joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2635f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 0x38]
call fcn.00014de0
ror bl, cl
shl bl, cl
mov ebx, eax
stc
pushal
cmc
test ebx, ebx
push 0xcbe66327
lea esp, [esp + 0x24]
je 0x47066
inc dl
mov edx, dword [ebp - 0x34]
pushal
mov byte [esp], 0x82
pushal
mov dword [ebp - 0x10], edx
cmc
cmc
jmp loc.0001baab

Function at 0x28349
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], 0x22414
pushfd
lea esp, [esp + 0x28]
jp 0x2e908
pushal
mov byte [esp], 0x81
mov dword [esp + 0x1c], edi
push 0x13664bcb
pushfd
pushfd
mov dword [esp + 0x24], esi
push ecx
pushfd
lea esp, [esp + 0x2c]
call fcn.00014430
pushal
cmp dl, ah
test al, al
pushal
pushfd
lea esp, [esp + 0x44]
jmp loc.000116f3
push 0xcffd87d1
mov dword [esp], 0x8e184b32
mov dword [esp], edi
call fcn.0004c50a

Function at 0x28599
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp eax, dword [ebp - 0x10]
mov word [esp], bx
lea esp, [esp + 4]
jbe 0x27efc
push ebx
lea esp, [esp + 4]
call fcn.0001f0e0
cmc
add eax, 0xc350
test sp, bx
mov dword [ebp - 0x10], eax
call fcn.00038116

Function at 0x287b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], eax
call fcn.0002b135

Function at 0x287c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ecx, dword [0x223a4]
cwde
mov dword [ebp - 4], ecx
pushfd
bswap ax
mov dword [0x223fc], ecx
lahf
lea edx, [ebp - 4]
jmp 0x405b0

Function at 0x2930d
Capabilities:
Execute anti-debugging instructions

Disassembly:
js 0x4977a
pushfd
call fcn.0003123f
xor ch, 0x61
dec cl
shr cl, cl
mov dword [ebp - 8], esi
add cl, 0x32
adc cx, di
sub eax, eax
shr cl, 2
setl cl
mov ecx, 0x2209c
cmc
pushfd
cmc
xchg dword [ecx], eax
push dword [esp]
jmp 0x27aef
pushfd
mov cl, byte [eax]
mov byte [esp + 4], al
inc eax
test si, bp
clc
jmp 0x3088d
clc
test cl, cl
pushal
pushfd
lea esp, [esp + 0x48]
jne 0x11441
shl bl, cl
test cx, di
sub eax, edx
movzx ebx, al
mov bh, bl
mov ebx, eax
pushal
mov byte [esp], bh
lea esp, [esp + 0x20]
je 0x38e9e
push 0x842ad858
bswap di
lea edi, [ebx + 1]
push dword [esp]
pushfd
call fcn.0003ec7a
cdq
setb al
setb dh
rdtsc
mov eax, dword [0x22448]
not cl
xchg cl, dl
seto dh
lea edx, [eax - 0x4bb4b1e1]
mov eax, dword [eax + esi*8 + 8]
dec cl
movsx dx, cl
dec cl
setne cl
lea edx, [eax + 1]
setp cl
call fcn.00037eb8
call fcn.0004156c
mov byte [esp + 4], 0xca
mov byte [esp], bl
push dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
pop dword [esp + 0x50]
mov byte [esp], bl
push dword [esp + 0x50]
ret 0x54

Function at 0x29659
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x20], 0
jmp 0x4190d
mov dword [esp + 0x1c], 0x492d6
call fcn.0003bb06

Function at 0x2a88b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0xc2f3
mov dword [esp + 4], edi
call fcn.00034d6f
Function at 0x2ab70
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
call fcn.00014f50
sar bh, cl
not bx
rcl bl, cl
mov ebx, eax
bt si, 0xe
test ebx, ebx
pushfd
pushal
pushfd
pushfd
lea esp, [esp + 0x2c]
je 0x43e15
mov di, 0x5548
pushal
mov edi, dword [ebp - 0x10]
push 0xe64120ac
mov dword [esp + 0x20], edi
pushfd
pushal
mov word [esp], si
mov byte [esp + 4], 0x1e
mov dword [esp + 0x40], ebx
pushfd
lea esp, [esp + 0x44]
jmp 0x2d7d7

Function at 0x2ade9
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp byte [esi], 0x56
jmp 0x42628
push esp
pushfd
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x4c0c2
pushfd
pop edx
lea edx, [ebp - 0x10]
pushfd
call fcn.0004bce8
pushal
push 0xab76ccad
lea esp, [esp + 0x48]
jne 0x3029e
jmp 0x268a6
call fcn.000252d7
jmp 0x2a1bd

Function at 0x2b493
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0x38e9e
mov edi, ebx
bswap di
lea edi, [ebx + 1]
jle 0x48db6
pushal
push eax
mov dword [esp + 0x20], edi
pushal
jmp 0x4b083
mov byte [esp + 0xc], dh
lea esp, [esp + 0x24]
jns 0x4de16
je 0x43e15
pushfd
cmp dword [ebp - 0xc], 0
push dword [esp]
lea esp, [esp + 8]
je 0x43e15
cwde
cdq
mov ecx, dword [ebp - 0xc]
pushal
lea eax, [esp - 0x6f5caaa2]
mov edx, dword [ebp - 8]
push dword [esp + 4]
bswap ax
bswap ax
lea eax, [ebp - 0x10]
pushal
call fcn.00042dd9
call fcn.0002d9b5
pushal
mov word [esp + 4], 0x3f71
lea esp, [esp + 0x20]
call sub.ntoskrnl.exe_memcpy
pushal
stc
test al, bl
add esp, 0x38
clc
pushfd
pushal
cmp dword [ebp - 8], 0
jmp 0x342e5
pushfd
mov dword [esp], edi
push ecx
pushfd
mov byte [esp + 4], dh
mov dword [esp + 4], 0
call fcn.00048a2b
mov dword [esp + 0x3c], 0
jmp 0x46ce2
push ebp
pushal
mov byte [esp], 0xc4
mov byte [esp], bl
lea esp, [esp + 0x24]
je 0x43e15
clc
cmp dx, cx
cmp dword [ebp - 0xc], 0
call fcn.00031e86

Function at 0x2bc97
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x2cb8a
movsx si, dl
movsx si, al
mov esi, dword [eax]
pushfd
mov byte [esp], cl
call fcn.0003158b

Function at 0x2bf72
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x4c
mov dword [esp + 4], eax
call fcn.0004bb09

Function at 0x2bf80
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bh, bl
test ah, 0x75
add esp, 0x14
cmc
sub eax, 0
pushal
push dword [esp + 4]
mov byte [esp], ch
lea esp, [esp + 0x24]
je 0x38541
jmp 0x36cb8
sub eax, 1
jno 0x43ffb
pushfd
mov dword [esp], 0x56ca23a4
pushal
lea esp, [esp + 0x24]
jne fcn.000356f7
pushal
mov dword [esp + 0x1c], 0x4c
pushfd
pushal
lea esp, [esp + 0x40]
jmp 0x305c4
push edi
push dword [esp]
mov byte [esp + 4], cl
lea esp, [esp + 8]
jne fcn.000356f7
pushfd
pushal
mov dword [esp + 0x20], 0x4c
push ebp
pushal
push dword [esp + 4]
lea esp, [esp + 0x48]
jmp 0x305c4
jmp 0x36fdc
Function at 0x2cf58
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx dx, al
dec ebx
lahf
jmp 0x43556
pushfd
call fcn.00025a93
cwde
lahf
mov ecx, dword [0x22444]
seta ah
pushfd
dec al
mov byte [esp + 4], al
mov eax, dword [ecx + ebx*8 + 4]
mov byte [esp + 4], 0x94
pushal
setnp dl
dec cl
lea edx, [eax + 1]
mov byte [esp], 0xda
mov byte [esp + 0xc], ah
nop
inc cl
mov cl, byte [eax]
push 0xaa70da3a
jmp 0x42901

Function at 0x2d6de
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
call fcn.0001cc4a
push dword [esp]
mov byte [esp], 0xb7
lea esp, [esp + 0x28]
call fcn.00014430
test bl, bh
test al, al
push 0xb3c6106d
pushfd
mov byte [esp], 0xac
push dword [esp + 4]
lea esp, [esp + 0xc]
jmp loc.000116f3
jmp 0x41e32
mov word [esp], 0x34e8
push dword [esp]
mov dword [esp + 4], 2
jmp 0x29709

Function at 0x2de96
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx - 0x67a4f2da]
lea eax, [ebp - 0x10]
pushal
mov byte [esp + 4], dl
pushal
mov dword [esp + 0x40], eax
call fcn.00030657
pushal
lea esp, [esp + 0x28]
je 0x43e15
test dx, 0x4ffa
cmp dword [ebp - 0xc], 0
pushfd
pushfd
lea esp, [esp + 8]
je 0x43e15
rdtsc
push 0xcf5fdd7
mov ecx, dword [ebp - 0xc]
rdtsc
cdq
lea edx, [ebx + 0x52351e5a]
movzx dx, dl
mov edx, dword [ebp - 8]
cwde
mov word [esp], 0xd6d3
jmp 0x2c6d1

Function at 0x2e411
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x28b94a48
lea esp, [esp + 0x2c]
je 0x4c0c2
and ax, sp
neg ah
shr ah, 2
mov eax, dword [0x226bc]
stc
test eax, eax
jmp 0x4b162
pushal
call fcn.0004d34e

Function at 0x2f116
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], ebx
push edx
mov byte [esp], dl
jmp 0x4afe4
jmp 0x28b88
jmp 0x28fea

Function at 0x2f9dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x10]
je 0x4c0c2
call fcn.0004ccaf

Function at 0x30047
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pushal
mov dword [esp + 4], 0xc910e107
lea esp, [esp + 0x2c]
jne 0x11441
bswap bx
pushfd
mov byte [esp], 0x3d
sub eax, edx
setne bh
mov bl, ch
not bl
mov ebx, eax
jmp 0x2929c
jmp 0x39d7a
push 0x34c72bcc
inc eax
clc
test cx, ax
push dword [esp]
test cl, cl
jmp 0x27d2b
pushal
pushfd
lea esp, [esp + 0x48]
call sub.ntoskrnl.exe_rand
sub si, bp
mov esi, eax
cmp si, 0xe45a
cmp di, si
test ah, bh
and esi, edi
jmp 0x44aa4
lea esp, [esp + 4]
je 0x38e9e
not di
push 0x1049a0e3
lea edi, [ebx + 1]
jmp 0x47a53
not cl
mov eax, dword [edx + esi*8 + 4]
mov dl, 0xa5
lea edx, [ebp - 0x641468a3]
lea edx, [ebx*4 - 0x42bcc692]
lea edx, [eax + 1]
inc cl
setg cl
mov cl, bl
mov cl, byte [eax]
call fcn.0004539e
push ebp
cmp esi, edi
pushal
lea esp, [esp + 0x24]
jb 0x2e356
dec cl
setg dl
lahf
dec esi
xchg dh, al
setno al
mov edx, dword [0x22448]
cwde
cwde
xchg al, cl
jl 0x3ecd2
mov eax, dword [edx + esi*8 + 4]
dec cl
lea edx, [eax + 1]
mov cl, 0x55
not cl
mov cl, byte [eax]
jmp 0x2fa5a
call fcn.00035b8d
Function at 0x30524
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xf6
pushfd
lea esp, [esp + 8]
call fcn.00012770
pushfd
mov word [esp], 0x2ac
mov byte [esp], 0xb3
lea esp, [esp + 4]
jmp 0x26d31

Function at 0x32781
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
jmp loc.0001bd40
push esi
call fcn.000112b0
pushal
lea esp, [esp + 0x40]
je 0x4c0c2
call fcn.000380d4
mov byte [esp + 0xc], 0xc5
call fcn.0003fbed
lea esp, [esp + 8]
je 0x2dcde
push 0x6015e7c8
movsx ax, dl
mov edx, dword [ebp - 0x1c]
lea eax, [ebp + 0x480030d6]
mov dword [esp], ecx
movsx ax, al
mov dword [esp], edx
rdtsc
cwde
bswap ax
mov eax, dword [ebp + 8]
push esi
mov dword [esp], eax
jmp 0x492db
mov dx, di
mov ecx, dword [ebx]
movzx edx, dl
jmp 0x404b2
mov edx, dword [ecx + 4]
jmp 0x32700
push 0
push 0x9b5e6312
lea edx, [esi*2 + 0x6d535038]
mov dword [esp], 0
jmp 0x32cf2

Function at 0x32eb3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x43e15
lea edi, [ebp*2 + 0x241dfce7]
mov edi, dword [ebp - 0x10]
push 0xb2fb7769
pushal
mov dword [esp + 0x20], edi
push dword [esp + 4]
mov dword [esp + 0x20], ebx
pushfd
mov byte [esp], 0xe8
lea esp, [esp + 0x24]
jmp 0x2d7d7

Function at 0x332aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
lea esp, [esp + 0x2c]
jb 0x2e356
pushfd
dec esi
call fcn.0003e647

Function at 0x33a80
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0x48e2b
clc
jmp 0x31a08

Function at 0x33d50
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x406b0
mov ax, di
mov ecx, dword [ebp - 0xc]
rdtsc
mov edx, dword [ebp - 8]
pushal
call fcn.00038912
jmp 0x4b194
lea esp, [esp + 0x24]
jp 0x277c2
push 0xde10da4
pushal
lea esp, [esp + 0x24]
je 0x43e15
jmp 0x30979
push 0xc73f2616
mov byte [esp], 0x10
push dword [esp]
lea esp, [esp + 8]
je 0x43e15
lahf
lahf
xchg ch, al
mov ecx, dword [ebp - 0xc]
rdtsc
mov edx, dword [ebp - 8]
push ebx
pushfd
pushal
lea eax, [ebp - 0x10]
push 0x1568873e
jmp 0x4b18e

Function at 0x352d2
Capabilities:
Reference http user-agent string

Disassembly:
pushfd
lea esp, [esp + 8]
call fcn.0001cb90
call fcn.000302ae
push edx
pushfd
mov byte [esp + 4], bl
push 0x95c3357f
mov dword [esp + 8], eax
call fcn.00032c33

Function at 0x352f5
Capabilities:
Reference http user-agent string

Disassembly:
lea esp, [esp + 4]
call fcn.0001f0e0
test bh, al
push 0xa4134930
call fcn.0003735c

Function at 0x366db
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xef
pushfd
mov word [ebx + 0x10], ax
push 0x8390dd94
pushal
pushfd
jmp 0x3276b
lea esp, [esp + 0x40]
call fcn.0001e890
call fcn.000300c2
mov dword [esp + 0x38], ebx
push esp
lea esp, [esp + 0x3c]
jns 0x40bbf
push esp
pushal
mov dword [ebx + 0xc], eax
call fcn.00031bf4
push edx
pushfd
mov dword [ebx + 0xc], eax
pushfd
push 0x685a11d1
pushfd
mov dword [esp + 0x10], 0x220a0
pushfd
jmp 0x30337
Function at 0x38697
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jl 0x2fc01
bt bx, 1
dec ah
rdtsc
call fcn.000287c0
mov dword [esp + 4], 0
pushal
call fcn.00041303

Function at 0x399e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x4c], esi
mov byte [esp], 0x7c
lea esp, [esp + 0x4c]
call fcn.00014430
clc
test al, al
pushfd
mov word [esp], 0xd2d6
lea esp, [esp + 4]
jmp loc.000116f3

Function at 0x3a05f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x14]
jne 0x271ae
cmc
push 0xcdbda607
test dh, dh
sub edx, 4
push ecx
cmc
mov byte [esp], ch
bt di, 8
add eax, 4
pushfd
test ax, dx
mov dword [esp], 0x726c2d5e
push 0xfda850b9
add ecx, 4
jmp 0x2be64

Function at 0x3aa4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jl 0x2dad9
pushal
bswap ax
mov eax, dword [ebp - 8]
test si, sp
pushfd
test eax, eax
pushfd
mov dword [esp], 0xf6c1aad2
mov byte [esp], 0x97
push dword [esp]
lea esp, [esp + 0x2c]
jmp 0x2aabf
cmp bl, 0x38
test eax, eax
push 0x5f5e5d42
jmp 0x31a8f
lea edx, [ebp - 0x124]
call fcn.000384c0
pushfd
pushfd
call fcn.0002af19
mov dword [esp], edx
push esp
lea esp, [esp + 4]
call fcn.00016d30
stc
test sp, 0x2931
jmp 0x36b48
xchg ch, dh
xchg cl, dl
lea ecx, [ebp - 0x18]
pushfd
pushfd
pushal
mov dword [esp + 0x24], ecx
lea edx, [esi - 0x52dc78b5]
bswap dx
push ecx
lea edx, [ebp - 0x124]
push dword [esp + 4]
call fcn.0003e5d2
test al, 0x85
test bl, dl
pushfd
clc
add esp, 0xc
stc
jmp 0x1be89
lea edx, [esi + 0x635e9cff]
mov dx, 0x6a77
bswap dx
push ecx
bswap dx
movsx dx, dl
bswap dx
jmp 0x3aa43
lea eax, [ebp - 8]
movzx dx, bl
mov dword [esp], eax
xchg cl, dh
jle 0x41956
setp ch
lea ecx, [ebp - 0x18]
not dx
not dl
jb 0x49ed8
push ecx
bswap dx
movsx edx, al
pushfd
lea edx, [ebp - 0x124]
jmp 0x3e5d7

Function at 0x3aa55
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 8], 0xf151199
pushfd
lea esp, [esp + 0x28]
je 0x38e9e
je 0x4bd00
pushal
pushfd
movzx di, bl
lea edi, [ebx + 1]
pushal
mov byte [esp + 0xc], 0x8b
pushfd
mov dword [esp + 0x44], edi
call fcn.0003a887
pushfd
lea edi, [ebx + 1]
pushfd
call fcn.0003996b

Function at 0x3afeb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], cl
mov dword [esp + 0x2c], 0x3b04a
mov word [esp], 0x53fd
mov dword [esp + 4], 0x2f4639f1
pushfd
call fcn.0004b5d0

Function at 0x3b00b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.000315a9
mov dword [esp + 0x30], ecx
pushfd
pushfd
lea esp, [esp + 0x38]
jno 0x343af
pushal
lea esp, [esp + 0x20]
call fcn.0001f2d0
lea ecx, [ebp - 0x4920d271]
movsx ecx, dl
mov ecx, dword [ebp - 4]
push ebx
mov dword [esp], ecx
pushfd
lea esp, [esp + 8]
jnp 0x3b4dd
push 0x3b40c
call fcn.0002dca1
cmc
inc si
neg si
mov esi, eax
bt ax, 1
clc
test esi, esi
push ebx
call fcn.0002dab5
call fcn.0004b878

Function at 0x3b311
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xc350
mov word [esp], 0x9146
mov word [esp], 0xf437
call fcn.0004057b
Function at 0x3c175
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
bt bp, bx
cmp eax, esi
push dword [esp + 4]
pushfd
call fcn.0003e690
jmp 0x32e8b

Function at 0x3ccc0
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
lea esp, [esp + 0x2c]
je fcn.00017673
push 0xd5cd7c35
jmp 0x39d46
mov dword [esp], edi
pushal
mov dword [esp + 0x1c], ebx
push dword [esp + 4]
jmp 0x2c0fa
mov byte [esp + 4], 0xda
mov dword [esp + 0x44], 0x3c73a
call fcn.00033eb9
xor si, cx
mov esi, eax
pushal
pushfd
test esi, esi
pushfd
mov byte [esp + 4], 0xc9
jmp 0x25120

Function at 0x3ed10
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
mov dword [esp + 0x2c], ecx
push dword [esp]
mov word [esp + 8], 0xab9
lea esp, [esp + 0x30]
call fcn.00014f50
push 0xa6a454fc
call fcn.0004dc94
mov byte [esp], dl
mov dword [esp + 0x2c], eax
jmp 0x3795b

Function at 0x3f032
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4e421
dec cl
setno cl
nop
not cl
dec cl
mov cl, byte [eax]
mov byte [esp], 0xe7
inc eax
clc
push esp
test cl, cl
pushfd
call fcn.00014b5e

Function at 0x3f831
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec cl
setle al
movsx dx, cl
bswap ax
mov edx, dword [0x22448]
jmp 0x366a9
call fcn.0001142e
lea ebx, [eax + 1]
mov dword [esp], 0x6dc90c9b
mov byte [esp], 0x79
mov byte [esp + 4], 0xb1
mov dword [esp + 0x3c], ebx
mov dword [esp + 8], 0xf02d4c7e
push eax
mov dword [esp + 0x3c], 0
call fcn.00035d28
lea esp, [esp + 0x48]
jb 0x2e356
lea edx, [eax*8 - 0xc7e5e6f]
lahf
dec esi
movsx dx, dl
lahf
rdtsc
setbe dh
mov edx, dword [0x22448]
pushfd
not cl
mov eax, dword [edx + esi*8 + 4]
movsx dx, al
not dl
lea edx, [eax + 1]
jmp 0x4033a
jmp 0x277b5

Function at 0x3fbc0
Capabilities:
Reference http user-agent string

Disassembly:
call fcn.00042889
mov dword [esp + 8], edx
pushal
pushfd
jmp 0x3c4e4

Function at 0x4002f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
sub eax, edx
mov byte [esp], 0x3f
pushfd
call fcn.00034c9b

Function at 0x4014b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x5c2c2140
push 0x346796f6
mov word [esp], cx
lea esp, [esp + 0x10]
call sub.ntoskrnl.exe_rand
xor si, 0xd5c3
mov esi, eax
cmc
pushfd
and esi, edi
clc
cmp di, bx
test bx, di
cmp esi, edi
push esi
mov word [esp], bx
call fcn.00027579

Function at 0x40180
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 8], ecx
pushal
mov word [esp], 0xa3fa
pushfd
jmp 0x33515
mov dword [esp + 0x28], eax
pushfd
push 0x22663590
mov dword [esp + 0x2c], ebx
mov byte [esp], dh
jmp fcn.00049775
pushal
push 0x42a594dd
mov dword [esp + 0x44], 0
jmp 0x42543
jmp 0x343b4
mov word [esp + 4], 0x794d
mov dword [esp + 0x40], ebx
mov byte [esp + 8], 0x77
mov byte [esp + 4], ch
mov byte [esp], 8
mov dword [ebp - 8], ebx
pushfd
mov dword [esp + 4], edx
pushfd
push 0x529ffcbf
lea esp, [esp + 0x4c]
call sub.ntoskrnl.exe_memset
not cx
rdtsc
movzx ecx, cl
rdtsc
mov ecx, dword [ebp + 8]
rdtsc
mov edx, dword [0x22448]
seto ah
cwde
lea eax, [edx - 0xed22130]
mov eax, dword [edx + esi*8 + 8]
push 0x1893a59a
push dword [esp]
jmp 0x2bf19
Function at 0x4055a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 0x38], ebx
pushfd
mov dword [ebx + 0xc], eax
push ecx
push dword [esp + 4]
pushfd
pushfd
mov dword [esp + 0x48], 0x220a0
mov byte [esp], cl
pushfd
call fcn.0003ecf8

Function at 0x4057b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], dh
cmp byte [0x224b2], 0
mov byte [esp + 4], 0x17
mov dword [ebp - 0x14], eax
pushal
lea esp, [esp + 0x28]
je 0x48e2b
call fcn.0004abbd
lea esp, [esp + 0x28]
je 0x27efc
cmp cx, di
call fcn.00025b42
movzx ax, al
sets ah
mov dword [esp + 4], edx
cwde
movsx eax, bl
lea eax, [ebp - 0x10]
pushfd
pushfd
push 0x3f745f44
call fcn.0004e3ca
pushfd
lea esp, [esp + 0x28]
jne 0x11441
bt bp, bp
shr bl, cl
sub eax, edx
lea ebx, [esi*8 - 0x6f9dc1d0]
setg bh
lea ebx, [edi*4 + 0x3a25965]
mov ebx, eax
push esi
pushal
mov word [esp], bp
pushfd
lea esp, [esp + 0x28]
je 0x38e9e
pushfd
jmp 0x2a866

Function at 0x41303
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
lea esp, [esp + 0x2c]
call fcn.0001e8d0
pushfd
movzx edi, cl
not di
mov edi, eax
call fcn.0001186b
movsx ax, cl
push 0x6cc719e2
cwde
movsx ax, dl
mov eax, dword [ebp - 0x18]
jmp 0x4a465

Function at 0x44101
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x10]
je 0x303a0
push edi
pushal
lea edi, [ebp*8 + 0x3af958f6]
mov edi, dword [eax]
pushal
lea esp, [esp + 0x44]
call sub.ntoskrnl.exe_rand
sub si, dx
rcl esi, 9
sar si, cl
mov esi, eax
cmp dl, 0xee
and esi, edi
push edx
cmc
clc
cmp esi, edi
push 0xe1246075
mov word [esp], bp
mov byte [esp + 4], al
jmp 0x4d03b
lea esp, [esp + 8]
jb 0x2e356
movsx dx, dl
not dh
pushal
cwde
dec esi
xchg dl, cl
mov edx, dword [0x22448]
lea eax, [ebp + 0xd134e71]
movzx ax, dl
mov eax, dword [edx + esi*8 + 4]
movzx dx, dl
setle dh
pop edx
lea edx, [eax + 1]
setne cl
setb cl
call fcn.0002930d

Function at 0x44da2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x95
mov dword [esp + 4], 0x56
pushfd
mov dword [esp + 4], esi
mov byte [esp], cl
push 0x2a480077
pushal
mov word [esp + 0xc], 0xf808
mov dword [esp + 0x24], 0x220c0
mov dword [esp + 0x10], edx
push 0xbded7d44
pushfd
mov byte [esp + 8], 0x46
lea esp, [esp + 0x2c]
call fcn.0001e890
push 0xb7301bde
mov dword [esp], 1
pushal
mov dword [esp + 0x1c], 0x100080
call fcn.00034b92
pushfd
call fcn.0002c9d1

Function at 0x45c90
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bl, 0xc9
test ecx, ecx
push ebx
call fcn.0001bd38
push 0xcfaa272d
lea esp, [esp + 0xc]
je 0x4930c
clc
shld cx, cx, cl
mov ecx, dword [0x226bc]
jmp 0x26323
jmp 0x338cd

Function at 0x47598
Capabilities:
Execute anti-debugging instructions

Disassembly:
test cl, cl
mov byte [esp], 0xd9
pushfd
pushal
lea esp, [esp + 0x34]
jne 0x11441
xor bh, 0x40
neg bx
sub eax, edx
movzx ebx, al
sete bh
mov ebx, eax
call fcn.0003aa55
push dword [esp + 4]
inc eax
cmp al, 0x3c
cmp ebx, 0x3fa01412
jmp 0x2a0b8
Function at 0x476b0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov word [esp], bx
push 0xdbd2ff8c
mov dword [esp + 4], str.REGISTRYMACHINESYSTEMCurrentControlSetControlSession_Manager
push edi
pushfd
lea esp, [esp + 0xc]
call fcn.00013e60
pushal
push ecx
lea esp, [esp + 0x24]
jmp fcn.000140f9

Function at 0x49d7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x40], esi
pushfd
push eax
mov byte [esp], 0xbc
lea esp, [esp + 0x48]
call fcn.00014430
cmc
call fcn.0002fc48

Function at 0x49fa5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xf8
pushfd
push edx
mov dword [esp + 0x38], edx
mov byte [esp], cl
lea esp, [esp + 0x38]
call sub.ntoskrnl.exe_memcpy
clc
shld ax, si, 7
add esp, 0x18
movzx dx, al
rdtsc
cwde
mov eax, dword [0x22448]
movsx dx, cl
movzx dx, al
mov eax, dword [eax + esi*8 + 8]
inc dx
sets cl
call fcn.0003689f
mov dword [0x22438], edi
push 0xf125df1e
pushal
lea esp, [esp + 0x30]
jmp fcn.00017673

Function at 0x4a89d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x44b7b
pushfd
sub eax, 1
jmp 0x38275
mov byte [esp], 0x20
mov byte [esp], 0x6a
lea esp, [esp + 4]
jne fcn.000356f7
jmp 0x3f32b
pushal
lea esp, [esp + 0x2c]
je 0x38541
jmp 0x3b62f

Function at 0x4abbd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0xc]
je 0x48e2b
bt bx, dx
clc
push esp
bt ax, di
cmp byte [0x2246b], 0
pushal
push eax
lea esp, [esp + 0x28]
jne 0x48e2b
call fcn.0004089d
stc
cmp dword [0x224d8], 0
push ebp
jmp 0x4babb
jmp 0x26938

Function at 0x4b6c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
jmp 0x3fcaa
mov byte [esp], 0xdd
pushal
mov dword [esp], 0x22af4f1a
lea esp, [esp + 0x2c]
je 0x48e1d
not ch
xchg ecx, edx
mov ecx, dword [0x22438]
movzx dx, dl
setae dh
mov dx, sp
mov dh, 0x44
mov edx, dword [0x22434]
pushal
mov dword [esp + 0x1c], ecx
mov word [esp], ax
pushal
mov byte [esp + 8], 0x76
mov dword [esp + 0x38], edx
mov byte [esp], 0x71
mov dword [esp + 0x34], esi
push dword [esp]
mov byte [esp], bh
lea esp, [esp + 0x38]
call sub.ntoskrnl.exe_memcpy
movzx eax, dl
shr al, cl
mov eax, dword [0x22438]
bt ebx, eax
cmp cl, bh
clc
add esp, 0xc
pushfd
mov word [esp], 0xf0d7
mov dword [esp], 2
jmp 0x4add1

Function at 0x4cfc9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], ebx
jmp loc.00017946
mov edx, dword [ebp - 4]
mov byte [esp], ah
jmp 0x34e13

Function at 0x4d20f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x40da9
mov ebx, eax
pushfd
pushal
lea esp, [esp + 0x24]
je 0x38e9e
mov di, si
pushfd
lea edi, [ebx + 1]
pushal
mov byte [esp], 0x9f
pushfd
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
call fcn.000444e1
lea esp, [esp + 8]
jne 0x11441
shr bx, cl
neg bh
rol ebx, cl
dec ebx
sub eax, edx
seta bl
jmp 0x33fad