joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036032
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10036054
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10036054
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10036054
ret
cmp word [ebx + 4], 0x14c
jne 0x10036054
test word [ebx + 0x16], 2
je 0x10036054
test word [ebx + 0x16], 0x100
je 0x10036054
cmp word [ebx + 0x18], 0x10b
jne 0x10036054
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10036054
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x100360e0
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10036074
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1001cfbf
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10036054
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x100360e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10036054
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10036054
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10036054
ret
cmp word [ebx + 4], 0x14c
jne 0x10036054
test word [ebx + 0x16], 2
je 0x10036054
test word [ebx + 0x16], 0x100
je 0x10036054
cmp word [ebx + 0x18], 0x10b
jne 0x10036054
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10036054
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x100360e0
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10036074
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1001cfbf
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10036054
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10036197
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100361f0
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10036197
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100361a6
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043be49
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100361f7
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001d06d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10036296
add edi, 4
add eax, 2
dec ecx
jne 0x100361dc
call 0x10036243
loope 0x10036239
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10036293
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100362a4
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10036257
cmp eax, ecx
ja 0x10036257
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100362e1
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100362d7
lea edi, [ebp - 0x100]
push pe_nt_image_headers32
push edi
push esi
call fcn.1001d54c
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x100361a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100361f0
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10036197
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100361a6
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043be49
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100361f7
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001d06d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10036296
add edi, 4
add eax, 2
dec ecx
jne 0x100361dc
call 0x10036243
loope 0x10036239
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10036293
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100362a4
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10036257
cmp eax, ecx
ja 0x10036257
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100362e1
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100362d7
lea edi, [ebp - 0x100]
push pe_nt_image_headers32
push edi
push esi
call fcn.1001d54c
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x7a4d84
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a4d8e
pushal
call 0x7a4d94
pop ebp
sub ebp, 0x10
sub ebp, 0x3a4d84
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a4db8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a4dc1
mov eax, 0x3a4d84
add eax, ebp
add eax, 0x63
mov ecx, 0x5fa
mov edx, 0xd09918ed
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a4dd8
jmp 0x7a4deb
and byte [esi + 0x64], ah
shr ebp, 1
in eax, dx
in eax, dx
insb byte es:[edi], dx
sub al, 0x15
in eax, dx
in eax, dx
in eax, dx
out dx, al
and byte [ebp - 0x17], dl
in eax, dx
in eax, dx
in eax, dx
push edi
vpaddsw ymm5, ymm2, ymm5
sbb cl, byte [edi]
out dx, al
and eax, 0xede16c66
in eax, dx
in eax, dx
out dx, al
sub byte [ebp - 0x690e7a43], bh
jecxz 0x7a4e05
test dword [ebx - 0x131239c1], ecx
ror ecx, 0x85
push ebp
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
imul eax, dword [0xededede8], 0xededc304
in eax, dx
pushal
mov ecx, ecx
adc dword [ecx + eax*8 - 0x37], esp
mov ecx, 0xe56866b0
in eax, dx
in eax, dx
in eax, dx
js 0x7a4e22
in eax, dx
in eax, dx
in eax, dx
pushaw
std
in eax, dx
in eax, dx
in eax, dx
sub al, 4
out dx, eax
fsub st(7), st(0)
outsb dx, byte [esi]
das
jmp 0x19e330fa
Function at 0x105ec058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105ec1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105ec07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ec06a
add dl, dl
jne 0x105ec089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ec0dc
xor eax, eax
add dl, dl
jne 0x105ec096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ec17d
add dl, dl
jne 0x105ec0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105ec0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105ec075
mov eax, 1
add dl, dl
jne 0x105ec0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ec0e1
sub eax, ebx
mov ebx, 1
jne 0x105ec128
mov ecx, 1
add dl, dl
jne 0x105ec10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105ec119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ec105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ec075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105ec13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105ec14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ec136
cmp eax, 0x7d00
jae 0x105ec16d
cmp eax, 0x500
jb 0x105ec168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ec075
cmp eax, 0x7f
ja 0x105ec170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ec075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105ec19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105ec075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1044f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1044f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1044f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044f06a
add dl, dl
jne 0x1044f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044f0dc
xor eax, eax
add dl, dl
jne 0x1044f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044f17d
add dl, dl
jne 0x1044f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1044f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1044f075
mov eax, 1
add dl, dl
jne 0x1044f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044f0e1
sub eax, ebx
mov ebx, 1
jne 0x1044f128
mov ecx, 1
add dl, dl
jne 0x1044f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1044f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044f136
cmp eax, 0x7d00
jae 0x1044f16d
cmp eax, 0x500
jb 0x1044f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044f075
cmp eax, 0x7f
ja 0x1044f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1044f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1044f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x7b7edd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, esp
mov eax, ebx
setnp ah
mov ebx, esi
seto ah
jmp 0x7b7eed
rdtsc
mov dl, byte [esp + 1]
rdtsc
sub esp, 0xb8
jmp 0x7b7ec7

Function at 0x7dd164
Capabilities:
Encrypt data using aes

Disassembly:
xchg bh, bl
lea ebx, [eax*4]
lea esp, [esp + 2]
xor edx, esi
mov bl, byte [esp]
jmp 0x7dd143
movzx esi, byte [eax + 0xa]
mov ebx, dword [esp]
shl edx, 8
push cx
jmp 0x7dd111
mov bh, ch
movzx esi, byte [eax + 0xb]
mov bl, dh
xchg bl, bh
jmp 0x7dd18b
or bp, 0x19d1
lea esp, [esp + 2]
mov bl, 0x26
lea esp, [esp + 2]
jmp 0x7dd135
xor edx, esi
jmp 0x7dd19d
shl edx, 8
dec ebx
sub esp, 0x16
xchg word [esp + 0xe], di
lea esp, [esp + 2]
jmp 0x7dd175
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
movzx esi, byte [eax + 0xd]
jmp 0x7dd1ae
shl edx, 8
jmp 0x7dd21f
xor edx, eax
jmp 0x7dd204
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0x7dd1ce
mov esi, 0xff
jmp 0x7dd250
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
jmp 0x7dd1ee
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
jmp 0x7dd1e4
lea ebp, [ebp*4]
lea ebp, [ebp + 0x7b5828]
mov eax, dword [ebp]
pop ebp
jmp 0x7dd26d
and eax, esi
push ebp
mov ebp, eax
jmp 0x7dd22b
and ebp, 0xa401eba4
jmp 0x7dda99
lea esp, [esp + 0x48]
xor eax, 0x1000000
mov bh, bl
stc
clc
jmp 0x7dd257
mov bh, 0x4e
stc
push edi
pushal
jmp 0x7dd290
mov ebx, dword [esp]
clc
and edi, 0xff0000
lea ebx, [ecx + 0xca]
neg bl
jmp 0x7dd2b3
and edi, esi
rcl bl, cl
lea ebp, [esi*4]
mov edi, dword [edi*4 + 0x7b5828]
jmp 0x7dd528
mov edi, edx
cmp bp, 0x261f
shr edi, 8
mov bp, word [esp]
jmp 0x7dd730

Function at 0x7dd32c
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
sub esp, 4
mov bp, 0xc3ea
jmp 0x7dd303

Function at 0x7dd4b9
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
jmp 0x7dd4e4
push ebp
mov ebp, ecx
jmp 0x7dd50c

Function at 0x7dd57e
Capabilities:
Encrypt data using aes

Disassembly:
stc
shr edi, 0x18
sub esp, 0x1f
add esp, 0x19
lea esp, [esp + 1]
jmp 0x7dd5a3
mov word [esp + 1], cx
mov edx, dword [edx*4 + 0x7b5828]
cmc
jmp 0x7dd566
lea esp, [esp + 1]
movzx edi, byte [edi*4 + 0x7b5828]
mov dh, 0x3c
mov ebp, 0x7b5828
xor ecx, edi
call fcn.007dd58d
ja 0x7dd5a8
add ax, si
xor eax, 0x47ded6b
test dword [ebp + 0x7c], 0xf221d64f

Function at 0x7dd6da
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 1], bp
lea esp, [esp]
mov dword [esp], eax
jmp 0x7dd6ff
lea esp, [esp + 0x1c]
cmp ebx, 0x7b7050
jmp 0x7dd84f
pop edi
pushal
mov word [esp + 8], si
jmp 0x7dd791
lea ebp, [esi*4]
pop eax
pushal
lea esp, [esp + 0x20]
jmp 0x7dd747
pop ebp
mov ebx, eax
lea ebx, [ebx*4]
mov bl, byte [esp]
jmp 0x7dd7d3
lea esp, [esp + 0x20]
pop esi
bswap ebp
lea ebp, [esi*4]
lea ebx, [esp + ecx]
jmp 0x7dd76c
pop ebx
ret
jne 0x7aa64e
push 0xa
mov edi, dword [esp]
xchg al, ah
jmp 0x7dd75d

Function at 0x7e1d39
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
rcr edx, 0x1c
rdtsc
jmp 0x7e1d23
Function at 0xa6db67
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, byte [esp + 0xc]
xchg byte [esp + 8], al
mov cl, al
pop word [esp + 4]
lea esi, [edx + edi]
jmp 0xa6dbb5
xchg word [esp + 0xd], bp
pop word [esp + 8]
xchg bl, ah
lea eax, [ecx + esi]
mov bx, bp
xchg word [esp + 0xb], cx
jmp 0xa6dbe8
push word [esp + 1]
mov ebp, edx
lea edi, [esi*4]
lea esi, [eax*4]
cpuid
mov ebp, dword [esp + 0xf]
jmp 0xa6db92
mov bl, 0x5d
lea esp, [esp + 1]
lea esp, [esp + 0xc]
popal
push ebp
lea esp, [esp]
jmp 0xa6dc58
mov dword [esp + 0xa], esi
mov byte [esp], cl
lea esp, [esp + 5]
mov di, word [esp]
rdtsc
rdtsc
jmp 0xa6dbd2

Function at 0xa6e22a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
pop word [esp + 0x27]
cld
lea esp, [esp + 2]
mov dword [esp + 1], eax
jmp 0xa6e26f
lea esp, [esp + 4]
sub esp, 0x14
pushal
push dword [esp + 0xa]
jmp 0xa6e214
bswap eax
push edx
pushfd
mov word [esp + 1], sp
lea esp, [esp + 1]
mov dx, cx
jmp 0xa6e29a
lea eax, [esp + edx]
rcl ax, cl
xchg ah, al
lea eax, [ebp*4]
mov ah, bl
mov al, 0x98
jmp 0xa6e259
pushfd
push si
rdtsc
mov ax, dx
shr dh, cl
pop edx
jmp 0xa6e3b6
lea edx, [ecx + edi]
mov dh, 0xcd
bts edx, edx
ror edx, 3
mov edx, 0xd53c8f38
mov dl, 0xc2
jmp 0xa6e284
inc ah
mov dword [esp + 0x11], ebx
btc ax, cx
rdtsc
rdtsc
jmp 0xa6e327
pop dword [esp + 8]
mov dword [esp + 0xf], ecx
xchg dword [esp + 5], edx
push dword [esp + 3]
lea edx, [ecx + ebp]
jmp 0xa6e2cb
xchg word [esp + 0x12], ax
push word [esp + 0x17]
xchg dl, ah
pop ax
sub edx, ecx
mov word [esp + 0x13], si
jmp 0xa6e2e1
mov word [esp + 7], dx
rcl dx, cl
bts ax, bp
jmp 0xa6e33e
pop word [esp + 3]
mov ax, 0x7502
lea esp, [esp + 2]
bsf edx, ecx
dec dx
mov ax, si
jmp 0xa6e311
lea edx, [ebp + 0x331d6fb1]
sub esp, 0x15
pop dword [esp + 3]
bt dx, ax
xchg dword [esp + 0x25], eax
mov eax, dword [esp + 0x17]
jmp 0xa6e385
neg eax
mov ax, word [esp + 1]
inc edx
xchg dword [esp + 3], eax
push ebp
xchg dx, ax
jmp 0xa6e2fa
push dword [esp + 0x1c]
neg edx
mov eax, esp
pop word [esp + 0x15]
rcl ah, cl
jmp 0xa6e39e
mov word [esp + 0x17], dx
dec al
lea eax, [ebp + ebp]
add ax, 0x43a9
mov word [esp + 0x21], sp
lea eax, [esp + ecx]
jmp 0xa6e36f
push word [esp + 0x1e]
xchg edx, eax
neg dh
mov al, byte [esp + 0x1c]
xchg dx, ax
jmp 0xa6e430
rdtsc
rdtsc
sub esp, 0x16
pop ax
not dx
rdtsc
jmp 0xa6e35d
mov ax, dx
pushal
lea esp, [esp + 0x4a]
mov eax, 0x2a717c50
call fcn.00a6e3c6
cdq
add eax, 0x8a0ffc95
xor al, 0xb6
and al, 0x43
mov esi, 0x3bab266a
pop esi
lodsd eax, dword [esi]
dec ebp
dec esi
fnstcw word [eax]
pop word [esp + 0x13]
xchg dh, dl
mov eax, ebp
not dx
xchg dl, dh
cmp ax, sp
jmp 0xa6e3dc
mov ax, 0x3ff4
pop word [esp + 9]
lea eax, [0x5c0be1e]
bsf edx, ecx
shl ax, 0
mov al, 0x99
jmp 0xa6e403
Function at 0xa6e3c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
bsf eax, eax
jmp 0xa6e416
ror al, cl
push bx
mov dx, 0x8300
mov eax, dword [esp + 3]
mov dx, bx
setbe dl
jmp 0xa6e460
cld
bsr edx, ebp
mov dx, 0x9cb3
bsr ax, ax
mov dh, 0x46
jmp 0xa6e46e
bswap edx
lea eax, [esi + ebp]
pop eax
not dh
rdtsc
xchg al, dh
jmp 0xa6e44a
mov eax, 0xc3f3e8b0
mov al, dh
rdtsc
setp ah
stc
xchg dl, al
jmp 0xa6e65c
xchg byte [esp + 1], dl
mov dx, word [esp]
xchg dl, ah
setg al
jmp 0xa6e509
not dh
lea edx, [esp + 0x26221b7e]
not ah
seto dh
mov eax, 0xed5c4ee5
bsr eax, edi
jmp 0xa6e4a1
mov edx, 0xae4556d4
pushfd
mov eax, ebx
neg edx
mov dh, byte [esp + 0x12]
jmp 0xa6e550
clc
sete dh
mov ax, word [esp]
mov dl, byte [esp + 1]
sub esp, 0x19
rdtsc
jmp 0xa6e4cf
mov dx, word [esp + 1]
neg ax
bsr edx, ebp
add esp, 1
mov dx, 0xedea
add esp, 0
jmp 0xa6e4e5
mov dx, word [esp + 6]
xchg word [esp + 0xf], dx
push word [esp + 7]
jmp 0xa6e581
pop dx
rcl edx, 7
mov dx, 0x384a
lea esp, [esp + 0xa]
ror ah, cl
add esp, 0x1a
jmp 0xa6e520
lea eax, [eax*4]
xchg word [esp + 0x11], ax
rcr al, 2
mov ah, 0x89
sub esp, 0x1a
xchg word [esp + 0x29], dx
jmp 0xa6e536
bsr edx, edi
rcl edx, cl
mov edx, dword [esp + 0x25]
neg dx
xchg dword [esp], edx
cld
jmp 0xa6e604
mov dword [esp + 0xb], esp
mov eax, esi
lea esp, [esp + 6]
pop ax
pushal
pop dword [esp + 4]
jmp 0xa6e56b
mov eax, edi
bsr eax, esp
not dx
sub esp, 7
mov dx, sp
pop edx
jmp 0xa6e4b7
mov edx, dword [esp + 0x2a]
bswap eax
dec ah
bswap eax
mov dword [esp + 0x1d], esp
call fcn.00a6e5bb
mov dword [esp + 0x29], edi
mov dx, word [esp + 0x2c]
mov al, byte [esp + 0x1f]
setne ah
lea esp, [esp + 0x1e]
jmp 0xa6e62c
dec edx
push dword [esp + 0x1b]
bswap edx
lea eax, [edi + 0x4d]
rdtsc
xchg dword [esp + 9], edx
jmp 0xa6e5d1
lea edx, [eax*4]
call 0xa6e616
mov edx, 0x6dbbc797
mov ax, cx
btc ax, di
rdtsc
mov ah, 0xa7
sbb dh, 0x2d
jmp 0xa6e7fb
mov dh, 0xb6
bswap eax
std
neg eax
ror dl, cl
mov dh, byte [esp]
jmp 0xa6e5a7
mov eax, ebp
call 0xa6e76b
xchg dh, ah
mov eax, 0x638405da
lea edx, [edx - 0x7745b278]
sub esp, 0x1d
cld
mov eax, edi
jmp 0xa6e850
push dword [esp + 0xb]
push dword [esp + 0xc]
xchg byte [esp + 0x24], ah
push cx
jmp 0xa6e900
mov eax, dword [esp + 0x1b]
xchg dword [esp + 0x13], edx
xchg dword [esp + 0x17], edx
xchg word [esp + 9], dx
lea edx, [ecx + edi]
dec eax
jmp 0xa6e83a
push dword [esp + 5]
bswap edx
rcl ax, cl
xchg dh, al
push dword [esp + 0x17]
bt edx, edx
jmp 0xa6e87d
mov edx, 0x14c57f8c
mov edx, esi
neg dx
cmc
shl edx, cl
pop edx
jmp 0xa6e893
Function at 0xa6e73f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0x6a80
mov byte [esp], cl
inc eax
mov dl, cl
xchg byte [esp], ah
mov edx, ebp
jmp 0xa6e749
mov ax, word [esp]
mov eax, dword [esp]
mov edx, dword [esp]
add eax, 0xdef7cc45
bts ax, si
mov dx, sp
jmp 0xa6e708
add esp, 9
mov dl, 4
setne ah
jmp 0xa6e71e
sub eax, 0x45687713
ror dl, 1
xchg dx, ax
bt edx, edx
mov dx, 0x1b5e
rdtsc
jmp 0xa6e7b5
cld
mov dx, word [esp]
xchg byte [esp], dh
mov eax, esp
xchg byte [esp], dl
neg dx
jmp 0xa6e7dc
setle ah
btc ax, bp
std
lea edx, [esi + esi]
lea esp, [esp]
mov dx, di
jmp 0xa6e781
bts ax, cx
std
xchg dx, ax
lea edx, [eax + ebp]
inc eax
rcl dx, cl
jmp 0xa6e797
lea esp, [esp]
btr edx, edx
adc edx, 0x3cbd9a3d
rdtsc
inc eax
cmc
jmp 0xa6e82a
xchg al, dl
xchg byte [esp], dh
setp ah
stc
sbb eax, 0xf2e0e079
rdtsc
jmp 0xa6e7c6
cld
mov dx, sp
mov edx, esi
bsf edx, edx
xchg byte [esp], al
mov ah, al
jmp 0xa6e802
Function at 0xa6e934
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xa], di
mov byte [esp + 0x17], dh
push dword [esp + 0xa]
jmp 0xa6e0d8
push dword [esp]
push edx
call fcn.00a6e0c2
mov word [esp + 3], dx
pop dword [esp]
jmp 0xa6e0fc
mov dword [esp + 2], esi
push dword [esp + 1]
call 0xa6e10a
lea ecx, [edi + 0x60072444]
push bx
mov dword [esp + 1], ebp
jmp 0xa6e86b
push dword [esp + 1]
pop word [esp + 0x14]
lea esp, [esp + 0x2a]
call fcn.00a6e48f
rdtsc
lea eax, [edx + ebp]
sub esp, 0x16
lea esp, [esp + 0x42]
sub esp, 0x1c
pop eax
jmp 0xa6e8bd
lea edx, [edx*4]
bswap edx
bsf edx, ecx
mov dl, ah
stc
jmp 0xa6e8d4
mov ax, 0x2d6b
not eax
mov ax, word [esp + 0x16]
mov byte [esp + 0x16], bl
mov dh, byte [esp + 6]
mov dh, al
jmp 0xa6e8a7
shr eax, cl
pop word [esp + 9]
neg edx
not edx
bsr edx, esp
mov eax, ebp
jmp 0xa6e8ea
pop dword [esp + 9]
xchg word [esp + 8], dx
xchg word [esp + 7], dx
jmp 0xa6ef6c
neg ax
mov ax, word [esp + 9]
dec edx
add esp, 0xa
add esp, 9
call 0xa6e934
sub dword [eax + 0xf], ecx
xor dword [edx + 0xfe81147], esi
xor dword [ebp - 0x14a5cfec], ecx
fsub qword [esi + 0x42]
jmp 0xa6e93c
rdtsc
mov dl, 0x47
adc eax, ebp
rdtsc
lea edx, [eax + esi]
pop edx
jmp 0xa6e910
lea edx, [edi*4]
stc
mov ah, 0xa0
setne al
std
not ah
jmp 0xa6ea04
pop ax
stc
setae ah
mov word [esp + 0xc], di
neg ax
pop word [esp + 2]
jmp 0xa6e926
mov ax, bp
push dword [esp + 2]
rcr eax, cl
pop edx
mov dx, 0xa939
jmp 0xa6e991
xor edx, 0x8c0078aa
pushfd
pop dx
pop dx
mov edx, ebx
push word [esp + 2]
jmp 0xa6e967
add esp, 3
mov byte [esp], bl
xchg ah, dl
rdtsc
mov dword [esp], edi
jmp 0xa6e9d5
mov ax, word [esp + 2]
not dx
lea edx, [ecx - 0xc3ec]
mov byte [esp], ah
lea eax, [ecx + edi]
not ah
jmp 0xa6e97d
pushal
pop dword [esp + 0xf]
mov ah, byte [esp + 0x10]
mov ax, 0xec1e
mov dword [esp], eax
jmp 0xa6e9e9
mov dx, word [esp + 3]
xchg byte [esp + 2], ah
rdtsc
pop dx
bswap edx
setne ah
jmp 0xa6e9bf
push word [esp + 0x1d]
call fcn.00a6ea18
adc dword [eax + 0x72906106], edx
mov dword [0xfc17e49d], ecx
sbb al, 0x6f
jbe 0xa6ea64
mov al, byte [0x24148b66]
mov dx, word [esp]
mov edx, dword [esp + 1]
xchg dword [esp], edx
btc eax, edi
push di
pop ax
jmp 0xa6e9a7
shl ah, cl
push dword [esp + 0xa]
mov eax, 0xdda1be34
push word [esp + 0x11]
push dword [esp + 8]
lea edx, [ebp - 0x89d8]
jmp 0xa6e952
hlt
push word [esp + 0xa]
bswap edx
mov edx, 0x2e78c825
mov eax, edx
neg dx
xchg edx, eax
jmp 0xa6ea35
pop word [esp]
add eax, 0x941373d2
mov edx, eax
std
mov eax, 0x6edde05e
rol eax, cl
jmp 0xa6ecbb

Function at 0xa6f262
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 1], ch
lea esp, [esp + 2]
mov dword [esp + 0x28], ebp
pushfd
mov dword [esp + 0x28], esi
push esi
jmp 0xa6f241
mov word [esp], sp
push dword [esp + 8]
mov dword [esp + 0x28], esp
push edi
push word [esp + 3]
mov byte [esp + 2], bl
jmp 0xa6f20c
mov byte [esp], dl
call fcn.00a6f27a
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xa6f264
jmp 0xa6f229
mov eax, dword [eax]
jmp 0xa6f28f
mov eax, dword [eax + 8]
jmp 0xa6f2ca
push eax
jmp 0xa6f041