joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b950
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x44b99c
mov eax, esi
call fcn.00433928
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44b99c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x44b99c
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x44bae0
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x44b9dc
cmp eax, 0x108
ja 0x44b9dc
mov eax, esi
call fcn.00433928
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44bad7
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x44bae0
jmp 0x44bad7
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x44babe
cmp eax, 0x20a
ja 0x44babe
test byte [esi + 0x50], 0x80
jne 0x44ba0e
sub eax, 0x203
je 0x44ba0b
sub eax, 3
je 0x44ba0b
sub eax, 3
jne 0x44ba0e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x44ba22
dec eax
je 0x44ba37
dec eax
je 0x44ba57
dec eax
je 0x44ba37
jmp 0x44ba5e
mov ecx, ebx
mov eax, dword [0x46d7f4]
mov eax, dword [eax]
mov edx, esi
call fcn.0043d31c
jmp 0x44bad7
cmp byte [esi + 0x5d], 1
jne 0x44ba4d
mov eax, esi
mov si, 0xffed
call fcn.004038c0
jmp 0x44bae0
or word [esi + 0x54], 1
jmp 0x44bad7
and word [esi + 0x54], 0xfffe
jmp 0x44bad7
mov eax, dword [0x46ebd0]
cmp byte [eax + 0x20], 0
je 0x44bad7
mov eax, dword [0x46ebd0]
cmp dword [eax + 0x1c], 0
je 0x44bad7
mov eax, dword [ebx]
mov edx, dword [0x46ebd0]
cmp eax, dword [edx + 0x1c]
jne 0x44bad7
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0043386c
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004038c0
jmp 0x44bae0
mov eax, dword [ebx]
cmp eax, 0xb00b
jne 0x44bad7
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0044a254
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ef80
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x44ef9c
cmp dword [esi + 4], 0
je 0x44efc9
test byte [ebx + 0x55], 1
jne 0x44efbb
mov eax, ebx
call fcn.0044dbd8
test eax, eax
jne 0x44efbb
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x44f0d9
mov edx, esi
mov eax, ebx
call fcn.0044eaa0
jmp 0x44f0d9
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44f0d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00450d50
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0044b884
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0044ef80
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00450d50
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f0d9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4555bc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x46d94c]
cmp byte [eax + 0xc], 0
je 0x455729
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x455722
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46ec24], 0
jne 0x455610
push 0x455730
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x455738
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec24], eax
cmp dword [0x46cc20], 0
jne 0x45570b
push 0x455748
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46cc20], eax
cmp dword [0x46cc20], 0
je 0x45570b
push 0x455754
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec28], eax
push 0x455764
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec2c], eax
push 0x455778
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec30], eax
push 0x455790
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec34], eax
push 0x4557a8
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec38], eax
push 0x4557bc
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec3c], eax
push 0x4557d4
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec40], eax
push 0x4557ec
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec44], eax
push 0x455808
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec48], eax
push 0x455814
mov eax, dword [0x46cc20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ec4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455729
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x459ad0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x459afe
mov eax, ebx
call fcn.0045a588
cmp dword [ebx + 0x3c], 0
je 0x459af7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x459b6f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x459b61
cmp dword [ebx + 8], 0
je 0x459b20
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x459b32
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x459b61
cmp dword [ebx + 8], 0
je 0x459b13
cmp eax, 3
je 0x459b45
dec eax
jne 0x459b13
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x459b13
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x459b13
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x459b8d
cmp dword [ebx + 0x10], 0xcc
je 0x459b8d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00459b98
pop ebx
ret

Function at 0x46b028
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00404698
add esp, 0x100
pop ebx
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406060], 1
mov dword [0x40605c], 1
mov dword [0x406058], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x406014], eax
mov eax, dword [0x40606c]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406068]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401840
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4018a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406074]
test esi, esi
jle 0x4019c0
mov eax, dword [0x406078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4018d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401957
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4018c0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4019e7
mov eax, dword [0x406078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x406078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4019c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401950
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401960
add dword [0x406074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401950
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4018de
mov eax, dword [0x406078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401f00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406088]
sub esp, 4
test ebx, ebx
je 0x401f55
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401f4e
test esi, esi
je 0x401f4e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f30
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402290
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4022b5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4022c0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4022b5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402308
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4022fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40230a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022f0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x6d11c8
Capabilities:
Encode data using xor

Disassembly:
mov word [esp], di
mov dword [esp], ebp
jmp 0x6d1362
mov byte [esp + 0x11], dh
lea esp, [esp + 1]
pushal
mov word [esp + 2], di
push edx
push word [esp + 0x16]
mov word [esp + 0x13], di
jmp 0x6d12d2

Function at 0x7e5f31
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
not dx
mov ebp, esi
mov ebp, 0x8219eeae
neg edi
sete ch
jmp 0x7e6012
mov ax, word [esp + 2]
lea esp, [esp + 1]
add esp, 2
jmp 0x7e5f10
lea esp, [esp]
mov al, ah
inc di
lea eax, [esp + ebx]
push edx
mov ch, byte [esp + 1]
jmp 0x7e5fb1
sub esp, 0x12
lea esp, [esp + 0x10]
push word [esp + 1]
add esp, 4
mov ebx, esi
xchg byte [esp], al
jmp 0x7e5f61
not eax
xchg dh, al
mov bl, 0x68
mov al, ah
xchg esi, ebp
xchg byte [esp], dl
jmp 0x7e5f82
btc edx, ebx
mov word [esp + 2], bx
lea ebx, [edi*4]
xchg cx, si
jmp 0x7e5ff2
lea esp, [esp]
mov bl, 0x80
mov dx, word [esp]
setle bh
mov ebp, dword [esp]
xchg ah, bl
jmp 0x7e5fa2
bsf si, si
push word [esp + 1]
pop word [esp + 1]
jmp 0x7e603f
xchg ch, dl
inc dx
lea esp, [esp + 1]
bswap edi
rdtsc
xchg dword [esp], ecx
jmp 0x7e5fdc
not ecx
lea ebx, [eax + 0x89]
rdtsc
add esp, 0
mov edi, ecx
lea ecx, [ebp + 0xa7]
jmp 0x7e5fc9
pop word [esp + 0xf]
xchg byte [esp + 0xd], cl
mov ax, dx
neg ebx
jmp 0x7e6088
xchg dword [esp], edi
sub esp, 0x18
sub ecx, eax
cmc
mov ax, word [esp + 0x16]
mov dx, di
jmp 0x7e6029
bsf cx, si
mov word [esp], di
lea edi, [edi*4]
mov di, sp
jmp 0x7e6106
mov al, 0x36
push dword [esp + 0xe]
xchg dword [esp + 4], ebp
mov bx, word [esp + 4]
mov ch, byte [esp + 0xd]
btc ecx, ebx
jmp 0x7e606e
neg ecx
inc di
pop ebx
rcl di, cl
xchg ah, bl
clc
jmp 0x7e60e7
lea eax, [eax + edx]
mov bh, byte [esp + 0xb]
bswap eax
pushal
lea esp, [esp + 0x42]
push esp
jmp 0x7e60b5
btc edi, edi
sub esp, 0xc
xchg byte [esp], cl
mov al, 0x4e
pop word [esp + 3]
xchg dx, bp
jmp 0x7e6193
mov di, 0x9c91
lea esi, [ebp - 0x47]
bsr bp, bp
add esp, 0x1b
lea esp, [esp + 1]
pushal
jmp 0x7e60d6
xchg dh, al
mov cl, ch
call fcn.007e617c
cwde
adc eax, 0xff1fec85
or al, byte [esi + 0x658e7314]
mov bh, 0x9e
jmp 0x8fe50cb7
invalid
invalid
Function at 0x7e69d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax + edx]
inc cx
bsf cx, si
mov edi, 0xbcb81a12
xchg dh, al
mov edx, dword [esp]
jmp 0x7e68f4
lea ebp, [esi*4]
mov di, word [esp]
lea edi, [ebx*4]
mov byte [esp], bh
inc dl
jmp 0x7e67c8
xchg si, ax
xchg ch, dl
mov esi, 0xa77f8dd2
bsr dx, bp
neg edi
xchg ch, dl
jmp 0x7e67ed
lea ebx, [edx*4]
xchg ebx, esi
not dh
sub esp, 0
xchg ebx, eax
jmp 0x7e68ca
cmc
mov ebp, dword [esp]
mov byte [esp], ch
sub esp, 0x1e
xchg ah, bl
lea ebp, reloc.RASAPI32.dll_RasHangUpA
jmp 0x7e681d
pop word [esp]
add esp, 1
neg eax
mov cx, di
lea esp, [esp]
setno ah
jmp 0x7e6833
mov ax, 0xb023
cpuid
cld
xchg dx, cx
shl bp, cl
xchg edx, eax
jmp 0x7e6858
mov edx, 0x2025383c
rdtsc
pop ebp
ror edi, 5
push esp
xchg dword [esp], ebx
jmp 0x7e687d
mov si, 0x1321
mov ebp, 0xa5a027be
mov edi, dword [esp + 0x17]
jmp 0x7e69a8
lea ecx, [eax*4]
mov dword [esp + 0xc], ecx
stc
mov edx, 0x8ab48494
mov edi, dword [esp + 0x16]
lea eax, [esi - 0x4d]
jmp 0x7e68b3
lea edx, [edx*4]
sub esp, 2
mov di, word [esp + 1]
lea esp, [esp + 1]
push word [esp + 1]
mov si, 0x10db
jmp 0x7e68a2
bsf bp, ax
mov ah, byte [esp]
mov bx, word [esp]
jmp 0x7e6991
mov cl, ch
not dh
lea eax, [ebp*4]
bsf dx, si
jmp 0x7e6912
lea esp, [esp + 8]
mov dl, dh
xchg dh, al
and ax, 0x9752
mov bx, word [esp]
mov cx, dx
jmp 0x7e6928
xchg dx, si
lea eax, [eax*4]
rdtsc
add esp, 0x1a
mov dx, 0xbb0f
mov byte [esp + 3], ah
jmp 0x7e693f
xchg word [esp + 9], si
push dword [esp + 9]
mov edx, 0x9bc0021c
mov ah, byte [esp + 0x1b]
cmc
rdtsc
jmp 0x7e695b
lea ebx, [ebp*4]
stc
bswap edi
rdtsc
push esp
xchg byte [esp], al
jmp 0x7e6ce1
lea ecx, [ebp - 0xa7]
xchg dword [esp + 0xe], esi
mov cx, sp
mov ax, 0x2b29
mov cl, 2
lea edx, [ecx*4]
jmp 0x7e697a
btr edi, edx
mov esi, 0x20e7e740
add esp, 8
lea esp, [esp]
jmp 0x7e680a
cpuid
mov ch, byte [esp + 0x1f]
mov eax, dword [esp + 0x25]
xchg edi, eax
popal
btc esi, edi
jmp 0x7e69f5
mov ebx, dword [esp + 7]
pushal
xchg word [esp + 0x25], si
not bx
pop dword [esp + 0x14]
setae bh
jmp 0x7e6a13
lea ecx, [ebx + ebp]
bsf ax, ax
add esp, 5
mov word [esp + 2], dx
stc
mov ecx, 0x83a44de
jmp 0x7e6a36
mov dword [esp + 0x15], ecx
lea esp, [esp + 0xc]
bswap eax
mov ax, bx
xchg byte [esp + 2], bl
pop cx
jmp 0x7e6a58
push edx
xchg byte [esp + 6], dl
mov byte [esp + 1], dh
lea ebx, [esi*4]
sub esp, 0x14
lea eax, [ecx + ebx]
jmp 0x7e6a93
xchg edi, ecx
xchg word [esp + 2], bp
mov ecx, 0x9816d778
cld
cpuid
bswap edi
jmp 0x7e6b45

Function at 0x7e6fa4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 6]
mov edi, eax
pushal
ror dh, 7
mov esi, dword [esp + 1]
jmp 0x7e7a80
push esp
pop edi
neg ax
xchg word [esp + 4], cx
xchg dword [esp + 2], eax
inc dl
jmp 0x7e78dc

Function at 0x7e7b23
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, eax
push word [esp + 0x12]
pop edx
mov word [esp + 3], bx
jmp 0x7e7b71
pop edx
not dh
pop ecx
rdtsc
mov ah, byte [esp + 0xa]
mov bp, 0xf165
jmp 0x7e7b53
setl bh
rdtsc
mov ax, di
mov al, 0x8e
not bx
bswap esi
jmp 0x7e7b32
Function at 0x7e9858
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x933bd10c
btr eax, edx
bsr bx, cx
lea eax, [edx*4]
pushal
mov dword [esp + 7], esi
jmp 0x7e98cb
mov word [esp + 6], di
mov dword [esp + 7], eax
neg ebx
jmp 0x7e983a
mov bx, si
rdtsc
not bh
rdtsc
neg eax
pop word [esp + 1]
jmp 0x7e9891
ror ax, cl
mov byte [esp + 0xd], bh
not eax
mov dx, 0x5f47
lea edx, [eax + edx]
xchg dword [esp + 2], edx
jmp 0x7e9865
neg dh
pop dword [esp + 6]
bsr dx, cx
mov eax, 0xb5ec7d18
mov dh, ch
pop word [esp + 5]
jmp 0x7e994c
mov dword [esp + 4], edx
mov dx, 0x4b7f
pushal
inc edx
mov ax, word [esp + 0x18]
lea esp, [esp + 0xf]
jmp 0x7e987b
lea esp, [esp + 9]
lea ebx, [eax - 0x51]
mov bh, byte [esp + 5]
ror bx, cl
pop ebx
lea esp, [esp + 3]
jmp 0x7e98b2
push dword [esp + 5]
not edx
mov edx, 0xe03b7c54
mov dl, 0x9c
push word [esp + 2]
mov word [esp + 0x13], dx
jmp 0x7e98ff
mov dx, 0xd1d7
ror ah, 1
push dword [esp + 8]
mov edx, 0x2f06d272
xchg byte [esp], al
push dword [esp + 5]
jmp 0x7e991f

Function at 0x7eac6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, esp
lea eax, [esi*4]
mov ax, word [esp + 6]
add esp, 0xb
jmp 0x7eac9d
not eax
sub esp, 0
rcl bx, cl
lea edx, [eax + 0xd1]
jmp 0x7eacb0
lea esp, [esp]
mov bh, byte [esp]
mov ebx, ecx
mov dl, 0x64
bsf bx, ax
lea eax, [eax + ebx]
jmp 0x7eac7d
mov al, 0x2e
lea ebx, [ebp*4]
not edx
xchg bx, ax
rdtsc
jmp 0x7eace8
mov edx, ebp
mov bx, 0x154f
mov eax, dword [esp]
lea esp, [esp]
lea esp, [esp]
bsr bx, bp
jmp 0x7eaccf

Function at 0x7eb02c
Capabilities:
Execute anti-debugging instructions

Disassembly:
setl ah
lea esp, [esp + 7]
sub esp, 6
mov byte [esp + 1], ah
xchg byte [esp + 6], dh
jmp 0x7eb04c
xchg dh, dl
rdtsc
inc ebx
mov edx, 0x8aa96918
add esp, 0xc
mov edx, ebp
jmp 0x7eaff3
xchg dh, al
pop edx
dec bx
sub bl, ah
jmp 0x7eb00e
pop ax
push edx
xchg edx, eax
mov dword [esp + 0x13], eax
pop word [esp + 1]
jmp 0x7eb0e1
mov dword [esp + 1], ebp
pop ax
mov edx, dword [esp + 3]
neg dx
bswap ebx
sub esp, 0x10
jmp 0x7eb035
mov dx, word [esp + 0x16]
rdtsc
mov eax, esp
push word [esp + 0xd]
call fcn.007eb072
xchg dx, ax
clc
mov dh, ch
sub esp, 0xe
push dword [esp + 6]
jmp 0x7eb0c8
mov edx, 0x8d2e512
rcr edx, 0x15
setnp dh
mov ah, byte [esp + 9]
lea ebx, [esi + edi]
jmp 0x7eb14d
mov dh, byte [esp + 5]
rdtsc
push dword [esp + 0x12]
pop dx
push word [esp + 3]
mov dh, ch
jmp 0x7eb08b
lea ebx, [ebx + edi]
xchg byte [esp + 9], al
mov bx, word [esp + 0xc]
call fcn.007eb11a
setns dh
call fcn.007eb1d9
sbb al, 0x89
sbb dword [eax - 0x75], edi
and byte [esi + 0x2adfb82a], bh
pushfd
fmul qword [edi - 0x21]
mov edx, 0x9d62fe49
in al, dx
mov ax, bp
lea edx, [ecx*4]
xchg dword [esp + 2], edx
neg ah
lea eax, [edi + ebp]
jmp 0x7eb15e
Function at 0x7eba48
Capabilities:
Execute anti-debugging instructions

Disassembly:
not eax
xchg dword [esp + 0xd], ebx
jmp 0x7eba54
bsr dx, bp
mov edx, dword [esp + 0x1b]
mov dh, byte [esp + 9]
mov byte [esp + 7], ah
jmp 0x7ebae5
xchg bx, ax
lea esp, [esp + 0x17]
mov byte [esp + 2], ah
lea ebx, [ebx*4]
ror bh, 3
mov dl, dh
jmp 0x7ebab9
mov bh, byte [esp + 0x13]
push word [esp + 8]
bt edx, edx
mov bx, word [esp + 0xf]
xchg dx, ax
xchg word [esp + 6], bx
jmp 0x7eba77
lea eax, [ecx - 0xab]
mov ax, si
xchg word [esp + 1], dx
push esp
mov ah, byte [esp + 1]
xchg word [esp + 3], bx
jmp 0x7ebb2a
mov word [esp + 0x1b], di
pop edx
xchg dword [esp + 0x15], edx
rdtsc
pop bx
mov ax, bx
jmp 0x7eba9e
mov edx, dword [esp + 0xc]
mov ebx, dword [esp]
mov ebx, 0x4b80c330
lea ebx, [edx*4]
stc
jmp 0x7ebb3d
sub esp, 0
xchg ah, bl
mov edx, dword [esp]
lea ebx, [ecx*4]
bswap eax
jmp 0x7ebaf8
push word [esp + 1]
rdtsc
xchg bx, dx
lea esp, [esp + 2]
stc
mov dl, 0xfc
jmp 0x7ebb13
xchg bh, al
bsr bx, bp
mov bl, bh
push esp
mov word [esp], dx
mov al, 0x5c
jmp 0x7ebbf6
cld
bswap ebx
lea ebx, [eax - 0xe9]
setbe bl
dec bx
mov ebx, dword [esp + 0x29]
jmp 0x7ebb68
mov eax, dword [esp + 0x23]
mov ebx, dword [esp]
mov bx, 0x3e73
lea ebx, [edx + edx]
mov ebx, dword [esp]
mov ebx, 0x2f9a256e
jmp 0x7ebb84