx + 4]
push 0xa86205de
jmp 0xdf4990
Function at 0xdf91e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0xbc]
cmc
mov byte [esp + 4], cl
stc
add edx, dword [ecx + eax + 0x10]
movzx ax, al
mov dword [ebp - 0x8c], edx
rol ecx, cl
xchg ch, dl
rcr ch, cl
mov eax, dword [ebp - 0x38]
bt dx, 1
imul eax, eax, 0x14
xadd dl, ch
btc dx, 0xc
neg dx
bsr cx, bp
mov ecx, dword [ebp - 0x40]
add edx, ecx
mov edx, dword [ebp - 0xbc]
test dh, ch
add edx, dword [ecx + eax]
dec ax
pushfd
bsr eax, ebp
bswap ax
mov dword [ebp - 0x64], edx
add ah, ch
mov eax, dword [ebp - 0x44]
clc
xor ecx, ecx
inc cl
rol cl, 1
and cl, 0xcb
mov cl, byte [eax]
clc
pushfd
stc
cmp ecx, 0x75
mov word [esp], 0x2b95
pushfd
pushfd
jmp 0xdf7e28
lea esp, [esp + 0x50]
jne fcn.00dfd2f9
sub cl, al
mov ecx, dword [ebp - 0x44]
call fcn.00dfcc14
lea esp, [esp + 0x40]
je 0xdf1c92
bts dx, cx
pushfd
shld dx, cx, 0xc
pushal
mov edx, dword [ebp - 0x44]
pushal
clc
sub eax, eax
pushfd
pushfd
push dword [esp]
mov al, byte [edx]
bt esp, 0xd
bt di, ax
test ah, 0x76
cmp eax, 0x55
mov byte [esp + 0xc], 0xa6
jmp 0xdf5f14
jmp 0xdf2ba0

Function at 0xdf98ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
je 0xdfe522
lea eax, [ebx + 0x2d8c0057]
inc ch
lea ecx, [ecx - 0x537882ba]
mov eax, dword [ebp - 0x104]
pushal
xor ch, 0x18
mov ecx, dword [eax + 0x30]
jmp 0xdfe554
test dh, 0x9f
cmc
xor edx, edx
not dh
push ecx
mov dx, word [ecx + 6]
clc
call fcn.00df1a50

Function at 0xdf98fd
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get number of processors

Disassembly:
cmp bl, 0x54
pushal
push dword [esp]
pushfd
lea esp, [esp + 0x2c]
jne 0xdfce8f

Function at 0xdf9d34
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec dx
pushfd
mov dx, word [ecx + 6]
cmp bl, ch
cmc
cmp edx, 0x4c
push 0x32642216
lea esp, [esp + 0x50]
jne 0xdfcdfe
rol al, cl
mov eax, dword [ebp - 0x100]
dec cl
mov ecx, dword [eax + 0x30]
cmp al, 0x39
cmp dl, 0x71
cmp ah, dh
sub edx, edx
mov dl, ah
bsr dx, bp
mov dx, word [ecx + 8]
stc
stc
cmp edx, 0x6c
pushfd
call fcn.00dfdc1d
mov word [esp + 0x14], 0x5ed1
pushfd
cmp ecx, 0x2e
call fcn.00dfdca2
Function at 0xdf9d8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp], dl
mov word [esp], 0xd142
lea esp, [esp + 4]
jne 0xdf8c42
sbb ah, ch
aam 7
cwde
ror ch, 1
mov eax, dword [ebp - 0x104]
call fcn.00dfe3e1
mov dword [ecx], eax
push 0x6fed327
mov byte [esp], dl
lea esp, [esp + 0x50]
jmp 0xdfca9c
pushfd
mov eax, dword [ebp - 0x5c]
pushfd
pushfd
and eax, 0xffff
bt dx, di
mov byte [esp + 8], al
cmp eax, 0x1000
lea esp, [esp + 0xc]
je 0xdfb6bd
push 0x5ae22bb
lea esp, [esp + 4]
jne 0xdf8b46
bts ax, 0xc
mov ecx, dword [ebp - 4]
sar dx, cl
cmp edx, 0xbf5627ff
and ecx, 0xffff0000
rol al, cl
adc eax, ebp
mov edx, dword [ebp - 0x1c]
rcr ah, cl
cmc
mov eax, dword [edx]
push 0x261f5557
pushal
pushal
add eax, ecx
mov ch, 0xd
mov ecx, dword [ebp - 0x1c]
pushfd
push 0xe1042537
jmp 0xdf5104
and dl, 0xd0
mov edx, dword [ebp - 0x5c]
call fcn.00df478f
push eax
lea esp, [esp + 4]
jne 0xdf8b46
pushfd
aam 0xe4
movzx ax, bl
mov ecx, dword [ebp - 4]
bt ecx, 0x1c
btr dx, cx
shld dx, ax, 7
and ecx, 0xffff0000
bsr eax, ebx
bts ax, si
mov edx, dword [ebp - 0x1c]
pushfd
mov eax, dword [edx]
stc
cmc
add eax, ecx
call fcn.00df3eb7
jmp 0xdf1e5d
lea esp, [esp + 0xc]
jne 0xdf80bc
pushfd
pushfd
push dword [esp]
lea esp, [esp + 0xc]
jmp 0xdfca9c
jl 0xdfc9d9
jne 0xdf8b46
das
mov ecx, dword [ebp - 4]
cmc
adc ax, 0xe338
aad 0x16
and ecx, 0xffff0000
cmp ah, 0x11
inc dx
stc
mov edx, dword [ebp - 0x1c]
lea eax, [eax + 0xc09e0fd]
ror al, 1
mov eax, dword [edx]
cmc
add eax, ecx
setns cl
call fcn.00df3bb6
je 0xdfb706
in al, dx
adc bl, byte [esi - 0x6c79542]
push 0x38
stc
invalid
push ecx
sbb al, 0xcb
rol dword [esi + 0x7ff5085], cl
add eax, 0x1e37cbb4
sub eax, 0x73adeff7
in al, 0xfa
push ebp
pop eax
push ebp
adc byte [edi + 0x3affc04e], bh
and dword [0x582d346c], esp
jae 0xdfb6ff
clc
cmp al, 0xe3
add ecx, dword [ebx - 0x59255219]
jb 0xdfb782
mov esi, 0xf5b2b3dd
lodsb al, byte [esi]
mov ah, 0xb2
popal
js 0xdfb791
mov dword [ebx + 0x7e8a5e3c], edx
insd dword es:[edi], dx
cmp al, 0xaf
adc eax, esi
sub edx, dword [edi + 0xf5bdeb]
stc
mov al, 0xd3
add ebp, dword [ebp + 0x54]
imul eax, dword [edx + eax*2], 0xfffffff4
cli
add dword [esi + 0x33788583], 0xffffffe2
bound esi, qword [ebp + ebx + 0x47b2a825]
pop esp
out dx, eax
push ds
lcall 0x6e16, 0xafda6f7f
cmp dword ds:[ebp - 1], edi
scasb al, byte es:[edi]
int1
aad 0x45
mov ch, 0xa1
cdq
add eax, 0xe78471ec
mov ah, 0x6c
arpl word [edx], bp
out dx, al
mov ebp, edx
xchg esp, eax
movsd dword es:[edi], dword [esi]
push ds
wait
in al, dx
test byte [edx], 0x60
pop esp
inc ebx
push cs
invalid
jmp 0xdf943a
pushfd
mov word [esp], di
push 0x952cacb1
lea esp, [esp + 8]
jmp 0xdf3f05

Function at 0xdfa354
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, edx
bsr dx, si
dec dh
mov dx, word [ecx]
call fcn.00df96dd
mov eax, dword [ebp - 0x104]
mov ch, 0xd
stc
mov ecx, dword [eax + 0x30]
jmp 0xdf44a5
lea esp, [esp + 0x44]
je 0xdf6391
jmp 0xdf6d8c
Function at 0xdfa4f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
pushfd
lea esp, [esp + 8]
jne 0xdfcdfe
rcr ch, 1
mov eax, dword [ebp - 0x100]
xor cx, di
rcr cl, cl
bsf cx, ax
mov ecx, dword [eax + 0x30]
push edi
pushfd
cmc
sub edx, edx
movsx dx, bl
rcr dh, 1
not dh
mov dx, word [ecx + 0xe]
test dl, 0x3d
cmp ax, 0xf6f5
call fcn.00df88d6
jmp 0xdf3e78

Function at 0xdfa998
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
mov dx, word [ecx]
clc
bt si, 8
cmp edx, 0x6b
pushal
lea esp, [esp + 0x44]
jl 0xdfe3c8
pushfd
lea esp, [esp + 4]
je 0xdf6391
aas
mov eax, dword [ebp - 0x104]
bts cx, cx
mov ecx, dword [eax + 0x30]
bt si, cx
jmp 0xdfac49
push dword [esp]
lea esp, [esp + 0x14]
je 0xdf8c42
xchg cl, al
lahf
bsr ax, bx
rcl eax, cl
mov eax, dword [ebp - 0x104]
shl ch, cl
rol ch, 3
sbb ecx, 0xb1ab6e54
pushfd
mov ecx, dword [eax + 0x30]
cmp dl, bl
pushal
sub edx, edx
bsf dx, bx
shl dh, cl
jmp 0xdf7e82
pushfd
jmp 0xdfdb8a
xor edx, edx
bsf dx, ax
rcr dh, cl
mov dx, word [ecx]
push dword [esp]
cmp edx, 0x4b
call fcn.00df657c
push eax
invalid

Function at 0xdfab06
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0xdfcaec
shl ch, 7
btc cx, 4
cwde
mov dword [ebp - 8], 0
stc
mov eax, dword [ebp - 8]
not cl
mov ecx, dword [ebp - 0x64]
pushfd
test ah, 0x97
mov word [esp], bp
cmp dword [ecx + eax*4], 0
mov dword [esp], eax
mov byte [esp], ch
jmp 0xdf87f3
jmp 0xdf58bf
pushfd
lea esp, [esp + 8]
je 0xdfcef9
bts dx, 8
cmc
rdtsc
shr ecx, cl
mov edx, dword [ebp - 8]
sar cl, 1
add cl, 0x46
movzx cx, cl
mov eax, dword [ebp - 0x64]
or ch, bl
and cx, bx
movzx ecx, bl
not ch
mov ecx, dword [eax + edx*4]
test bh, dh
cmc
cmp dl, al
and ecx, 0x80000000
cmp dl, dl
cmc
cmc
cmp ecx, 0x80000000
pushal
mov dword [esp + 0x1c], esp
jmp 0xdf32ca
mov byte [esp], cl
test al, 0xa7
cmp edx, 0x4c
call fcn.00df55fd
cmc
cmp si, si
test eax, eax
jmp 0xdfcadb
jb 0xdf5d9e
pushal
lea esp, [esp + 0x20]
je 0xdfcaec

Function at 0xdfab87
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xdfc179
push ecx
add edx, 0x14645602
mov dword [ebp - 0x60], ecx
bswap eax
pushal
pushal
cmp bp, sp
mov edx, dword [ebp - 0x60]
adc ax, ax
adc cl, bl
xor ah, 0xdf
btc cx, dx
add edx, 2
cwde
push 0x4df7b1c
jmp 0xdf49e6
lea esp, [esp + 0x34]
je 0xdf855e
and dl, 0x47
xadd dx, cx
xor cl, 0xa4
bsr dx, dx
mov edx, dword [ebp - 8]
lea eax, [edi - 0x62252aac]
mov eax, dword [ebp - 0x64]
and ch, ah
mov ecx, dword [ebp - 0xbc]
pushal
push 0x3bff1e2b
pushfd
test cl, 0x85
add ecx, dword [eax + edx*4]
shl dh, 5
sbb dx, 0xb4ce
add esp, 0x28
jl 0xdfae39
bsr ax, dx
mov dword [ebp - 0x60], ecx
rol cx, cl
mov edx, dword [ebp - 0x60]
lahf
add edx, 2
lea eax, [ebp - 0x7a3c1718]
mov dword [ebp - 0x98], edx
jmp 0xdfd4e0
mov eax, dword [ebp - 0x98]
bswap cx
movsx cx, cl
bswap cx
push eax
pushal
movzx cx, cl
movzx cx, cl
movsx cx, al
mov ecx, dword [ebp - 0xb4]
pushal
pushfd
jmp 0xdf7104

Function at 0xdfafbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0xdf796d
rcr ch, cl
bsf cx, bp
mov ecx, dword [ebp - 0x44]
jmp 0xdf9df8
call fcn.00df45ec
call fcn.00dfd327
pushfd
jmp 0xdf2e79
Function at 0xdfb1a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp + 4]
mov dword [esp + 8], 0xdf2cb8
call fcn.00df7efd
cmp bl, 0x4c
push 0xc816bc7d
pushal
lea esp, [esp + 0x24]
jne 0xdfce8f
rol bl, cl
pushal
sub bl, cl
mov bl, byte [eax + 8]
pushfd
cmp bl, 0x6c
mov word [esp + 4], 0x31dc
push 0xc6c8d6b2
call fcn.00df74ac
lea esp, [esp + 0x24]
jne 0xdf8c42
shr cl, cl
rcl ah, cl
mov eax, dword [ebp - 0x104]
sar ecx, 0xa
rol cl, cl
bt bp, bx
lea ecx, [esp + 0x5f50f72b]
mov ecx, dword [eax + 0x30]
call fcn.00df83dd

Function at 0xdfb2e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp cx, cx
mov byte [esp], dh
bt ebx, ebx
sub edx, edx
mov byte [esp + 4], 0x4e
sar dh, cl
rcr dl, cl
mov dx, word [ecx + 8]
pushal
call fcn.00df6188

Function at 0xdfc059
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x72
pushfd
push 0x5abe4195
lea esp, [esp + 0x2c]
je 0xdf8760
not cx
call fcn.00dfaea2
pushfd
push dword [esp + 4]
lea esp, [esp + 0x40]
je 0xdf609c
call fcn.00df4b1b
pushfd
push dword [esp]
mov dword [ebp + 8], eax
sete ah
movsx eax, dl
mov eax, dword [ebp - 0xbc]
mov byte [esp + 4], dh
jmp 0xdfad0f
cmc
push edi
cmp dword [ebp - 0x70], 0
jmp 0xdf6cfe
call fcn.00df597e
clc
cmp edx, 0x6c
pushal
lea esp, [esp + 0x44]
je 0xdfbcb6
ror cl, cl
sete al
das
mov eax, dword [ebp - 0x104]
sbb ch, 0x38
rcr ecx, 1
clc
mov ecx, dword [eax + 0x30]
call fcn.00dfe07b
xchg ch, al
rdtsc
bsf ax, cx
cmp si, ax
mov ecx, dword [ebp - 0x2c]
neg dl
mov edx, dword [ebp - 0x30]
bsr ax, sp
das
sal al, 4
dec eax
mov dword [ecx + 4], edx
pushal
setae al
mov dword [esp + 0x1c], 0
sal eax, 0x17
cmc
mov dword [esp + 0x18], 1
ror al, cl
sub ch, 0x74
aad 0x21
rol al, cl
mov eax, dword [ebp - 0xbc]
and ch, dl
jmp 0xdfa1ca
btc ax, sp
mov eax, dword [ebp - 0x104]
add cl, ch
bsf cx, bx
mov ecx, dword [eax + 0x30]
clc
push 0xbacf6e67
clc
stc
xor edx, edx
sar dl, cl
mov dx, word [ecx + 6]
pushfd
cmc
cmc
cmp edx, 0x6e
call fcn.00df3ce2
jmp 0xdf28ef
pushal
jmp 0xdf1913

Function at 0xdfc0cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, edx
and dh, 0xc9
push 0xde188ccc
btc dx, dx
mov dx, word [ecx + 0xa]
pushfd
stc
jmp 0xdf9245

Function at 0xdfc0e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], cl
push ebp
lea esp, [esp + 0x28]
jne 0xdf80bc
push ebx
pushal
pushfd
lea esp, [esp + 0x28]
jmp 0xdfca9c

Function at 0xdfc453
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
call fcn.00df65f2
lea esp, [esp + 0x48]
jne 0xdfcdfe
test dh, dl
mov eax, dword [ebp - 0x100]
bsf ecx, edi
stc
btc ecx, esp
not ecx
mov ecx, dword [eax + 0x30]
bt eax, eax
jmp 0xdf72b8
mov dword [esp + 4], 0x40
pushfd
jmp 0xdf71b0
mov word [esp + 4], 0xdf70
push dword [esp + 8]
lea esp, [esp + 0x10]
je fcn.00dfd2f9
mov al, bl
bswap ax
movzx ax, al
lea eax, [ebp - 0x128]
push edi
mov byte [esp], 0x85
mov dword [esp], eax
push 0x1794bdd8
push esi
jmp 0xdf9e1f
Function at 0xdfc55a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x2a02faff
push esp
pushfd
mov dword [esp + 8], eax
pushal
jmp 0xdfd4b7
pushfd
pushal
mov word [esp], 0xb4f5
mov dword [ebp - 0x90], 0
push dword [esp + 0x10]
call fcn.00dfab2c
movzx edx, cl
shr eax, 0x1c
ror dh, cl
or al, 0x40
mov edx, dword [ebp - 0xa0]
cmp ah, dl
shr ah, cl
call fcn.00df2e91
push dword [ebp - 0x14]
pop dword [esp + 0x24]
pushfd
mov byte [esp + 8], ah
push 0x5e361515
push dword [esp + 0x2c]
ret 0x30
push 0xfe7aef27
mov dword [esp + 0x28], 0xdf9cc4
jmp 0xdf8869
jb 0xdf363c
pushfd
push dword [esp]
mov dword [esp + 4], eax
push 0x3d097501
pushal
jmp 0xdf96eb
lea esp, [esp + 0x28]
jne 0xdfddf0
pushfd
mov word [esp], sp
jmp 0xdfc9c3
mov word [esp], 0x8189
mov dword [ebp - 0xc], 0x2000
lea esp, [esp + 4]
jmp 0xdf3eea
movzx ax, bl
mov eax, dword [ebp - 0x10c]
jmp 0xdfb592

Function at 0xdfc5ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ch
not ax
neg ecx
mov eax, dword [ebp - 0x100]
clc
mov ecx, dword [eax + 0x30]
push 0x3ee26fee
call fcn.00dfa962
lea esp, [esp + 8]
jne 0xdfcdfe
inc ch
ja 0xdf5d83
mov eax, dword [ebp - 0x100]
neg cl
mov ecx, dword [eax + 0x30]
pushfd
push dword [esp]
pushal
sub edx, edx
rcl dl, cl
bt bp, 9
call fcn.00df2ffa
mov byte [esp + 4], 0x24
call fcn.00df53e1
int3

Function at 0xdfcc89
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
lea esp, [esp + 0x14]
jne fcn.00dfd2f9
bt esp, edi
mov eax, dword [ebp - 0x44]
cmc
sub ecx, ecx
rcl cl, 6
mov cl, byte [eax + 3]
bt bp, 5
cmp ecx, 0x72
pushal
pushal
jmp 0xdf3720

Function at 0xdfccba
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00df2a5b
cmp edx, 0x2e
push eax
push 0x1d7778
lea esp, [esp + 0x10]
jne 0xdfcdfe
bsf ecx, esp
stc
bt bx, 5
not ah
mov eax, dword [ebp - 0x100]
bswap cx
push esi
neg cl
shl ch, cl
mov ecx, dword [eax + 0x30]
pushfd
test ah, ah
pushfd
sub edx, edx
stc
mov dx, word [ecx + 0xc]
pushal
push 0x43ee8ecb
cmc
clc
cmp edx, 0x64
call fcn.00df24a6

Function at 0xdfcd9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0xdf855e
cmp bl, dl
sub dl, al
mov edx, dword [ebp - 8]
btr ax, 0xb
aam 0xc1
aaa
stc
mov eax, dword [ebp - 0x64]
sal cx, cl
shrd cx, sp, cl
mov ecx, dword [ebp - 0xbc]
stc
call fcn.00df7806

Function at 0xdfcf87
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x4c]
jne 0xdf8c42
adc ah, 0xaa
aam 0x82
lahf
neg ah
mov eax, dword [ebp - 0x104]
bsr ecx, ebx
clc
or ecx, esi
adc cx, 0xe47c
mov ecx, dword [eax + 0x30]
call fcn.00df524f
Function at 0xdfd01c
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
cmp bl, 0x4c
pushal
jmp 0xdf9bba
cmp bl, 0x6e
pushfd
lea esp, [esp + 8]
je 0xdf8d75
cmp bh, 0x21
stc
test dh, 0xd
cmp bl, 0x4e
pushal
pushal
lea esp, [esp + 0x40]
jne 0xdfce8f
rcr bl, cl
mov bl, byte [eax + 1]
call fcn.00df4faa
test dl, 0x16
cmp edx, 0x6c
pushfd
lea esp, [esp + 8]
je 0xdfa7bb
stc
not ch
shr ah, 3
mov eax, dword [ebp - 0x100]
movzx cx, cl
mov ecx, dword [eax + 0x30]
stc
stc
cmp ecx, 0x1ae647d6
call fcn.00df4454
lea esp, [esp + 0x24]
jne 0xdfce8f
bt di, 0xa
not bl
mov bl, byte [eax + 8]
call fcn.00df4887
mov eax, dword [ecx]
dec dx
dec dl
jmp 0xdfc268
adc eax, ebx
not ah
cwde
cmc
mov eax, dword [ecx + 0xc]
or al, 0x9c
stc
bt cx, 7
test eax, eax
mov byte [esp], 0xc3
pushal
lea esp, [esp + 0x24]
je 0xdfc26e
pushfd
add eax, edx
cmc
rol bl, 7
mov bl, ah
test al, ch
mov bl, byte [eax]
stc
jmp 0xdf8d51
mov dword [ebp - 0xdc], eax
push 0xcacbe22
bswap dx
btc edx, edx
mov edx, dword [ebp - 0xac]
add esp, 4
jl 0xdfd7e8
pushal
clc
add edx, 0x100022cb
push ebp
mov dword [esp + 0x20], edx
push edi
call fcn.00df26fe
pushfd
bt ebx, 0x1a
add ecx, 0x14
mov byte [esp], bl
mov dword [esp], 0x48c74c94
lea esp, [esp + 4]
jmp 0xdfb138
jmp 0xdf8d47
clc
call fcn.00df9a6f

Function at 0xdfd02e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
call fcn.00df17d0
sub eax, eax
test bh, bl
add al, 0xe4
ror al, cl
mov al, byte [edx + 5]
pushfd
cmp eax, 0x32
push 0x73e5e07b
lea esp, [esp + 8]
je 0xdfc095
and cx, dx
and ecx, edi
cmc
mov ecx, dword [ebp - 0x44]
pushfd
bt ax, sp
test dh, 0x54
sub edx, edx
mov byte [esp], 0x6a
push 0x797eb304
lea esp, [esp + 8]
jmp 0xdfc06c

Function at 0xdfd0bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
lea esp, [esp + 0x2c]
jne 0xdfce8f
clc
push 0x3dd2bb66
not bl
shr bl, cl
mov bl, byte [eax + 9]
cmp bh, 0x5a
cmc
bt ax, sp
clc
test bl, bl
pushfd
pushfd
call fcn.00dfccb5

Function at 0xdfd2b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp], 0xdf60e6
jmp 0xdf4dac
jmp 0xdf4a1e
mov eax, dword [ebp - 0x10c]
pushal
pushal
pushfd
mov dword [esp + 0x40], eax
jmp 0xdfdfa5
pushal
jmp 0xdfb238
lea esp, [esp + 0x28]
jne 0xdf4038
push 0xdf60e6
call fcn.00df1c36
movzx ax, cl
jmp 0xdf43d1
call fcn.00df1b88

Function at 0xdfd2ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0xdf6fe8
pushal
mov dword [esp + 0x1c], 0x8000
call fcn.00dfadc0

Function at 0xdfd35b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00dfb66f
jmp 0xdf8bb1

Function at 0xdfd3a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x10]
jne 0xdfce8f

Function at 0xdfd3cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0x1c]
push 0x9f76fa39
push esp
mov dword [ecx], eax
mov dword [esp + 4], 0xaf939f
pushfd
lea esp, [esp + 0x1c]
jmp 0xdfca9c
Function at 0xdfd59a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00df25f4
pushfd
push 0x9fd64b38
lea esp, [esp + 8]
jne 0xdfce8f
bt ebp, esi
mov bl, byte [eax + 9]
bt bx, si
test bl, bl
pushal
lea esp, [esp + 0x20]
je 0xdfa8b0
test ch, 0xb5
push esp
pushfd
bt sp, 0xc
add ecx, 0x14
pushfd
lea esp, [esp + 0xc]
jmp 0xdfb138
test ah, 0x96
test bl, 0x11
pushal
cmp ecx, 0x33
mov word [esp + 0xc], cx
lea esp, [esp + 0x24]
jne fcn.00dfd2f9
and dl, 0xf1
bsr edx, ecx
mov edx, dword [ebp - 0x44]
stc
sub eax, eax
add al, 2
stc
bt ecx, edx
test bl, al
mov al, byte [edx + 5]
jmp 0xdf59c6
cmp edi, 0xffffffff

Function at 0xdfd7f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xdfb0bb
xadd ch, al
mov eax, dword [ebp - 0x100]
rcl cx, cl
cmp bh, al
and cx, 0x2cfe
cmp dl, dl
mov ecx, dword [eax + 0x30]
test ebp, 0xad5c8e8
pushal
sub edx, edx
dec dl
and dl, bl
mov dx, word [ecx + 8]
bt di, sp
call fcn.00df1942

Function at 0xdfd83e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
inc dh
mov ecx, dword [ebp - 0x90]
bt bx, 0xc
shl dl, cl
xor dh, dh
movzx dx, cl
push ecx
movzx dx, cl
neg dl
push 0
shr dl, cl
sbb edx, edi
dec dl
push 0
lea edx, [esi*4 + 0x28846e9d]
setnp dl
inc dl
mov edx, dword [ebp - 0xac]
pushal
test al, dl
test bl, 0x4b
add edx, 0x10002361
call fcn.00df449a

Function at 0xdfd88a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
jne fcn.00dfd2f9
sbb ah, dl
movzx ax, bl
sbb ah, 0x96
mov eax, dword [ebp - 0x44]
clc
pushal
xor ecx, ecx
bt edx, eax
not cl
sar cl, 7
test bx, 0xc3
mov cl, byte [eax + 6]
clc
jmp 0xdf9d7c
sub edx, edx
pushal
and dl, ah
dec dl
sub dl, 0xd6
mov dl, byte [ecx + 5]
pushfd
stc
cmp edx, 0x32
push dword [esp + 4]
mov byte [esp + 4], dl
jmp 0xdf9207

Function at 0xdfdc1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + 0x30]
bt cx, cx
stc
bt bx, di
xor edx, edx
stc
call fcn.00df2c1b
cmp edx, ecx
test dl, 0x61
mov dword [ebp - 0x11c], eax
bt esi, ebp
cmp eax, 0xea
call fcn.00dfd2ce
mov byte [esp + 8], dl
pushal
mov dword [esp + 0x40], 0xdf1859
pushfd
push eax
push dword [ebp - 0xd4]
pop dword [esp + 0x44]
mov byte [esp], 0xbf
pushfd
push dword [esp + 0x48]
ret 0x4c
lea esp, [esp + 8]
je 0xdfb0bb
lahf
mov eax, dword [ebp - 0x100]
jmp 0xdf4aca