joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe32cdf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
bt edx, 0x1a
xor edx, edx
shld dx, si, 3
shr dl, 2
mov dx, word [ecx + 0x10]
jmp 0xe32f57
clc
cmp edx, 0x6c
lea esp, [esp + 0x24]
jae 0xe35b65
pushfd
pushfd
lea esp, [esp + 8]
je 0xe3bd9b
sbb ah, dl
sete al
test dl, cl
mov eax, dword [ebp - 0x100]
pushfd
mov ecx, dword [eax + 0x30]
jmp 0xe36087
pushfd
lea esp, [esp + 0x14]
je 0xe3864b
rcl al, cl
push 0xb01d34c5
add ch, 0xa4
shrd eax, ebx, 0xc
mov eax, dword [ebp - 0x100]
sar ch, cl
mov ecx, dword [eax + 0x30]
stc
push 0xda96f8d0
stc
sub edx, edx
not dx
movsx dx, bl
neg dh
mov dx, word [ecx + 0xe]
pushfd
jmp 0xe38aa2
call fcn.00e37504
pushal
pushfd
lea esp, [esp + 0x24]
je 0xe3bd9b
bt di, ax
mov eax, dword [ebp - 0x100]
rol cx, 4
pushal
adc cl, bl
rcl cx, cl
mov ecx, dword [eax + 0x30]
jmp 0xe32069
mov dword [esp], esp
bt ebp, edx
sub edx, edx
sal dh, cl
add dl, 0xbb
stc
rol dh, cl
mov dx, word [ecx + 0x10]
stc
push ecx
cmp edx, 0x4c
mov dword [esp + 4], ebp
call fcn.00e38c8f
cmc
clc
stc
cmp bl, 0x4c
pushfd
lea esp, [esp + 4]
jne 0xe321d4
stc
cmc
cmp bh, dh
mov bl, byte [eax + 9]
pushal
pushfd
push 0x9b7ee16a
test bl, bl
pushfd
push dword [esp]
call fcn.00e3a057
call fcn.00e364b6
lea esp, [esp + 0xc]
jl 0xe3c788
cmp edx, 0x4c
jmp 0xe3a307
cmp edx, 0x4c
push eax
pushfd
pushfd
mov byte [esp + 8], 0xe5
lea esp, [esp + 0x34]
jne 0xe38fe0
stc
neg cl
dec ch
mov eax, dword [ebp - 0x100]
mov cx, dx
test sp, bp
mov ecx, dword [eax + 0x30]
pushal
bt bp, cx
xor edx, edx
add dl, ah
stc
cmp dh, dl
mov dx, word [ecx + 0x10]
push 0xc1072e23
jmp 0xe32459
pushal
pushfd
jmp 0xe38641
inc ax
cmp esp, ebp
movzx eax, bl
mov eax, dword [ebp - 0x100]
test ah, 0x26
shld cx, ax, 1
bts ecx, edi
pushfd
mov ecx, dword [eax + 0x30]
cmp di, 0xd832
cmc
clc
cmc
xor edx, edx
stc
mov word [esp], bx
shld dx, dx, 2
mov dx, word [ecx + 0x12]
stc
pushfd
mov dword [esp], 0x35fc4746
test edx, edx
mov byte [esp + 4], ch
pushal
lea esp, [esp + 0x28]
jae 0xe371dd
jne 0xe38fe0
lea ecx, [edx + 0x6bee8a43]
mov eax, dword [ebp - 0x100]
pushal
pushfd
pop ecx
mov ecx, dword [eax + 0x18]
cdq
movsx edx, bl
bswap ax
mov dword [ebp - 0xf8], ecx
pop edx
mov edx, dword [ebp - 0x100]
movsx ax, al
push ebx
mov eax, dword [edx + 0x20]
pushfd
pushal
pushfd
pushfd
mov dword [ebp - 0xf0], eax
pushfd
lea esp, [esp + 0x50]
jmp 0xe371c6
push ebx
pushal
push edi
jmp 0xe3a299

Function at 0xe32d88
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0xe321d4
Function at 0xe32e6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], al
lea esp, [esp + 8]
je 0xe38c4d
movzx ax, dl
shrd ax, sp, 0xf
cmp sp, sp
mov eax, dword [ebp - 0x104]
movzx cx, bl
movsx cx, cl
stc
movzx cx, dl
mov ecx, dword [eax + 0x30]
call fcn.00e33f47
lea esp, [esp + 0xc]
je 0xe3ca25
call fcn.00e32216
cmp edx, 0x6c
jmp 0xe3435c
jmp 0xe32b45
jmp 0xe34c5b
lea esp, [esp + 0x20]
je 0xe3ca25
call fcn.00e3590d
push 0x61f87b09
lea esp, [esp + 4]
je 0xe3ca25
bt cx, bp
cmp dword [ebp - 0x90], 0
pushal
jmp 0xe348a7
test edx, edx
pushfd
mov word [esp + 4], 0x974a
pushfd
lea esp, [esp + 0x10]
je 0xe38f98
and eax, esi
bsr eax, eax
mov eax, dword [ebp - 0x44]
cmc
stc
pushal
bt bp, dx
xor ecx, ecx
adc cl, 0x18
shl cl, 1
mov cl, byte [eax + 0xa]
test si, dx
test ecx, ecx
push dword [esp + 0xc]
lea esp, [esp + 0x24]
jne 0xe3ca25
cmc
pushal
cmp dword [ebp - 0x70], 0
lea esp, [esp + 0x20]
jo 0xe3548b
je 0xe3ca25
clc
push esi
bt ebx, edx
test bl, 0x5f
cmp dword [ebp - 0x90], 0
push dword [esp]
pushfd
jmp 0xe32e5c
stc
jmp 0xe38f57

Function at 0xe32ec7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe3c5d4
mov byte [esp], 0x27
lea esp, [esp + 0x58]
jne 0xe3928c
pushfd
mov byte [esp], 0x3b
mov byte [esp], dh
lea esp, [esp + 4]
jmp fcn.00e372c1

Function at 0xe3305b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0x104]
lea ecx, [edx - 0x1858ded1]
mov ecx, dword [eax + 0x30]
push dword [esp + 4]
bt si, sp
jmp 0xe34512
xor edx, edx
or dh, 2
rol dl, 7
mov dx, word [ecx + 0xa]
stc
push dword [esp + 8]
push dword [esp]
cmp edx, 0x6c
push ecx
pushfd
push dword [esp]
lea esp, [esp + 0x3c]
je 0xe38c4d
sar ecx, 1
aam 0x6b
shl ax, cl
adc eax, 0x884cb15b
mov eax, dword [ebp - 0x104]
dec ecx
rol ecx, cl
dec ch
mov ecx, dword [eax + 0x30]
test bl, cl
xor edx, edx
call fcn.00e3ac37

Function at 0xe331f9
Capabilities:
Get number of processors
Packed with generic packer

Disassembly:
pushal
mov ebx, dword [ebp - 0xcc]
adc cl, dh
mov ax, 0xe31f
add ebx, dword [ebp - 0xbc]
aam 0xc3
movzx ax, bl
btr cx, 1
mov dword [edx], ebx
aam 0x50
xor byte [edx - 1], 0x80
xchg si, ax
rol di, cl
mov eax, dword [ebp - 0xac]
seta cl
sar dl, 6
mov dl, 0xc2
add eax, 0x10002395
sar ch, 4
mov dword [ebp - 0xb0], eax
add cl, 0x5b
jmp 0xe362c2
push dword [esp + 4]
sub ch, 0x27
push dword [esp + 0x28]
popfd
xor bh, 0xe1
xchg ah, cl
btc eax, edx
adc dh, bh
add esp, 0x2c
popal
sar al, cl
mov eax, dword fs:[0x30]
bt dx, 0xa
pushal
mov eax, dword [eax + 0xc]
mov byte [esp + 4], 0x9c
test eax, 0xcc51263f
clc
test ebx, 0xa48862ba
test eax, eax
push dword [esp + 8]
mov byte [esp], dh
lea esp, [esp + 0x24]
je 0xe359a6
btc eax, edi
mov eax, dword fs:[0x30]
call fcn.00e32aa5

Function at 0xe33405
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
je 0xe3b2fe
sbb cl, al
mov eax, dword [ebp - 0x100]
btc cx, ax
mov ecx, dword [eax + 0x30]
pushal
sub edx, edx
setae dh
jmp 0xe3b2d7
movsx dx, al
movzx dx, cl
mov dx, word [ecx]
add esp, 0x20
Function at 0xe3343a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0xe38a30
clc
pushfd
cmp dword [ebp - 0x118], 0
pushfd
push esi
push dword [esp]
pushal
lea esp, [esp + 0x30]
je 0xe38a30
pushal
cmp dword [ebp - 0x110], 0
push dword [esp + 0xc]
lea esp, [esp + 0x24]
je 0xe38a30
dec al
daa
das
rdtsc
lea eax, [ebp - 0x120]
and edx, 0x3ea18f42
inc dl
push eax
inc edx
rcr edx, 0x16
bswap edx
pushal
mov dword [esp + 0x1c], 1
clc
mov dword [esp + 0x18], 0
sbb dh, dh
sub dh, 0xdd
inc dx
sar dl, 5
mov edx, dword [ebp - 0xac]
pushal
push dword [esp + 4]
clc
add edx, 0x10002323
jmp 0xe3c040
mov dword [esp + 0x38], edx
pushfd
mov dword [esp + 0x38], 0x80000002
call fcn.00e33e52

Function at 0xe338c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe3c861
mov word [esp + 4], 0xf9cb
lea esp, [esp + 0x28]
jne 0xe3b389
setns al
shld ax, bp, 0xf
mov eax, dword [ebp - 0x104]
movzx cx, dl
sub ch, 0x4d
bswap ecx
mov ch, 0x77
mov ecx, dword [eax + 0x30]
bt dx, dx
test ax, ax
xor edx, edx
btr dx, 1
rcr dl, 4
movzx dx, cl
call fcn.00e35b26
pushal
pushal
push eax
mov word [esp], 0xffaa
lea esp, [esp + 0x44]
call fcn.00686480
cmc
cmp cl, al
mov dword [ebp - 0x20], eax
shrd si, sp, 0xc
daa
aad 0x21
mov eax, dword [ebp - 0xac]
or si, 0x70af
add eax, 0x100022ba
movzx si, dl
not si
mov esi, ecx
movsx esi, bl
mov esi, dword [ebp - 0x3c]
push eax
lea esp, [esp + 4]
call fcn.00686480
sbb dl, ah
mov dword [ebp - 0xb8], eax
pushal
sal dh, cl
rcr dx, cl
mov edx, dword [ebp - 0x3c]
shld eax, esp, cl
xor ah, 0x96
mov ecx, dword [edx + 0x3c]
bt sp, dx
cmc
movsx eax, bl
call fcn.00e326f6
push dword [ebp - 0x20]
pop dword [esp]
pushal
push esi
pushal
push dword [esp + 0x44]
ret 0x48

Function at 0xe33bb4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe36128
mov byte [esp + 8], al
lea esp, [esp + 0xc]
jne 0xe38fe0

Function at 0xe33c31
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xe9d0bb2c
mov dword [esp + 8], edx
jmp 0xe3c573
mov dword [esp + 0x24], 0xe39233
call fcn.00e364a1
pushal
jmp 0xe3b074

Function at 0xe33c86
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x28]
je 0xe39bd1
cmc
cmp bl, 0x44
jmp 0xe33ea9
rcr ah, cl
test ah, 0x4c
daa
bts ax, bp
mov eax, dword [ebp - 0x100]
clc
clc
sar ecx, cl
shrd cx, ax, 7
mov ecx, dword [eax + 0x30]
cmc
cmc
test ch, 0x79
xor edx, edx
ror dh, 6
stc
bts dx, 2
mov dx, word [ecx + 8]
clc
clc
stc
jmp 0xe346b2
lea esp, [esp + 0x2c]
je 0xe33852
shrd cx, si, 4
lea eax, [0x6bef131c]
aas
movsx eax, cl
mov eax, dword [ebp - 0x100]
shl cl, cl
mov ecx, dword [eax + 0x30]
call fcn.00e355a0
pushfd
lea esp, [esp + 4]
jne 0xe321d4
sbb bl, 0x94
sub bl, cl
mov bl, byte [eax + 3]
pushal
cmp bl, 0x6c
call fcn.00e3445b
mov dword [esp + 0x34], 0xe381ae
call fcn.00e3bcd4
cmp edx, 0x6c
call fcn.00e341e4
cmc
cmp bl, 0x64
pushfd
push dword [esp]
jmp 0xe330b2
Function at 0xe33cd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
cmp dword [ebp - 0xfc], edx
mov byte [esp + 8], bl
push 0x413d0e4b
mov byte [esp + 4], 0xa9
lea esp, [esp + 0x48]
je 0xe371c6
cmc
pushfd
btc eax, 0xe
shrd dx, bp, 0xb
mov eax, dword [ebp - 0xfc]
shld ecx, esi, cl
test esi, ebp
bt edi, 1
bsr cx, dx
mov dword [ebp - 0x100], eax
neg dh
push 0x8d95521d
mov ecx, dword [ebp - 0x100]
test bl, dl
btr edx, ebx
mov edx, dword [ecx + 0x34]
pushfd
pushfd
stc
cmc
and edx, 4
cmp cx, 0x6356
pushfd
test bx, 0x65a8
push dword [esp]
test edx, edx
jmp 0xe35353
push eax
mov byte [esp], al
lea esp, [esp + 0x1c]
je 0xe38fe0
sbb ecx, eax
or cl, bl
mov eax, dword [ebp - 0x100]
call fcn.00e3598c

Function at 0xe33db3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x6d
mov ecx, dword [ebp - 0x9c]
movzx ax, cl
mov dword [esp + 0x24], ecx
pushfd
mov edx, dword [ebp - 0xc]
call fcn.00e39076

Function at 0xe33df0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov word [esp], si
lea esp, [esp + 0x2c]
jne 0xe3ca25

Function at 0xe33f47
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x24]
jne 0xe38fe0
test bp, 0x3b79
stc
shl ah, 1
rcl cx, 0xf
mov eax, dword [ebp - 0x100]
bsr cx, bp
movzx cx, al
cmp ax, 0x4263
sal ch, 1
mov ecx, dword [eax + 0x30]
jmp 0xe3b3b9
push 0xd2b7bc5d
sub edx, edx
call fcn.00e350c0
cmp edx, 0x4c
jmp 0xe33aba
cmp al, 0xa9
sub edx, edx
pushal
bsr dx, di
mov dx, word [ecx + 8]
pushal
cmp di, bp
cmp edx, 0x6c
call int.00e39d87
jmp 0xe3b112

Function at 0xe341e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0xe3b490
btc ax, di
jmp 0xe3b45e

Function at 0xe341f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 8], 0x35b
lea esp, [esp + 0x30]
je 0xe39146
clc
pushal
jmp 0xe39136
stc
cmp bl, 0x44
pushal
pushfd
lea esp, [esp + 0x44]
jne 0xe321d4

Function at 0xe34386
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x24], 0
call fcn.00e325c7
jmp 0xe338a2

Function at 0xe34446
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 8], 0
lea esp, [esp + 0x48]
je 0xe34450
test di, 0xbef9
inc eax
jmp 0xe3278a

Function at 0xe3464f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
xor edx, edx
clc
cmc
ror dh, 6
mov dx, word [ecx + 0x16]
test dl, dh
pushal
cmc
pushfd
cmp edx, 0x6c
mov byte [esp + 4], 0x8b
call fcn.00e35dc3

Function at 0xe3466d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd3e0a079
push dword [esp]
lea esp, [esp + 0x34]
jne 0xe3b389
call fcn.00e3ac98
jmp 0xe36d35
mov edx, dword [ebp - 0x100]
pushfd
mov eax, dword [edx + 0x20]
call fcn.00e33e99
bswap cx
adc ch, bh
push 0x9be499c0
mov ecx, dword [ebp - 0x44]
cmp ah, 0x39
push dword [esp]
sub edx, edx
rcr dl, 4
not dl
shr dl, cl
mov dl, byte [ecx + 5]
stc
jmp 0xe3ac3f
pushfd
test dh, dh
cmp edx, 0x32
mov byte [esp + 8], cl
lea esp, [esp + 0xc]
jne 0xe3ca25

Function at 0xe34a24
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0xe321d4
Function at 0xe34aa4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
xor edx, edx
not dx
sal dl, cl
mov dx, word [ecx + 0x12]
call fcn.00e3acb4
call fcn.00e320f5
pushfd
pushal
clc
cmp edx, 0x2e
push dword [esp]
push dword [esp]
push ecx
push 0x3f5b19e1
lea esp, [esp + 0x34]
jne 0xe3b389
btc ax, 0xc
movsx cx, al
stc
shrd ax, dx, cl
mov eax, dword [ebp - 0x104]
shld ecx, ebp, 0x13
movzx ecx, bl
mov ecx, dword [eax + 0x30]
push 0xb2cb2e65
jmp 0xe33429

Function at 0xe34bd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], 4
pushfd
push dword [esp + 8]
mov byte [esp + 4], ch
push dword [ebp - 0x7c]
pop dword [esp + 0x2c]
pushfd
push 0x2c197c1c
mov dword [esp + 0x30], 0xe339a8
call fcn.00e39b14
jmp 0xe3a83e
sar cl, cl
pushal
mov ecx, dword [ebp - 0x130]
pushfd
cmp dword [ecx], 0
jmp 0xe33e74
add eax, dword [edx + 4]
mov byte [esp], 0x22
pushfd
push dword [esp + 4]
jmp 0xe3c14f
pushfd
lea esp, [esp + 0x28]
je 0xe335cd
rcr dh, cl
cmp di, dx
xor dl, bh
mov edx, dword [ebp - 0x130]
bts ax, dx
neg cl
add edx, 8
dec ax
pushal
mov dword [ebp - 0xd8], edx
adc eax, ebx
push dword [esp]
sub ah, 0xc4
xadd cl, al
mov eax, dword [ebp - 0x130]
sub ch, ah
pop ecx
stc
pushal
mov ecx, dword [eax + 4]
cmc
call fcn.00e369f6
push dword [ebp - 0x128]
pop dword [esp + 0xc]
pushal
jmp 0xe337b9
mov dword [ebp - 0x130], eax
pushfd
pushfd
pushal
pushfd
lea esp, [esp + 0x38]
jmp 0xe341ad

Function at 0xe34c56
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0xe321d4
jmp 0xe34a0f

Function at 0xe34ceb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x58409d
cmp edx, 0x6c
call fcn.00e32cdf

Function at 0xe34cf8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0xe3b389
cwde
sar al, 1
aaa
lea eax, [ebx + 0x60d1a65]
mov eax, dword [ebp - 0x104]
sar ecx, 3
pushfd
jmp 0xe3488d

Function at 0xe34d6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xe359a0
pushal
pushfd
lea esp, [esp + 0x24]
jne 0xe321d4
pushal
call fcn.00e3a1de

Function at 0xe34d8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x70], 1
lea esp, [esp + 4]
pushfd
mov byte [esp], bl
lea esp, [esp + 0x10]
je 0xe34636
push esi
jmp 0xe3462b
Function at 0xe34e0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0xe39bd1
stc
jmp 0xe35582
push dword [esp + 0xc]
pushal
lea esp, [esp + 0x44]
je 0xe32ebb
jmp 0xe363f8
mov bl, byte [eax + 4]
cmc
cmp bl, 0x6c
pushfd
jmp 0xe34be7
lea esp, [esp + 4]
je 0xe34a19
test ah, 0x31
call fcn.00e3b0a5
lea esp, [esp + 4]
jne 0xe321d4
xor bl, bh
or bl, 0xad
mov bl, byte [eax + 2]
test cx, sp
cmp bl, 0x64
pushal
lea esp, [esp + 0x20]
jge 0xe350c8
push 0xa666611
lea esp, [esp + 4]
je 0xe39bd1
test al, ch
cmp bl, 0x44
pushfd
push 0xd0d86f8e
pushal
push 0xb7b8fca0
lea esp, [esp + 0x2c]
jne 0xe321d4
rol bl, cl
shl bl, cl
sub bl, ch
add bl, 0x32
mov bl, byte [eax + 3]
bt ebp, 0xf
bt cx, 1
stc
cmp bl, 0x6c
pushal
jmp 0xe32508
jmp 0xe324e4
clc
cmp bl, 0x44
push eax
lea esp, [esp + 4]
jne 0xe321d4
sub bl, bl
mov bl, byte [eax + 3]
push 0x42dbf097
jmp 0xe37efe
test sp, 0x767d
bt bx, cx
cmp bl, 0x4c
pushal
push 0x89375b9f
pushfd
lea esp, [esp + 0x28]
jne 0xe321d4
ror bl, cl
jmp 0xe33b65
jmp 0xe3ade6
cmp bl, 0x6c
call fcn.00e3c605

Function at 0xe34e9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], 4
call fcn.00e34c8d

Function at 0xe34eba
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 8], 0x7179a218
lea esp, [esp + 0x20]
jne 0xe321d4
rol bl, 2
mov bl, 0x43
not bl
call fcn.00e357d2
sub edx, edx
bts dx, 0xc
test al, 0x4d
mov dx, word [ecx + 8]
clc
cmc
cmp cx, 0x65bc
cmp edx, 0x65
push ebx
jmp 0xe358a3
cmp edx, 0x45
pushfd
jmp 0xe386a8
lea esp, [esp + 0x4c]
je 0xe3acd3
dec ch
mov eax, dword [ebp - 0x104]
rcr cl, 1
neg cx
mov ecx, dword [eax + 0x30]
clc
xor edx, edx
or dl, al
neg dl
xor dl, 0x3b
sub dh, 0x33
mov dx, word [ecx + 8]
jmp 0xe35345
call fcn.00e34cf8
lea esp, [esp + 0x24]
je 0xe32ebb
stc
stc
cmp bl, 0x4c
jmp 0xe32ea8
Function at 0xe34fca
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt bp, dx
mov eax, dword [ebp - 8]
ja 0xe3b0bb
movzx cx, al
pushal
pop ecx
mov ecx, dword [ebp - 0x64]
clc
bt cx, 1
cmp dword [ecx + eax*4], 0
mov word [esp + 4], ax
pushfd
pushfd
lea esp, [esp + 0x24]
je 0xe3627e
aad 0xba
and ch, 2
aaa
mov edx, dword [ebp - 8]
jmp 0xe384f9
lea esp, [esp + 0x2c]
jno 0xe3a08f
je 0xe39b4b
bts cx, si
mov edx, dword [ebp - 8]
sal cx, 0xf
neg ax
das
stc
mov eax, dword [ebp - 0x64]
rcl cl, 3
lea ecx, [edx - 0x1af50c80]
mov ecx, dword [ebp - 0xbc]
pushal
push edx
pushal
jmp 0xe3c58e
add eax, 1
pushfd
mov dword [ebp - 8], eax
pushal
push edx
push eax
pushfd
lea esp, [esp + 0x38]
jmp 0xe32791
cmc
jmp 0xe37250
sal al, 6
test ch, cl
mov eax, dword [ebp - 8]
cmc
cmc
jmp 0xe32e00
and ecx, 0x80000000
pushfd
pushfd
cmp ecx, 0x80000000
push esp
pushal
jmp 0xe32d1f
aaa
xor ax, bp
bsf cx, sp
mov eax, dword [ebp - 0x64]
sal ch, cl
mov ecx, dword [eax + edx*4]
jmp 0xe33c26
pushfd
jmp 0xe39bb3
push dword [esp + 4]
lea esp, [esp + 0x28]
je 0xe39b4b
pushal
bsf edx, esi
neg al
mov edx, dword [ebp - 8]
adc cl, 0xff
shr al, 5
dec ecx
mov eax, dword [ebp - 0x64]
pushal
mov ecx, dword [ebp - 0xbc]
clc
call fcn.00e33c6e
jmp 0xe393d9
and ecx, 0x80000000
pushal
cmp ecx, 0x80000000
jmp 0xe39442
pushfd
pushal
call fcn.00e32cbc
push ebp
jmp 0xe3c32d
cmc
mov ecx, dword [ebp - 0x64]
cmp ch, bh
cmp dword [ecx + eax*4], 0
jnp 0xe3abeb
pushfd
lea esp, [esp + 4]
je 0xe3627e
movzx dx, dl
mov edx, dword [ebp - 8]
shrd ax, si, 4
mov eax, dword [ebp - 0x64]
adc ch, ah
shl ecx, 4
mov ecx, dword [eax + edx*4]
jmp 0xe38c2d
lea esp, [esp + 4]
je 0xe3627e
adc ch, 0xaa
mov edx, dword [ebp - 8]
mov cl, cl
call fcn.00e356a3
add ecx, dword [eax + edx*4]
bsf dx, bx
inc edx
btc ax, 0xc
mov dword [ebp - 0x60], ecx
inc al
pushfd
mov edx, dword [ebp - 0x60]
xchg ecx, eax
bsr cx, cx
shr al, 7
add edx, 2
jmp 0xe34566

Function at 0xe35109
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
jne 0xe38fe0
not ecx
xadd ax, cx
aas
mov eax, dword [ebp - 0x100]
lea ecx, [eax*2 + 0x47ed6f4a]
mov ecx, dword [eax + 0x30]
cmc
sub edx, edx
sbb dx, dx
mov dx, word [ecx + 4]
clc
pushfd
push eax
cmp edx, 0x64
mov word [esp], 0x3546
push edi
lea esp, [esp + 0xc]
je 0xe36136
ror ch, 5
neg ah
aam 0x86
and cx, 0xed52
mov eax, dword [ebp - 0x100]
dec ch
mov ecx, dword [eax + 0x30]
test ch, 0x6e
xor edx, edx
pushfd
setae dh
mov dx, word [ecx + 4]
test cl, ch
stc
push dword [esp]
cmp edx, 0x44
call fcn.00e33bb4
pushal
cmp edx, 0x54
jmp 0xe34b16

Function at 0xe35191
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0xe38a30
stc
bt esi, edx
bt sp, di
pushfd
cmp dword [ebp - 0x110], 0
push eax
pushal
push dword [esp]
call fcn.00e35bd4
Function at 0xe35370
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
mov eax, dword [edx]
pushfd
pushfd
pushfd
mov dword [ebp - 0x108], eax
pushfd
lea esp, [esp + 0x10]
jmp 0xe36ec9
stc
cmp dword [ebp - 0x108], ecx
pushfd
lea esp, [esp + 0x30]
jno 0xe38691
jb 0xe370d0
movzx eax, cl
pushfd
mov edx, dword [ebp - 0x108]
not ah
pushfd
mov eax, dword [edx]
pushal
jmp 0xe3ac32
jmp 0xe3924d
pushfd
lea esp, [esp + 4]
jb 0xe370d0
pushfd
rdtsc
lahf
mov edx, dword [ebp - 0x108]
pop eax
jmp 0xe334c2
jmp 0xe36bf5

Function at 0xe354c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push esi
lea esp, [esp + 0x28]
jne 0xe3b389

Function at 0xe355a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push dword [esp + 0xc]
call fcn.00e370f6

Function at 0xe35604
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov eax, dword [ebp - 0x2c]
mov byte [esp + 4], dl
lea esp, [esp + 0x24]
js 0xe38555
pushfd
mov dword [ebp + 8], eax
lea eax, [ecx - 0x21a5fac8]
call fcn.00e36d94
pushfd
mov word [esp], sp
push edi
lea esp, [esp + 8]
jg 0xe3c6bb
mov dword [ebp + 8], eax
mov al, bl
movsx ax, al
seto al
mov eax, dword [ebp - 0xbc]
jmp 0xe3c2a2
mov dword [ebp + 0xc], eax
push esi
jmp 0xe37196
pushfd
mov dword [ebp + 8], eax
bswap ax
lahf
call fcn.00e3563e

Function at 0xe35713
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0xe3ca25
pushfd
cmp ch, 0xe7
pushal
pushfd
cmp dword [ebp - 0x7c], 0
call fcn.00e36bd0
bt ax, di
cmp bl, 0x6e
push edx
jmp 0xe3bec8
pushfd
jmp 0xe35bb8

Function at 0xe357c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
btr eax, ebx
pushfd
mov dword [ebp - 0x28], edx
jmp 0xe3c99e
bswap dx
bt si, ax
setb ah
mov eax, dword [ebp - 0xa0]
mov byte [esp + 4], 0x92
mov word [esp + 4], si
imul eax, eax, 0x18
setnp cl
pushfd
movsx cx, dl
mov ecx, dword [ebp - 0xe8]
movsx dx, dl
mov edx, dword [ecx + eax + 0x10]
not al
xchg cx, ax
mov al, dl
mov dword [esp + 0x4c], edx
lea ecx, [0x7383c682]
bswap eax
mov eax, dword [ebp - 0x94]
bswap cx
lea ecx, [esi + 0x6dfa9e9e]
push dword [esp + 0xc]
setne cl
mov dword [esp + 0x4c], eax
push 0xa39eb269
movsx cx, dl
mov ecx, dword [ebp - 0x28]
call fcn.00e3c003

Function at 0xe357d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, byte [eax + 4]
push 0x44bc5919
bt di, cx
test ax, 0x89ca
cmp bl, 0x6c
mov byte [esp + 4], 0x6f
lea esp, [esp + 8]
je 0xe34a19
jmp 0xe36ad3
call fcn.00e3bbf4

Function at 0xe357f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
sar dl, cl
jmp 0xe326ee
jmp 0xe345a5
Function at 0xe35921
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
jne 0xe38a30
pushal
mov byte [esp], bh
mov dword [ebp - 0xc], 0x2000
call fcn.00e33e79
pushfd
call fcn.00e38fce
pushal
lea esp, [esp + 0x20]
jne 0xe3ca25
pushfd
lea esp, [esp + 4]
jmp fcn.00e3373a
jmp 0xe3bd50
movzx ax, bl
mov al, 0x81
lea eax, [edx*4 - 0x7a9a2e5e]
lea eax, [esi - 0x3307d459]
mov eax, dword [ebp - 0x10c]
push ebx
mov dword [esp], eax
pushfd
mov dword [esp + 4], eax
push 0x3b2b47a3
pushal
pushfd
lea esp, [esp + 0x2c]
je 0xe32897
push 0xe39fd0
jmp 0xe351e7
mov dword [ebp - 0x11c], eax
mov byte [esp], al
cmp dword [ebp - 0x11c], 0
mov dword [esp], edx
pushal
jmp 0xe344a7