joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d092e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dl, 0x69
lea esp, [esp - 8]
push ebx
rcr al, 0x33
push ebp
cmp cx, bx
and bl, dh
push esi
mov esi, ecx
add ax, sp
mov eax, 0x30c30c31
test si, ax
xchg ch, dh
shrd ecx, edi, 0x2f
mov ebp, dword [esp + 0x1c]
btc ecx, esi
btr dx, si
mov ebx, dword [esi + 8]
btr edx, esp
setg dh
mov ecx, dword [esi + 0xc]
shl dl, 0x26
sub ecx, ebx
bsf dx, bx
push edi
cwd
imul ecx
clc
lahf
sar edx, 4
sub ax, 0x961
sbb ah, 0xd9
mov eax, edx
mov dword [esp + 0x10], esi
shr eax, 0x1f
add edx, eax
cmp edx, ebp
jae 0x4a5a3a
mov edi, dword [esi + 4]
test al, 0x61
cmp ch, 0x40
jmp 0x4b7885

Function at 0x5d663e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
push ebp
mov ebp, esp
push 0xffffffffffffffff
cmp ah, bl
push 0x101fccc4
push 0x100cbc04
ror al, cl
sub ah, 0xfa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
jmp 0x4c629d

Function at 0x5d6f58
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
shr ah, 0x8c
movsx eax, dx
push 0xffffffffffffffff
adc eax, 0x548847be
lahf
cwde
push 0x100de9c0
mov eax, dword fs:[0]
push eax
ror al, 0xe9
lahf
mov dword fs:[0], esp
sar ah, cl
bt ax, bp
sub esp, 0x50
push ebx
movzx eax, di
lahf
cmove ebx, ebx
mov ebx, dword [ebp + 0xc]
push esi
jmp 0x65273f
push edi
bswap eax
mov edi, dword [ebp + 0x10]
mov si, 0x1ba5
movzx eax, bx
mov esi, ecx
mov cx, bx
lea eax, [ebp + 0x18]
not ch
bswap ecx
mov dword [ebp - 0x10], esp
push eax
lea ecx, [ebp + 0x14]
jmp 0x4aa286

Function at 0x5da2d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp 0x4a259c

Function at 0x5dea74
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebp
rcl dword [edx + 0x61]
push dword [esp + 4]
jmp 0x4a55cb

Function at 0x5ebf61
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
push esi
mov esi, ecx
test si, cx
stc
test al, 0x99
cmp dword [esi + 0x78], 1
jmp 0x4c2306

Function at 0x5ecc41
Capabilities:
Execute anti-debugging instructions

Disassembly:
in eax, dx
rol byte [ebx - 0x3f7cba18], 0xd8
push ss
xchg ebp, esi
lea esp, [esp + 4]
sub ebx, eax
mov eax, esp
lahf
pop edi
pop esi
mov ebp, 0x61f6555b
cmove bp, ax
lea eax, [edx + ebx*4]
setbe bl
movsx ebp, cx
pop ebp
pop ebx
jmp 0x52c114
ret
push esi
mov esi, ecx
ror cl, 0xff
push edi
rol ch, cl
mov edi, dword [esp + 0xc]
test ebx, 0x1b9f00d0
bsf cx, si
mov ecx, dword [esi + 4]
cmp ecx, edi
jmp 0x60ce08
je 0x4e7e95
test ecx, ecx
jmp 0x60f14b
je 0x4a5e83
push esi
jmp 0x4a5e7e
Function at 0x5ed62e
Capabilities:
Execute anti-debugging instructions

Disassembly:
in al, dx
sbb al, 0
cmp eax, esi
je 0x4e33ca
cmp edi, esi
jmp 0x4e33b2
push dword [ebp + 0xc]
call fcn.005348e5
test eax, eax
jmp 0x60e6ad
je 0x4e33bd
mov esi, dword [edi + 0x1c]
xchg edi, edi
mov dword [ebx + 0x20], esi
mov ebx, 0x5ef17ba3
add byte [edi], cl
test dword [ecx - 0x740000c2], ecx
cmp eax, 0x100e13ac
jmp 0x4e99b7
push ebp
push ebp
jmp 0x539ec2
invalid
sub ebp, ebp
jmp 0x4e6e4c
je 0x536b38
cmp eax, 2
jne 0x60e6b3
push eax
jmp 0x4ddd19
push 0x19f
jmp 0x5468fd
push dword [esi + 0x1c]
jmp 0x699503
push 0xffffffffffffffff
rol ax, cl
btr eax, 4
push 0x100de3a1
test bx, 0x4009
or ah, dl
shl ax, cl
mov eax, dword fs:[0]
cmc
test di, bp
clc
push eax
bts ax, di
or al, dh
shr al, 0x44
mov dword fs:[0], esp
xchg al, al
and ax, 0x2c3e
sub esp, 0x88
sub ax, bp
push ebx
neg al
xchg al, ah
bts eax, ecx
push ebp
push esi
mov esi, ecx
mov ax, si
xor bp, 0x1fc3
mov eax, dword [esi + 0x60]
and bp, bx
mov ebp, dword [esi + 0x74]
stc
cmp eax, 0xc
mov dword [esp + 0xc], ebp
jne 0x62f674
test ebp, ebp
jle 0x4f32e4
mov eax, ebp
cmc
test si, sp
jmp 0x65fed6
mov edi, 0xdf8b66fc
mov ecx, dword [ebp - 0xc]
movsx edi, dx
jmp 0x611fed
dec ebp
hlt
mov dword fs:[0], ecx
pop edi
mov bl, 0x7a
pop esi
jmp 0x4af788
mov eax, dword [esi + 0x7c]
jmp 0x4e440d
test eax, eax
jmp 0x4c1e5f
retf

Function at 0x5ee9e1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x60045411
clc
jmp 0x626326
mov ecx, dword [esi + 0x248]
cmp cx, bp
test ecx, ecx
jne 0x645d70
sub edx, edx
jmp 0x63cb18
push ebp
btc cx, 0x9b
sal cl, cl
not al
mov ebp, esp
ror ch, 0x55
push esi
rcr cx, 0xd
sal cl, cl
rol cx, 0xed
mov esi, 0xf
lea ecx, [ebp + 8]
ror ax, 0xa0
xor al, 0xcf
lea ecx, [ecx + esi*8 - 4]
sar eax, cl
xadd eax, eax
setb ah
mov eax, dword [ecx + 4]
clc
test eax, eax
jmp 0x5f2a62
je 0x6480e1
push dword [ecx]
jmp 0x6480e1
stosd dword es:[edi], eax
pop ds
in eax, dx
inc esi
inc esp
and al, 0x10
adc ecx, ebp
inc edx
stosd dword es:[edi], eax
invalid
jne 0x63cb26
mov esi, ecx
cmp esi, 0x700a137d
test ebp, ebp
jmp 0x4fd467
call 0x914e4d99
cmp al, 0xfe
call dword [edi + 0x56]
jmp 0x4b2db7
test dword [ecx], ebp
jge 0x645d59
dec dword [ebx - 0x56dbdbbc]
scasb al, byte es:[edi]
jg 0x645d96
jae 0x54d9e45
ljmp 0x748b:0xf38b66ff
sti
dec dword [ebx - 0x54f0f7a9]
invalid
dec esi
stc
test ch, al
cmp ecx, 0x4c82d45
lea ecx, [ecx - 8]
cmc
test esi, esi
jne 0x5eea15
call dword [ebp + 8]
pop esi
jmp 0x50d273

Function at 0x5ef34c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lds esp, [esi - 0x68]
push esi
mov esi, ecx
rcl ax, 0x1d
bsr ax, si
mov ecx, dword [esp + 8]
rcr eax, cl
rcl ax, cl
bswap eax
mov eax, dword [esi + 0xd0]
lea eax, [eax + ecx]
stc
cmp ebp, 0x21666714
cmp eax, 0xc8
jmp 0x4e6330

Function at 0x5fa8e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
out dx, al
mov edx, dword [esp + 8]
jmp 0x4b48b9
mov eax, dword [esp + 4]
test dword [eax + 0x78], 0x400000
je 0x5eb0a7
mov ecx, dword [esp + 8]
jmp 0x4acadb
Function at 0x5fbc31
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [eax]
leave
jmp 0x4c87da
push ebp
mov ebp, esp
cwde
mov eax, dword [ebp + 8]
jmp 0x5ed230

Function at 0x602d13
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and ah, al
push 0xffffffffffffffff
push 0x100df650
btr eax, edx
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
lea esp, [esp - 0x24]
stc
cmp si, bp
cmc
push ebx
not bh
setp bl
bsr bx, si
mov ebx, ecx
movzx cx, bh

Function at 0x60be02
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
bts bp, cx
mov ebp, esp
sub esp, 0x34
jmp 0x62d99f
mov dword [ebp - 4], 0

Function at 0x610f24
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov edx, 0x80
adc esi, ecx
mov eax, dword [esp + 4]
sub esp, 8
test ch, 0xa9
test eax, eax
jbe 0x6180f2
cmp eax, 0xffff
jmp fcn.00464371
add esp, 8
jmp 0x5036c4

Function at 0x61264a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
out 8, eax
test si, 0x5d47
cmp esp, 0x50e73bdf
cmc
add edi, ebp
cmp ah, dh
cmc
add esi, 2
jmp 0x65adb4
mov word [eax + 8], di
mov eax, dword [esp + 0x1c]
jmp 0x4b21ad

Function at 0x614d46
Capabilities:
Encode data using xor

Disassembly:
not cl
bts cx, ax
mov ecx, eax
imul ecx, ecx, 0x7fffffff
stc
add ecx, edi
stc
lea eax, [ebx + eax*2]
shl ecx, 1
push ecx
mov eax, dword [ecx + 4]
cmp ebp, edx
and eax, 1
jmp 0x4e0802

Function at 0x615b52
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi + 0x3c], 0x20
jmp 0x6455d0
push 0x2d
jmp 0x5d0bbc
sub esp, 0x2ec
cmc
stc
push ebx
test ebx, ebp
push esi
bt si, 0x5d
bts si, sp
mov esi, ecx
cmc
push edi
xor ebx, ebx
jmp 0x609199
mov dword [esi + 0x108], ebx
jmp 0x4c1510

Function at 0x616749
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub dword [ecx], edx
sub byte [ecx + 0x51595702], bh
push ebp
mov ebp, esp
push 0xffffffffffffffff
stc
setge al
push 0x100ddc60
clc
mov eax, dword fs:[0]
cmp ah, ch
stc
push eax
bts eax, esi
test edi, 0x57ab633f
sub eax, edi
mov dword fs:[0], esp
and al, 0xb8
lea esp, [esp - 0x4c]
bswap ax
mov eax, dword [ecx + 0xc4]
push ebx
clc
test bh, 0x34
push esi
cmp al, 0xec
cmc
cmp eax, 2
jmp 0x4a3d87

Function at 0x6167bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
push ebp
not bp
mov ebp, esp
mov bp, 0x15c7
add byte [ebx + 0x55c35de5], cl
sub bp, di
mov ebp, esp
test sp, 0x79e9
sub ebp, ebp
cmp esi, edi
jmp 0x4a9bea

Function at 0x61cdde
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword fs:[0]
cmp dx, cx
push 0xffffffffffffffff
stc
push 0x100def58
cmp esi, 0x6de9346d
push eax
mov dword fs:[0], esp
lea esp, [esp - 0x34]
push esi
movzx esi, ax
and esi, 0x58c50352
cmovl esi, ebp
mov esi, ecx
inc cx
mov ecx, dword [0x10191fc8]
cmc
push edi
jmp 0x620c4e
sub edi, edi
stc
cmp sp, bp
cmp ecx, edi
jmp 0x4b84fc
Function at 0x624238
Capabilities:
Execute anti-debugging instructions

Disassembly:
call dword [0x100e1298]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x63da40
mov edx, dword [ebp + 8]
jmp 0x4ac4bf
push ecx
jmp 0x602260
push ebp
mov ebp, esp
push ecx
movzx ax, ch
bswap ecx
mov eax, dword [ebp + 8]
setae ch
xchg ecx, ecx
push eax
setne ch
push 0
movsx ecx, bp
mov ecx, dword [0x10191984]
jmp 0x614440
mov eax, dword [ebp - 4]
jmp 0x513282

Function at 0x62b4e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [edi], cl
test byte [edi], bh
sub eax, 0xe9560001
sub ch, byte [0x45c70001]
aam 0x30
and al, 0x16
adc cl, ch
pop ss
sub esp, 0x2c
push ebx
mov cx, sp
cmova cx, di
push ebp
setno bl
mov ebp, dword [esp + 0x3c]
movzx bx, al
movzx ebx, bx
push esi
push edi
seto bh
movzx ecx, si
push 0
sete ch
mov bl, dh
lea ebx, [ebp + 0x14]
push 0
mov cl, 0xb
mov ecx, ebx
jmp 0x4fd2e9

Function at 0x62bc60
Capabilities:
Execute anti-debugging instructions

Disassembly:
in al, dx
dec eax
mov eax, dword [esp + 4]
sal edx, cl
stc
clc
mov edx, dword [ecx + 4]
cmp sp, 0x4fe7
cmc
jmp 0x641919
cmp eax, edx
jmp 0x4a2eaf

Function at 0x62cc10
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [0x100e13ac]
push dword [esp + 0x10]
movsx esi, bp
not si
mov esi, ecx
push 0x1108
jmp 0x4d0aaa
push dword [esi + 0x1c]
jmp 0x4e17f2
call edi
push eax
call fcn.004d0de0
test eax, eax
je 0x69762d
push 0
push dword [esp + 0x10]
jmp 0x530624
test esi, ebp
or eax, dword [ecx]
add byte [ecx + 0x101813dc], ah
push 0x1109
push dword [esi + 0x1c]
jmp 0x69762b
test ecx, ecx
jbe 0x4b5ee2
mov ebp, ecx
setne bl
mov bl, byte [esi - 1]
jmp 0x62df79
lea eax, [esi + ecx*2]
je 0x5d3815
cmp ecx, 1
jmp 0x652b74
dec esi
jmp 0x507c72
jbe 0x4bf303
lea ebp, [ecx - 1]
jmp 0x499e9c
lcall 0x1628, 0x568a2cca
invalid

Function at 0x62d91e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, ecx
lahf
push 0
mov eax, dword [esi + 0x9c]
push eax
mov eax, dword [esi + 0xb8]
jmp 0x4b1340
Function at 0x630daf
Capabilities:
Check for software breakpoints

Disassembly:
add dl, byte [edi + 0x59]
push ecx
and byte [esi - 0x67], ah
lea edx, [ecx + edi]
jmp 0x536bd9
add byte [edi], cl
test bl, bh
mov bl, 0x19
add bh, bh
jne 0x4d9681
jmp 0x53d4ea
push dword [ebp + 0x10]
push dword [ebp + 0xc]
jmp 0x68a5ab
je 0x613b10
mov eax, edx
clc
sub eax, ecx
jmp 0x691f1b
push esi
jmp 0x4de54c
call fcn.00611c15
add esp, 0xc
cmp eax, 0xffffffff
jmp 0x4d9697
lea ecx, [ebp - 0x1c]
call 0x43f2b6
mov edx, dword [esi + 4]
rcr ah, 0x77
mov ecx, esi
mov ecx, dword [esi]
and ax, di
push 0
adc eax, ebx
neg ax
mov dword [ebp - 4], 0
clc
mov edx, dword [edx + 8]
mov eax, dword [ecx]
stc
test edx, 0x4ba90f8f
imul edx, edi
push edx
jmp 0x65a07c
push eax
jmp 0x5eab72
push ebp
bt eax, 0x4c
adc bp, 0x6084
mov ebp, esp
push 0xffffffffffffffff
cmc
bswap eax
btr eax, 0xc4
push 0x100df5e8
sbb al, 0xaa
mov eax, dword fs:[0]
push eax
mov ah, 0x74
shl al, 0x5f
btc ax, si
mov dword fs:[0], esp
rcl ah, cl
sub esp, 0x10
test bl, 0x27
sbb ah, bl
push ebx
btc ax, 0xe
btr eax, eax
push esi
mov esi, ecx
rcr ah, cl
setge ah
clc
push edi
add al, 0xb5
btr di, dx
adc di, sp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], esp
mov eax, dword [esi + 0x1d8]
clc
test eax, eax
jle 0x5edcbd
push edi
jmp 0x642574
push eax
bswap ax
lahf
lea eax, [esi + 0x1dc]
jmp 0x5ffc64
mov byte [ebp - 4], 1
jmp 0x4c378a
fld st(3)
cdq
or dword [eax], ebx
pop ds
fnstcw word [ecx + 0x26]
mov eax, 0x3fa71acf
loope 0x68a5bb
inc ebx
sub bh, byte [ebx - 0x28]
lodsb al, byte [esi]

Function at 0x63163d
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 0x58]
jmp 0x52294b
invalid
push 0x1017cc68
push edx
jmp 0x66e35e
mov dword [esi + 0x48], edi
jmp 0x4da02e
push ebp
mov ebp, esp
cmc
stc
test sp, cx
lea esp, [esp - 0x44]
push esi
mov esi, dword [ebp + 8]
push edi
sub edi, edi
cmc
cmp esi, edi
jmp 0x65f8ac
mov dword [ebp - 4], eax
je 0x5d2aa7
cmp dword [esi + 0x48], edi
jbe 0x5d2aa7
cmp eax, esi
jmp 0x4b6eab
cmp eax, edi
jmp 0x64a058
je 0x4a0539
mov eax, dword [esi + 0x44]
jmp 0x64e5c6
xor byte [eax + esi + 0x54], cl
xor byte [eax + 0x30], bl
pop esp
xor byte [eax + 0x30], ah
insb byte es:[edi], dx
xor byte [eax + 0x30], dh
je 0x66e39f
xor byte [eax], 0x84
xor byte [eax - 0x6bcf6fd0], cl
xor byte [eax - 0x57cf63d0], bl
xor byte [eax + esi + 0x30b830b0], ch
mov esp, 0xc430c030
or al, 0x31
Function at 0x632098
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
cmp ebx, esi
cbw
neg eax
mov ecx, dword [ebp + 0x18]
xor al, ch
mov eax, dword [ebp + 0x14]
push ebx
push esi
sub esi, 0x491227ab
clc
xadd esi, esi
and dword [ecx], 0
or si, 0x5b62
sar esi, 0x42
cmp bh, 0xc8
mov esi, dword [ebp + 0x10]
cmp ch, 0x1d
push edi
and di, 0x5bb3
mov edi, 0x700f2cc9
cmova edi, edi
mov edi, dword [ebp + 0xc]
test bl, al
cmp ch, 0x13
mov dword [eax], 1
dec eax
mov eax, dword [ebp + 8]
clc
test edi, edi
je 0x632109
mov dword [edi], esi
cmp si, bx
cmp edi, 0x20f314e5
add edi, 4
mov dword [ebp + 0xc], edi
test esi, 0x6e4a0488
cmp byte [eax], 0x22
jmp 0x656adf
jne 0x4a6261
mov dl, byte [eax + 1]
jmp 0x4a67ca

Function at 0x634c1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 8]
test esi, esi
jmp 0x4c93f0
push esi
jmp 0x60a438

Function at 0x636e42
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xdd
jmp 0x49bac2

Function at 0x638a77
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [ecx - 0x16b7dbbc], cl
mov dh, 0x22
idiv edi
inc ecx
test eax, eax
mov dword [esi + 0x1d4], ecx
jmp 0x503cb8
push ebp
mov ebp, esp
cmove ax, bx
sub esp, 8
lahf
bswap eax
push ebx
movzx eax, sp
inc ax
push esi
mov esi, ecx
push edi
bswap eax
mov ax, 0x613f
dec eax
mov dword [ebp - 4], esi
setae ch
mov ecx, dword [esi + 0x1d4]
mov eax, dword [esi + 0x228]
jmp 0x624108

Function at 0x63b264
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
dec esi
xor byte [ebx], bh
retf
nop
nop
nop
nop
jmp 0x63156f
push edi
xchg di, di
push eax
push ecx
cbw
not ecx
mov eax, dword [ebp + 0x10]
movzx ecx, si
mov ecx, dword [ebp + 0xc]
push ecx
movsx edi, bp
mov edi, dword [ebp + 8]
jmp 0x499d0e
jle 0x65f895
mov eax, dword [ebp + 8]
cmovl cx, si
mov ecx, dword [eax]
or ah, 0x92
mov eax, dword [ebp + 0x10]
test esi, 0x2d4c7a63
cmp bx, 0x58d4
cmc
cmp ecx, eax
jne 0x5f8e23
sub eax, eax
pop edi
jmp 0x656098
mov dword [ebp - 4], 0xffffffff
jmp 0x5f906d
dec dword [eax - 0x17]
test eax, 0xf5ffe935
sub edx, edx
jmp 0x4c0b9a
push ebp
mov ebp, esp
bts ax, si
sal al, cl
push ecx
rcl ah, cl
sub ax, si
rol ax, cl
mov eax, dword [ebp + 0xc]
clc
push edi
cmp ebp, ebx
test bp, 0x2fe6
stc
test eax, eax
jmp 0x60c993
mov esp, ebp
mov ebp, ebx
pop ebp
jmp 0x50525b
mov eax, dword [ebp - 4]
jmp 0x50c9a7

Function at 0x63c198
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
push eax
jmp 0x4bce82
push 0xffffffffffffffff
push 0x100dddd8
mov eax, dword fs:[0]
jmp 0x63aa96
Function at 0x63f9d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ds
add byte [eax], 0
add byte [eax], al
jmp 0x53d33a
push 0xffffffffffffffff
cwde
push 0x100dd418
sub eax, 0x5a727577
bsf eax, edi
cmp di, bx
mov eax, dword fs:[0]
test ah, 0x9e
test eax, edi
push eax
clc
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
not bx
bswap ebx
movzx ebx, bx
push esi
movsx ebx, di
mov esi, ecx
mov bx, sp
not ecx
push edi
mov bh, 0xbf
lea ebx, [esi + 0x48]
bswap ecx
mov ecx, ebx
jmp 0x627476
enter 0xffffffffffffcb8b, 0xffffffffffffff8b
mov gs, esp
add al, 0
add cl, ch
and edx, dword [edi + 0x61e8fffe]
mov ch, dl
inc dword [ebx - 0x3908f33c]
mov al, 0x4b
dec esp
and al, 0x5f
ror bx, 0x99
mov bx, bp
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x4bb5cd
cmc
push esi
push ecx
push edx
sub ecx, ecx
stc
xor edx, edx
mov cl, byte [eax + 0x11]
mov dl, byte [eax + 0x10]
jmp 0x4cee7b

Function at 0x63fe48
Capabilities:
Execute anti-debugging instructions

Disassembly:
or byte [ecx - 0x6fe38aab], 0x90
mov dword [eax + 0x10], ecx
jmp 0x5df061
mov dword [eax + 0xc], ecx
jmp 0x4bb82e
mov dword [eax], 0x10161430
jmp 0x6408aa
mov eax, ecx
test di, 0x2699
stc
xor ecx, ecx
jmp 0x61652a
mov dword [eax + 4], 0x101854f0
jmp 0x645315
mov dword [eax + 8], ecx
jmp 0x5cf3de

Function at 0x640f6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
les edi, [ecx]
push eax
call fcn.005ebd97
xor eax, eax
jmp 0x61ca8e
mov dword [esi + 8], eax
jmp 0x49fc6d
push esi
lahf
not al
mov esi, ecx
mov eax, dword [esi + 8]
jmp 0x5e9a16

Function at 0x6443ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x526cc9
call dword [eax + 0x24]
push 1
mov ecx, esi
jmp 0x611a0a
mov esi, dword [esi + 8]
stc
test esi, esi
jne 0x4db6fe
sub eax, eax
xchg si, si
pop esi
ret 4
je 0x5e09b6
call eax
test eax, eax
jmp 0x61c931
mov dword [esi + 0xc], eax
cmp sp, di
mov dword [esi + 4], 0
cmp di, 0x7151
jmp 0x5e09b6
and al, 0x9c
add byte [eax], al
add bl, dl
stc
mov ecx, edi
sub ebp, ebp
cmc
jne 0x611245
mov dword [esi + 8], eax
jmp 0x61123f
push esi
mov esi, ecx
shld eax, eax, 0xc7
mov eax, dword [esi + 4]
test di, 0x6262
cmp eax, 0x73ba136b
test eax, eax
jmp 0x5eaacc

Function at 0x644d51
Capabilities:
Execute anti-debugging instructions

Disassembly:
fnsave dword [eax]
add al, 0
cmp dword [ebp - 0x20], eax
jne 0x4d1f02
inc dword [ebp - 0xc]
mov dword [ebp - 0x20], 1
cmc
cmp di, 0x6634
cmp si, bp
cmp byte [ebp - 5], 0
jmp 0x511cba
jle 0x4e302a
mov byte [ebp - 0x16], 1
jmp 0x4e302a
push ebp
mov ebp, esp
shr ax, cl
bts ax, dx
movsx eax, di
sub esp, 0x12c
bts eax, esi
sbb ah, 0x5c
movzx eax, sp
mov eax, dword [ebp + 0x14]
push ebx
push esi
test ebp, edi
jmp 0x4d1ee2

Function at 0x64e305
Capabilities:
Execute anti-debugging instructions

Disassembly:
in al, dx
and byte [ebx - 0x3a7ccb40], al
sub byte [ebx - 0x3c7ce63e], al
sbb al, byte [ebx - 0x3a7cdd17]
mov edi, 0x833dc283
in eax, dx
inc byte [ebx - 0x3e7c0012]
fiadd word [ebx - 0x3d7ce33f]
inc esp
mov eax, dword [0x101813dc]
push ebx
mov ebx, dword [esp + 8]
jmp 0x4b4817
Function at 0x651e12
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, eax
xchg ebx, eax
jle 0x4c7a4a
fisttp word [edi]
test dword [ecx], edi
add dword [eax], eax
add byte [ebx + 0x35013106], bh
mov byte [0x7762fa81], al
inc ecx
xchg esi, eax
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x65d0c3
xor eax, eax
jmp 0x4c7a0b
lea eax, [ebp + 0xc]
push 0
jmp 0x4b3828

Function at 0x653ceb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [0xf575c13b], al
call fcn.006357e5
add esp, 0xc
lea edx, [esp + 0x88]
jmp 0x631fa6
cli
idiv bh
push ecx
jmp 0x4f8be0
sbb al, 0x89
inc ebp
stc
cmc
lea ebx, [ebx + 0x32]
cmc
sub ecx, 0xffffffd1
lea edx, [edx + 0x44]
lea edi, [edi + 0x35]
clc
sub esi, 0xffffffd5
lea ebp, [ebp + 1]
lea ecx, [ecx - 1]
stc
clc
lea esi, [esi + 1]
lea ebp, [ebp - 0x2f]
clc
cmp cx, 0x4a31
test edi, ebp
add ecx, 0x41
add ecx, 0x2e
jmp 0x4a34c1
push ebx
mov ebx, 0x65216d03
mov ebx, dword [esp + 8]
jmp 0x505592

Function at 0x65b279
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xchg ebx, eax
add al, 0
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x63f750
add ecx, 1
stc
cmp ecx, 0x55774113
jmp 0x5228b4
jne 0x5228ca
nop
nop
btr dx, cx
shl cl, cl
cpuid
test si, 0x215f
clc
cmp edx, 0x96417762
jmp 0x651d95
jne 0x4e0a16
mov edi, 0x34253204
nop
ror dx, cl
nop
ror cl, 0x64
xor dh, 0xac
cpuid
cmp esi, 0x44935abc
cmp eax, 0x81013844
jmp 0x4ead00
push eax
mov eax, dword [esp + 0x48]
jmp 0x64eccb
ror byte [edi], 0x84
ret
push ecx
xchg cx, cx
push edx
movsx ecx, cx
lea ecx, [esp + 0x14]
add eax, dword [ecx + ebp*8]
loopne 0x651deb
in eax, 0xff
mov eax, dword [esi + 0x104]
mov bp, 0x7289
mov ebp, dword [esi + 0x100]
mov dword [esi + 0x108], eax
cmc
test bh, 0x30
sub eax, eax
shl al, cl
xor ecx, ecx
shr cl, cl
mov al, byte [esi + 0x155]
xor edx, edx
adc dl, 0x56
mov cl, byte [eax + 0x10164610]
sbb dl, 0xe5
mov dl, byte [eax + 0x10164608]
movsx ax, bh
mov eax, ebp
jmp 0x4ca8d0
push eax
movsx dx, dh
movzx ecx, si
bswap cx
mov ecx, dword [esp + 0x4c]
setae dl
movzx dx, cl
mov dh, al
mov edx, dword [esp + 0x48]
jmp 0x5e3902
mov ecx, dword [esp + 0xc]
bts eax, ebp
push esi
rol al, 0xb4
bsf esi, edi
sbb al, al
mov esi, dword [esp + 8]
push edi
cbw
rcr eax, 0xdb
btc eax, esp
mov edi, dword [esp + 0x10]
ror eax, 8
add ah, ch
bts eax, ebx
shl ecx, 7
btr ax, 0x7f
sar al, 0xb4
mov eax, ecx
test di, ax
shr ecx, 2
jmp 0x65e4f2
rep movsd dword es:[edi], dword [esi]
rol ecx, cl
btr cx, 0x85
shl ecx, cl
mov ecx, eax
cmc
jmp 0x666379
and ecx, 3
jmp 0x4e0a16
Function at 0x65dd48
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp byte [ebp - 0xa], dh
mov bh, pe_nt_image_headers32
push ebp
movsx edx, bp
cwd
mov edx, dword [ebp]
jmp 0x65f65b
loopne 0x4fe90f
cmc
clc
add ebx, eax
cmp dword [ebp], 0
jbe 0x60869e
sub eax, ecx
bsf ecx, eax
mov cx, sp
movzx cx, dh
mov ecx, esi
test sp, di
jmp 0x4c36fb
mov eax, dword [esi + 0x24]
stc
mov ecx, dword [eax]
lea eax, [ebx + 0x8c]
sal dl, 0x9c
ror dx, 0x70
mov dword [ebx + 0x74], ecx
bswap dx
mov edx, dword [esi + 0x24]
ror cx, cl
add edx, ebp
push eax
mov ecx, esi
jmp 0x4fe909
cmp edx, ecx
jbe 0x64842d
sub eax, ecx
clc
mov ecx, esi
test dx, dx
cmp bp, ax
add eax, ebp
jmp 0x648427
push eax
call fcn.00667236
mov eax, dword [esi + 0x24]
shld dx, sp, 0x99
shr dx, 0x19
mov ecx, dword [eax]
mov dword [ebx + 0x70], ecx
bt ax, bp
mov eax, dword [esi + 0x24]
xor cx, di
shld cx, ax, 0xdd
rcr dh, 0xa9
mov ecx, dword [esi + 0x28]
xadd edx, edx
cmovne edx, esp
sbb dh, dh
add eax, ebp
mov dword [esi + 0x24], eax
lea edx, [eax + 4]
stc
cmc
cmp edx, ecx
jmp 0x5d46f9
push ebp
mov ebp, esp
shr al, cl
movsx ax, cl
mov eax, dword [ebp + 8]
jmp 0x4d0c2c
xor al, 0x85
ror byte [edi], 0x84
loop 0x65f69c
stc
dec dword [ebx - 0x3678dbba]
sal cx, cl
or dx, si
mov ecx, dword [esi + 0x28]
rol dh, 0x9b
not edx
mov ebp, 4
mov dx, 0x4dcc
rcr dh, cl
adc dh, 0x4e
lea edx, [eax + 4]
jmp 0x6139a7
push cs
adc byte [ebp - 0x16d7dbb4], cl
pushfd
jmp 0xe9b6f68e

Function at 0x65f4da
Capabilities:
Parse pe header

Disassembly:
add byte [eax], al
add byte [eax], al
sbb ah, cl
or byte [edi + 0x31], 0xc6
call fcn.004fb235
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x464f12
push eax
jmp 0x464f0c
push esi
mov esi, ecx
jmp 0x60814e

Function at 0x662269
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
std
invalid
push 0xffffffffffffffff
movsx ecx, ax
setno cl
mov ch, bh
mov ecx, esi
jmp 0x4b9435
je 0x659da6
push eax
jmp 0x661400
push dword [esi + 0x40]
mov ecx, esi
jmp 0x664331
je 0x5dbf61
push 0
jmp 0x50c13f
call fcn.004b7c0e
jmp 0x664336
push esi
mov esi, ecx
mov eax, dword [esi + 0x4c]
test esi, edi
test eax, eax
jmp 0x64e9c4
call fcn.004ec157
test eax, eax
jmp 0x65b36d

Function at 0x662cf9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ecx - 0x7ba4f10d]
inc eax
push ebp
mov ebp, esp
jmp 0x4b2737

Function at 0x6642a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
fld qword [ebp + 8]
jmp 0x4be63f
push ebp
mov ebp, esp
sub esp, 0x10
jmp 0x5dda1c

Function at 0x6648b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.004b8715
add ecx, 0x428
jmp 0x61b3c7