joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a5e9
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x4194f9
call fcn.0040f528
sub esp, 0x118
push ebx
push esi
push edi
push str.CMainFrame::ChkDel
mov esi, ecx
call fcn.004028a7
pop ecx
lea eax, [ebp - 0x10]
lea edi, [esi + 0x118]
push eax
mov ecx, edi
call fcn.00407fa3
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00407c9a
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00407fe0
push eax
push str.PrinterName
call fcn.00402932
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00407659
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407659
mov ecx, edi
call fcn.00407f85
lea ecx, [esi + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ecx
call fcn.00407f85
mov ecx, dword [ebp - 0x14]
cmp word [ecx], bx
jne 0x40a7ec
cmp word [eax], bx
jne 0x40a7ec
xor eax, eax
inc eax
cmp dword [esi + 0x47c], eax
je 0x40a7f3
push str.enter_:_EP_OpenPrinter
mov dword [ebp - 0x1c], ebx
call fcn.004028a7
pop ecx
push ebx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00407f8d
push eax
call fcn.00401b2e
push str.exit_:_EP_OpenPrinter
mov dword [ebp - 0x10], eax
call fcn.004028a7
push dword [ebp - 0x10]
push str.result
call fcn.00402a6e
add esp, 0x18
cmp dword [ebp - 0x10], 1
jne 0x40a6e6
push dword [ebp - 0x1c]
call fcn.0040eeb2
xor eax, eax
inc eax
jmp 0x40a7f3
lea eax, [esi + 0x798]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
cmp eax, ebx
je 0x40a707
push eax
push dword [esi + 0x430]
call dword [0x41a238]
mov eax, dword [ebp - 0x14]
mov dword [eax], ebx
push str.Delete_Reg_HKCU_run
call fcn.004028a7
pop ecx
mov ecx, edi
call fcn.00407f7d
cmp byte [eax], bl
mov ecx, edi
jne 0x40a722
mov ecx, dword [ebp - 0x20]
call fcn.00407f7d
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.00407f7d
push dword [ebp - 0x10]
xor ecx, ecx
cmp byte [eax], bl
mov edi, str.softwareMicrosoftWindowsCurrentVersionRun
sete cl
push edi
mov esi, 0x80000001
push esi
mov dword [ebp - 0x14], ecx
call fcn.00408a7c
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push ebx
push edi
mov edi, dword [0x41a014]
push esi
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
jne 0x40a782
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [0x41a018]
push dword [ebp - 0x18]
call dword [0x41a00c]
push 0x104
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.0040eef0
push 0x104
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.00406858
add esp, 0x1c
cmp dword [ebp - 0x14], ebx
mov eax, str.SoftwareEPSONSTM3STMDataEPNTarget
jne 0x40a7bd
mov eax, str.SoftwareEPSONSTM3STMDataEPLTarget
lea ecx, [ebp - 0x18]
push ecx
push 0xf003f
push ebx
push eax
push esi
call edi
test eax, eax
jne 0x40a7e8
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x18]
call dword [0x41a028]
push dword [ebp - 0x18]
call dword [0x41a00c]
xor eax, eax
jmp 0x40a7f3
mov ecx, esi
call fcn.00409c60
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x410aeb
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x41b6c0
call fcn.00410ef4
mov edi, 0x94
mov eax, edi
call fcn.00410010
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x41a1c8]
mov ecx, dword [esi + 0x10]
mov dword [0x420018], ecx
mov eax, dword [esi + 4]
mov dword [0x420024], eax
mov edx, dword [esi + 8]
mov dword [0x420028], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x42001c], esi
cmp ecx, 2
je 0x410b4b
or esi, 0x8000
mov dword [0x42001c], esi
shl eax, 8
add eax, edx
mov dword [0x420020], eax
xor esi, esi
push esi
mov edi, dword [0x41a1b8]
call edi
cmp word [eax], 0x5a4d
jne 0x410b86
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410b86
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x410b9e
cmp eax, 0x20b
je 0x410b8b
mov dword [ebp - 0x1c], esi
jmp 0x410bb2
cmp dword [ecx + 0x84], 0xe
jbe 0x410b86
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x410bac
cmp dword [ecx + 0x74], 0xe
jbe 0x410b86
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004157c6
pop ecx
test eax, eax
jne 0x410bc6
push 0x1c
call fcn.00410ac7
pop ecx
call fcn.00411ad1
test eax, eax
jne 0x410bd7
push 0x10
call fcn.00410ac7
pop ecx
call fcn.00415724
mov dword [ebp - 4], esi
call fcn.00415526
test eax, eax
jge 0x410bf0
push 0x1b
call fcn.00410aa2
pop ecx
call dword [0x41a174]
mov dword [0x4216c4], eax
call fcn.00415404
mov dword [0x41fe58], eax
call fcn.00415362
test eax, eax
jge 0x410c16
push 8
call fcn.00410aa2
pop ecx
call fcn.0041512f
test eax, eax
jge 0x410c27
push 9
call fcn.00410aa2
pop ecx
push 1
call fcn.00414c51
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x410c3d
push eax
call fcn.00410aa2
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x41a1b4]
call fcn.004150d2
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x410c5e
movzx eax, word [ebp - 0x40]
jmp 0x410c61
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00409180
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x410c7f
push edi
call fcn.00414d7e
call fcn.00414da0
jmp 0x410cb1
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00410f2f
ret
Function at 0xdf1942
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmp edx, 0x4c
pushfd
pushfd
lea esp, [esp + 0x30]
jne 0xdfcdfe
xor ah, 0xa3
xor ah, al
mov eax, dword [ebp - 0x100]
add ecx, 0x94ef0c62
test ch, 8
mov ecx, dword [eax + 0x30]
jmp 0xdf5706
call fcn.00df2e6d
mov dword [esp + 0x28], 0xdfde68
jmp 0xdf99f5
call fcn.00dfe592

Function at 0xdf1981
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
pushfd
lea esp, [esp + 0x14]
je 0xdf19d3
rcl ax, 3
xor ax, 0xab13
lahf
shrd ax, di, 0xd
mov eax, dword [ebp - 0x44]
bt ax, 0xa
cmp ecx, 0xdc8b7b2e
pushal
sub ecx, ecx
rcl cl, 3
add esp, 0x20
jl 0xdf9aac
mov cl, byte [eax + 7]
cmp al, 0xfc
pushfd
cmp dx, 0x50
pushfd
cmp ecx, 0x44
pushal
pushfd
lea esp, [esp + 0x2c]
jne fcn.00dfd2f9
lea esp, [esp + 0x44]
jne fcn.00dfd2f9
and dh, 7
mov edx, edx
mov edx, dword [ebp - 0x44]
cmp bh, ch
xor eax, eax
neg al
adc al, 0x5f
xor al, cl
adc al, 0x90
mov al, byte [edx + 8]
cmc
push 0xa5b4b849
push eax
cmp eax, 0x6c
call fcn.00dfcd40
stc
mov cl, byte [eax + 7]
pushfd
pushal
stc
test dl, 0x3e
cmp ecx, 0x44
pushal
jmp 0xdf8fd5

Function at 0xdf1c2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], 0x3b52
jmp 0xdf65bf
lea esp, [esp + 8]
je 0xdf9948
clc
jmp 0xdfd577
pushal
cmp bl, 0x44
push edi
lea esp, [esp + 0x24]
jne 0xdfce8f
stc
or bl, 0xce
mov bl, byte [eax + 3]
call fcn.00df64f2
jmp 0xdf87d8

Function at 0xdf1cf1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xdf3fb6
bswap si
mov esi, dword [ebp - 0x3c]
call fcn.00df1ccb

Function at 0xdf1dbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
je 0xdf6643
shr dx, 2
pushal
mov edx, dword [ebp - 0x44]
pushfd
stc
sub eax, eax
test ch, ah
test al, 0x56
sub al, 0xee
mov al, byte [edx + 3]
jmp 0xdf87ab
sub edx, edx
ror dl, 1
mov dl, byte [ecx + 4]
mov dword [esp], 0x4a6c7c6e
jmp 0xdf8a2d
cmc
test dl, 0x4a
cmp eax, 0x52
mov byte [esp + 0x10], bh
mov byte [esp], bl
pushal
lea esp, [esp + 0x44]
jne fcn.00dfd2f9
shl cx, cl
adc cl, 0x1c
mov ecx, dword [ebp - 0x44]
push edi
push eax
bt si, si
jmp 0xdf711a

Function at 0xdf206b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, 0xf1
mov ecx, dword [ebp - 0xb4]
jmp 0xdf57fb
mov dword [esp], ecx
jmp 0xdfad23
call fcn.00df8c54

Function at 0xdf2078
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ebp, edx
cmp ecx, 0x53
lea esp, [esp + 4]
je 0xdf3681
pushfd
pushal
pushfd
lea esp, [esp + 0x28]
jne fcn.00dfd2f9
sar edx, 7
inc dh
movzx dx, bl
ror edx, cl
mov edx, dword [ebp - 0x44]
cmc
push edx
call fcn.00df2d22
mov dword [ecx + eax*4], edx
mov byte [esp + 4], ah
bsr ax, di
call fcn.00dfa016
push 0xaa53addc
pushal
lea esp, [esp + 0x24]
jne fcn.00dfd2f9
pushfd
cmp bh, 0x8c
dec dl
bts edx, 0x16
mov edx, dword [ebp - 0x44]
clc
call fcn.00dfaba1
mov dword [eax + edx*4], ecx
pushfd
pushfd
mov word [esp], 0x596f
mov byte [esp + 4], bl
lea esp, [esp + 0x50]
jmp 0xdfdd96
Function at 0xdf216e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
movzx dx, dl
and dl, 0x6f
mov dx, word [ecx + 4]
push dword [esp]
cmp edx, 0x64
pushfd
pushfd
jmp 0xdfb303
mov dx, word [ecx + 4]
test bp, 0x6305
cmp edx, 0x44
pushfd
pushfd
jmp 0xdfabb9
clc
bt bp, ax
xor edx, edx
bsf dx, bx
neg dl
cmc
jmp 0xdf42d7
jmp 0xdf4eaa
lea esp, [esp + 8]
jne 0xdfcdfe
xchg cl, ah
mov eax, dword [ebp - 0x100]
stc
ror cl, cl
mov ecx, dword [eax + 0x30]
bt ebx, ebp
cmp dl, 0xe
sub edx, edx
shr dl, cl
not dh
mov dx, word [ecx + 6]
stc
clc
cmc
test eax, ecx
cmp edx, 0x6c
call fcn.00df4cf2
pushfd
call fcn.00dfb432
lea esp, [esp + 0x10]
je 0xdfa721
dec al
xadd ah, cl
mov eax, dword [ebp - 0x100]
cmp al, 0xdb
mov ecx, dword [eax + 0x30]
jmp 0xdf7900

Function at 0xdf21ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jb 0xdf5f45

Function at 0xdf22ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x2c]
je 0xdf313a
pushfd
cmp al, dl
aad 0x93
bsr ax, cx
mov eax, dword [ebp - 0x104]
sal ch, cl
or cl, ch
call fcn.00df303b
test dh, ch
jmp 0xdf631a
lea eax, [esp - 0x1fa10b39]
stc
adc ch, 0x81
mov eax, dword [ebp - 0x104]
shl ch, 2
sar ecx, 7
mov ecx, dword [eax + 0x30]
cmp ah, bl
pushal
xor edx, edx
rcr dx, 8
neg dh
clc
mov dx, word [ecx + 0xa]
cmp bp, bx
cmp edx, 0x6c
pushal
push ecx
call fcn.00df898d
jmp 0xdf9da4
Function at 0xdf24a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x95
lea esp, [esp + 0x34]
je 0xdf8e34
adc ah, bh
mov eax, dword [ebp - 0x100]
rcr cl, 1
jmp 0xdfcec6
lea esp, [esp + 0x20]
je 0xdfb4ff
sub al, 0xba
and al, 0xd2
test bh, dh
adc al, dh
mov eax, dword [ebp - 0x100]
sub cl, 0xa3
mov ecx, dword [eax + 0x30]
test si, 0x5c4a
sub edx, edx
push esi
mov dx, word [ecx + 0xe]
bt ebp, esi
mov word [esp], di
bt di, bx
stc
cmp edx, 0x4c
mov byte [esp], dh
lea esp, [esp + 4]
jne 0xdfcdfe
movzx ax, cl
mov eax, dword [ebp - 0x100]
push edx
lea esp, [esp + 4]
jmp fcn.00dfb50e
call fcn.00dfa4f7
push dword [ebp - 0x10c]
pop dword [esp]
jmp fcn.00dfa271
call fcn.00df347a
lea edx, [eax*8 - 0x7e484409]
movzx dx, bl
mov edx, dword [ebp - 0xb4]
jmp 0xdfab75
jmp 0xdf5788
daa
mov eax, dword [ebp - 0x100]
rcr cl, 6
mov ecx, dword [eax + 0x30]
stc
push 0x495ff470
sub edx, edx
neg dl
mov dx, word [ecx + 0xe]
clc
bt ax, cx
cmc
call fcn.00df6456
mov dword [ebp - 0x70], 1
pushal
mov byte [esp + 4], al
mov dword [ebp - 0x124], 0
push 0x2dee1572
mov byte [esp], 0x81
pushfd
lea esp, [esp + 0x28]
jmp 0xdf8351
push edx
push 0x2b32ccfe
mov dword [esp], 0xdfdd63
jmp 0xdfc231
rcl dl, cl
dec dh
and ax, si
mov edx, dword [ebp - 0xac]
daa
cwde
movsx ax, cl
and ah, bl
add edx, 0x10001f1a
sal al, 2
mov eax, dword [ebp - 0xb8]
push ecx
call fcn.00df6261
push eax
bt edi, 0xf
daa
mov eax, dword [ebp - 0x100]
sub esp, 0xfffffffc
call fcn.00dfaf38
push 0x459593e
push esi
pushfd
mov dword [edx + 6], eax
pushfd
lea esp, [esp + 0x10]
jmp 0xdfae78
mov ecx, dword [eax + 0x30]
bt bx, bx
cmc
xor edx, edx
pushal
dec dh
not dh
rcr dx, 0xe
mov dx, word [ecx + 0xc]
jmp 0xdfd63f
test ax, sp
cmp edx, 0x44
pushfd
jmp 0xdfd6a5
pushal
lea esp, [esp + 0x44]
jg 0xdf736c
jne 0xdfcdfe
shrd cx, di, 0xf
das
mov eax, dword [ebp - 0x100]
rol cx, cl
ror ch, cl
bts cx, sp
mov ecx, dword [eax + 0x30]
clc
sub edx, edx
inc dl
seta dl
inc dh
mov dx, word [ecx + 0xe]
pushal
cmp edx, 0x6c
mov byte [esp], 0x3f
jmp 0xdf8618

Function at 0xdf2812
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jb 0xdfa814
jne 0xdf8c42
aaa
not ch
jmp 0xdf91ad
pushfd
mov byte [esp], 0xc2
lea esp, [esp + 4]
jne 0xdf8c42
ror ch, cl
btc cx, dx
aaa
setne ch
mov eax, dword [ebp - 0x104]
movsx cx, cl
lea ecx, [ecx*2 + 0x5f54949f]
shr cx, 0xc
mov ecx, dword [eax + 0x30]
pushfd
stc
call fcn.00dfaf2c
Function at 0xdf294d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp - 0x6c], 0
push dword [esp]
lea esp, [esp + 0xc]
je 0xdf4c3e
rdtsc
mov edx, dword [ebp - 0x7c]
push 0xfc15cac3
pop ecx
lea ecx, [ecx + 0x75b61856]
lea eax, [ecx - 0x2e958b12]
mov eax, dword [ebp - 0xc0]
call fcn.00df7ee4
stc
clc
call fcn.00df6494
cmc
cmp dword [ebp - 0x48], 0
pushfd
pushfd
lea esp, [esp + 0xc]
jbe 0xdf6d2c
pushal
pushal
movsx ax, bl
mov eax, dword [ebp - 0xbc]
bts ecx, 0x1e
movzx ecx, cl
cmc
clc
add eax, dword [ebp - 0x74]
jmp 0xdf50a6
add edx, dword [ebp - 0x74]
mov byte [esp], bl
clc
stc
mov dword [ebp - 0x80], edx
jmp 0xdf33d4
sal ch, cl
sal dx, cl
rcr dx, cl
xadd cx, dx
mov edx, dword [ebp - 0xac]
btr ecx, 0x1d
dec cl
shl cx, cl
cmp ah, ch
add edx, 0x10002464
bswap cx
sub eax, eax
dec cl
mov dword [edx + 1], eax
shl cl, 7
xchg cl, dl
mov ecx, dword [ebp - 0xbc]
push 0x87b850f0
or dl, al
sub dx, 0x4725
sub ecx, 0x10000000
sete dh
mov dword [ebp - 4], ecx
shrd dx, sp, cl
test bh, ch
test dh, ch
pop edx
mov edx, dword [ebp - 0xbc]
pushfd
jmp 0xdf490c
call fcn.00dfd8e4

Function at 0xdf2a1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x44
mov dword [esp], esi
lea esp, [esp + 0x14]
jne 0xdf8c42
push 0x73355317
movsx ax, bl
btr cx, si
mov eax, dword [ebp - 0x104]
pushfd
pushfd
mov ecx, dword [eax + 0x30]
cmp ah, al
sub edx, edx
xor dh, 0x31
cmc
mov dx, word [ecx + 0x14]
test ch, ah
cmc
test bh, cl
jmp 0xdf5292
cmp edx, 0x6c
pushfd
push ebp
pushfd
lea esp, [esp + 0x18]
je 0xdf9ae0
not ecx
mov eax, dword [ebp - 0x104]
test bp, si
dec cx
mov ecx, dword [eax + 0x30]
test di, bp
stc
xor edx, edx
or dh, cl
mov dx, word [ecx + 0x14]
cmp al, 0x2d
test dx, ax
pushal
cmp edx, 0x4c
pushal
lea esp, [esp + 0x40]
jne 0xdf8c42
aas
mov eax, dword [ebp - 0x104]
setl ch
shrd ecx, ecx, 5
mov ecx, dword [eax + 0x30]
pushal
test ah, bl
push dword [esp]
xor edx, edx
stc
mov dx, word [ecx + 0x16]
cmp bl, 0xdc
jmp 0xdf6d03

Function at 0xdf2a5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0xdfd4d3
clc
clc
jmp 0xdfddcc
push edx
jmp 0xdfd4c9
lea esp, [esp + 0x24]
jne 0xdfce8f
bt ecx, 8
cmp bl, 0x4c
pushal
jmp 0xdf8bab

Function at 0xdf2c1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
lea esp, [esp + 0x28]
jne 0xdfcdfe
btr cx, si
rol cx, cl
mov eax, dword [ebp - 0x100]
rol cl, 1
bsr ecx, ecx
rcr cl, cl
mov ecx, dword [eax + 0x30]
pushfd
call fcn.00dfd5d4
push 0x14c1851
cmp edx, 0x4c
jmp 0xdf2f4a
test ebp, 0x34f4385e
movzx dx, dl
mov dx, word [ecx + 8]
lea esp, [esp + 4]
ja 0xdf27fc
cmp edx, 0x4c
push 0x3a7ec1a0
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0xdfcdfe
pushfd
cmc
sub al, al
mov eax, dword [ebp - 0x100]
or cl, 0x41
sal cl, cl
sar cx, 0xb
btc cx, dx
mov ecx, dword [eax + 0x30]
pushal
sub edx, edx
dec dx
neg dl
adc dh, 0x63
neg dl
mov dx, word [ecx + 0xa]
clc
cmp edx, 0x2e
pushfd
jmp 0xdfd604
call fcn.00df6c73
jmp 0xdf1ca1

Function at 0xdf2e08
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], 0xec18
call fcn.00df4045
Function at 0xdf2e6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, edx
btc dx, sp
cmc
call fcn.00dfdd37

Function at 0xdf2e91
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 1
setb al
mov dword [ebp - 0xa0], edx
lea esp, [esp + 4]

Function at 0xdf3186
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0xdf3fcd
jmp 0xdf9126
jmp 0xdf3fc1
pushfd
pushal
lea esp, [esp + 0x28]
jne fcn.00dfd2f9
bsr dx, bx
lea edx, [eax - 0x302054b2]
mov edx, dword [ebp - 0x44]
clc
cmc
xor eax, eax
shr al, 5
xor al, cl
push eax
mov al, byte [edx + 9]
stc
mov byte [esp], 1
cmp dl, dl
cmp eax, 0x4c
jmp 0xdf31ef

Function at 0xdf31f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
je 0xdf4a81
movsx eax, dl
movzx ax, al
mov eax, dword [ebp - 0xfc]
movzx edx, bl
call fcn.00dfe341
bt si, 0xa
mov edx, dword [ecx + eax + 8]
xor ch, 0xa
movzx ecx, bl
rcl cx, cl
rol ax, cl
add edx, dword [ebp - 0xbc]
bt ebx, eax
pushfd
mov cl, byte [esp]
mov dword [ebp - 0x28], edx
clc
mov eax, dword [ebp - 0xa0]
bts edx, edi
imul eax, eax, 0x18
movsx dx, dl
xchg ch, dl
mov ecx, dword [ebp - 0xe8]
jmp 0xdfc57b
mov dword [esp + 0x40], edx
jmp 0xdf6a79
push dword [esp]
mov eax, dword [ebp - 0x94]
movzx cx, dl
mov dword [esp + 0x40], eax
call fcn.00dfbf58
bswap dx
setno dh
mov edx, dword [ecx + eax + 0x10]
pushfd
not ax
not ch
jmp 0xdf43b1

Function at 0xdf34f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
mov dword [esp + 4], 0
push ebp
mov dword [esp + 4], 0
lea esp, [esp + 4]
jnp 0xdf87a1
push 0xdf96d8
pushal
mov byte [esp], ch
pushfd
pushfd
push dword [ebp - 0x20]
pop dword [esp + 0x24]
pushal
push dword [esp + 0x44]
ret 0x48

Function at 0xdf3548
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, edx
sbb dl, al
bswap dx
mov dx, word [ecx + 6]
test dl, 0xe6
jmp 0xdf8d7f

Function at 0xdf355b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xdf3beb
mov word [esp + 0x14], 0x4ea2
lea esp, [esp + 0x40]
je 0xdf1c92
cmc
bt si, si
dec dx
mov edx, dword [ebp - 0x44]
stc
xor eax, eax
inc al
sub al, ch
mov al, byte [edx]
pushal
cmp eax, 0x55
push dword [esp]
call fcn.00df6ef2

Function at 0xdf35b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cx, dx
movsx dx, bl
mov dword [ebp - 0x68], eax
bswap cx
cwde
mov edx, dword [ebp - 8]
lahf
mov eax, dword [ebp - 0x8c]
movzx cx, bl
not ch
lea ecx, [ebx*8 + 0x4d4fa24b]
movsx cx, dl
mov ecx, dword [ebp - 0x68]
push dword [esp]
mov byte [esp + 4], ah
mov dword [eax + edx*4], ecx
pushfd
pushal
pushfd
lea esp, [esp + 0x30]
jmp 0xdfdd96

Function at 0xdf361b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, ecx
lea esp, [esp + 0x24]
add cl, dl
rcl cl, cl
call fcn.00df6081
Function at 0xdf3653
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
pushal
btc dx, cx
imul eax, eax, 0x14
pop edx
call fcn.00df1f37
cmp dword [edx + ecx + 0x10], 0
lea esp, [esp + 0x24]
jo 0xdf857f
jmp 0xdf69e4
mov dword [ebp - 0x38], ecx
pushal
push ebx
lea esp, [esp + 0x28]
jmp 0xdfb5df
add ecx, dword [eax + edx*4]
rdtsc
mov dword [ebp - 0x60], ecx
rcl dl, 3
add dh, ah
sal dx, 4
mov edx, dword [ebp - 0x60]
stc
add edx, 2
movsx ax, al
mov ch, dh
mov dword [ebp - 0x98], edx
xchg ecx, eax
movsx ecx, bl
pushfd
mov eax, dword [ebp - 0x98]
jmp 0xdf362a
setge cl
movsx ecx, cl
movzx cx, bl
mov dword [esp], eax
call fcn.00df206b
lea esp, [esp + 0x28]
je 0xdfcef9
shl al, cl
push 0xc8de7365
inc dl
sub ax, bx
mov edx, dword [ebp - 8]
rol cl, cl
sbb ah, 0x45
mov eax, dword [ebp - 0x64]
rcr ch, 1
inc ch
mov ecx, dword [eax + edx*4]
pushfd
jmp 0xdfa2d9
je 0xdfa4c3
clc
ror cx, 2
rdtsc
mov dword [ebp - 0x12c], 0
cmc
jmp 0xdfaed8
and ecx, 0x80000000
cmc
cmp ecx, 0x80000000
mov byte [esp + 4], 2
lea esp, [esp + 8]
je 0xdf855e
shrd edx, edi, cl
sub dh, 5
adc dl, 0xbd
sub dx, bx
mov edx, dword [ebp - 8]
bsr cx, sp
bt edi, esp
btr cx, cx
rol ah, cl
mov eax, dword [ebp - 0x64]
sal ch, 4
setnp cl
shrd cx, si, cl
mov ecx, dword [ebp - 0xbc]
jmp 0xdf3560
bt eax, 0xb
pushal
mov eax, dword [ebp - 0x38]
jmp 0xdf19e1
not dx
bts edx, 9
cmc
btc edx, esi
mov ecx, dword [ebp - 0x38]
push ebx
bt ax, di
pushal
movzx edx, al
imul ecx, ecx, 0x14
cmp ebp, 0x2063b46b
mov edx, dword [ebp - 0x40]
jmp 0xdf1a10
btc cx, dx
setae cl
rcr cx, cl
btc cx, dx
mov ecx, dword [ebp - 0x38]
push esi
add ecx, 1
jmp 0xdf2771

Function at 0xdf3b56
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push ecx
lea esp, [esp + 0x30]
jne 0xdfcdfe

Function at 0xdf3c59
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xdf89d2
pushal
lea esp, [esp + 0x2c]
jne 0xdf8a0f
bsf ebx, ebx
movzx ebx, cl
push 0x565e2fa
btc bx, 0xc
mov ebx, dword [eax + 0xa]
push ebp
push edi
push dword [esp]
test bh, bl
and ebx, 0xffffff
push eax
cmp ebx, 0x6c6c
pushal
lea esp, [esp + 0x34]
je 0xdfd7ba
shr cx, cl
mov ecx, dword [edi + 0x10]
movzx ax, dl
add ecx, edx
neg dh
cwde
rol dx, cl
lea ecx, [ecx + esi*4]
shl eax, 2
shl al, cl
mov dx, ax
rdtsc
mov dword [ebp - 0x7c], ecx
jmp 0xdf9bd3

Function at 0xdf3d89
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 8], bx
lea esp, [esp + 0xc]
je 0xdf796d
neg ecx
shrd cx, bp, cl
clc
mov ecx, dword [ebp - 0x44]
bt bx, bp
sub edx, edx
sar dl, 7
mov dl, byte [ecx + 8]
clc
test dl, 0xd7
jmp 0xdf60de
cmc
cmp eax, 0x6c
push dword [esp]
jmp 0xdf1fc4
cmp edx, 0x4c
jmp 0xdfe075
pushfd
jmp 0xdf5001

Function at 0xdf3f1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0xdf19d3
mov eax, ebp
shr al, cl
das
btc ax, di
mov eax, dword [ebp - 0x44]
push ebx
sub ecx, ecx
call fcn.00dfe511

Function at 0xdf4045
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0xdfce8f
Function at 0xdf41a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x28]
je 0xdf3b62
jmp 0xdf77d9
or ecx, ebp
mov eax, dword [ebp - 0x100]
inc cx
mov ecx, dword [eax + 0x30]
stc
mov byte [esp], bh
cmc
mov byte [esp], 0xe8
sub edx, edx
pushal
mov dx, word [ecx]
clc
cmp edx, 0x6e
jmp 0xdf18a7

Function at 0xdf4237
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dl
test dx, sp
and edx, 4
pushal
push edx
test edx, edx
push edi
pushfd
lea esp, [esp + 0x30]
je 0xdfcdfe
call fcn.00df41a4
jmp 0xdf1b4f

Function at 0xdf42ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bh
pushfd
lea esp, [esp + 0x50]
jne fcn.00dfd2f9
rol al, cl
aad 0xf3
aam 0x4e
mov eax, dword [ebp - 0x44]
cmc
jmp 0xdf905d

Function at 0xdf442d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne fcn.00dfd2f9
adc dx, sp
dec dl
mov edx, dword [ebp - 0x44]
clc
sub eax, eax
mov al, 0xf4
push ecx
add al, 0x53
mov al, byte [edx + 8]
call fcn.00df3d89

Function at 0xdf4570
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jne 0xdf80bc
push 0xef539696
pushal
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp 0xdfca9c

Function at 0xdf45e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x6c
jmp 0xdf6b6b
lea esp, [esp + 8]
jno 0xdf9c04
je 0xdf91cc
movsx ax, bl
rol ecx, cl
btr ax, 2
sbb cl, 0xf2
mov eax, dword [ebp - 0x100]
cmc
dec cl
bswap cx
mov ecx, dword [eax + 0x30]
call fcn.00df1f90
jmp 0xdf1d59

Function at 0xdf45ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt bx, bp
cmp esi, edx
sub edx, edx
sal dl, 1
sar dl, 4
add dl, bh
mov dl, byte [ecx + 8]
push dword [esp]
cmp edx, 0x4c
jmp 0xdf7141
lea esp, [esp + 8]
jne fcn.00dfd2f9
sbb eax, edi
push 0xca727372
mov eax, dword [ebp - 0x44]
cmc
pushfd
xor ecx, ecx
adc cl, dh
and cl, ch
mov cl, byte [eax + 9]
stc
cmp ecx, 0x6c
pushfd
call fcn.00df8bb6

Function at 0xdf478f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt ebx, edx
push 0x5734e264
cmp ebp, ebp
and edx, 0xffff
mov word [esp + 4], 0xe0
cmp edx, 0x2000
call fcn.00df6d9d