joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f1ecb
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ecx, eax
push esp
push edx
lea esp, [esp + 0xc]
mov dword [esp + 0x18], ecx
call fcn.005f1775
clc
jnp 0x5f18a8
bsf ax, ax
bsr ax, bp
stc
jmp 0x5f18aa
bsf ax, ax
bsr ax, bp
stc
jmp 0x5f18aa
jmp 0x5f188a
sub esi, 4
stc
jp 0x5f1904
xchg ah, ch
ror ch, 5
pushal
jmp 0x5f1965
add edi, 0x28
cmc
cmc
sub esp, 4
jmp 0x5f1834
lea esp, [esp + 0x20]
inc ecx
cmc
jmp 0x5f18c2
ror ch, 5
pushal
jmp 0x5f1965
xchg ah, ch
jmp 0x5f18eb
movzx ecx, byte [edi - 1]
rdtsc
call 0x5f1940
bts edx, ebx
jmp 0x5f1da9
bsr dx, bp
rcl edx, 7
setb dh
bswap edx
shr dh, 5
mov dx, 0xdf07
jmp 0x5f1de3
bts edx, esp
bsr dx, cx
bts edx, edi
jmp 0x5f1d5a
bswap edx
bts edx, esp
bsr dx, cx
bts edx, edi
bts edx, ebx
xor al, 0xff
inc dl
jge 0x5f1d5f
jl 0x5f1df9
setg dh
clc
sete dh
mov dx, 0x65f7
mov edx, 0xbd32e10a
jmp 0x5f1e47
btc edx, esp
lea ebx, [ebx - 0x2c]
mov dh, 0x3e
not edx
lea edx, [ebp - 0x5a7a2cd9]
jmp 0x5f1e30
lea edx, [esi - 0x7550f3cb]
pushal
lea edx, [edx + edi]
jmp 0x5f1e08
bsr dx, bp
rcl edx, 7
setb dh
call 0x5f1db1
lea esp, [esp + 0x20]
not al
inc dx
jle 0x5f1e7e
jg 0x5f1e89
inc eax
iretd
mov dh, byte [esp]
neg dh
jns 0x5f1d9a
bswap edx
jmp 0x5f1d79
mov edx, dword [esp]
and dx, 0xa2c8
xchg dword [esp], ebx
bts edx, ebx
call fcn.005f1ebc
inc esi
int1
xchg dword [esp], ebx
xchg dword [esp], ebx
lea edx, [ecx - 0xe3]
mov dh, byte [esp]
btr edx, ebx
sbb edx, ebp
jmp 0x5f1dc6
mov dx, 0xf98d
mov edx, dword [esp + 4]
lea esp, [esp + 3]
lea esp, [esp + 4]
not al
jmp 0x5f1e1e
add dx, 0x4776
jmp 0x5f1ea1
add dx, 0x4776
mov dl, 0xac
bsr dx, cx
add dx, 0x51a6
jmp 0x5f20f1
mov dl, 0xac
bsr dx, cx
add dx, 0x51a6
jmp 0x5f20f1
bsr dx, bp
neg dx
dec dx
jne 0x5f2013
je 0x5f2013
rol dword [eax - 0x1d4cf0bd], 0x8d
adc al, 0x9d
add byte [eax], al
add byte [eax], al
btr edx, esp
lea edx, [ebx*4]
inc edx
jmp 0x5f1ec8
dec edi
mov edx, ebp
xchg dx, ax
not eax
lea eax, [edi*4]
bswap edx
jmp 0x5f1fa1
add bl, al
rdtsc
mov edx, dword [esp]
mov dh, byte [esp]
not ax
jmp 0x5f1eed
push edx
lea edx, [ebp - 0x8f8d2c9]
mov edx, esi
jmp 0x5f1f75
jmp 0x5f1f1c
sbb eax, ebp
jae 0x5f1f82
jb 0x5f1f82
inc dx
jp 0x5f1f8b
mov edx, dword [esp]
neg dx
mov dl, dh
mov edx, dword [esp]
jmp 0x5f209a
lea esp, [esp + 4]
rol cl, 0
mov dx, word [esp]
push edx
pop edx
mov dh, 0xc3
jmp 0x5f1f3e
invalid
cdq
Function at 0x5f2136
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x11], ch
jmp 0x5f2165
pop eax
lea esp, [esp + 0x20]
inc cl
rcl dh, 3
jmp 0x5f2226
bts edx, edi
lea eax, [edx*4]
mov ax, word [esp]
jmp 0x5f21c6
cbw
sub esp, 0x10
jmp 0x5f21d5
mov word [esp + 8], bx
mov dx, word [esp + 4]
lea edx, [esp + edx]
jmp 0x5f21f1
xchg ecx, eax
lea edx, [esi - 0xd]
mov dh, 0x9a
mov dx, 0x5fc5
sets dh
jmp 0x5f219c
ja 0x5f21a7
mov word [esp + 8], bx
mov dx, word [esp + 4]
jmp 0x5f220c
mov ax, word [esp]
jmp 0x5f21c6
cwde
neg dx
jge 0x5f2c49
mov dh, 0x12
sub esp, 0x1e
lea edx, [esp + edi]
jmp 0x5f26f9
lea edx, [esp + edx]
jmp 0x5f21f1
jnp 0x5f2175
bts edx, edi
lea eax, [edx*4]
jmp 0x5f21eb
mov dx, word [esp]
setp dh
mov dx, word [esp]
jmp 0x5f23cf
mov dx, word [esp]
setp dh
mov dx, word [esp]
call fcn.005f2255
mov dx, 0xfccd
inc ch
jmp 0x5f2419
mov dx, bx
lea edx, [ebx*4]
jmp 0x5f23fc
mov eax, dword [esi]
call fcn.005f2475
mov edx, dword [esp + 1]
jmp fcn.005f256f
jae 0x5f23e0
mov dx, bx
lea edx, [ebx*4]
jmp 0x5f23fc
lea esp, [esp + 2]
jmp 0x5f28ce
sub esp, 0x1e
lea edx, [esp + edi]
lea esp, [esp + 2]
xchg ecx, eax
neg dh
jl 0x5f23c4
jge 0x5f2283
jb 0x5f28f5
xchg ecx, edx
mov ax, 0x22c7
jmp 0x5f2933
xchg ecx, edx
mov ax, 0x22c7
jmp 0x5f2933
sub esi, 4
not cx
lea ecx, [esi - 0xc5]
xchg edx, eax
mov cl, ch
call fcn.005f296d
jmp [esi - 4]
mov dh, 0x12
jmp 0x5f28c4

Function at 0x5f2475
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 1]
jmp fcn.005f256f
setl ch
bt ecx, edi
ja 0x5f2403
jbe 0x5f244c
mov al, 0x32
mov al, byte [0xb28132c7]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0xfb31

Function at 0x5f2552
Capabilities:
Execute anti-debugging instructions

Disassembly:
out dx, eax
pop ebx
xchg esp, eax
pop es
mov dword [esi], edx
pushal
setl al
mov ax, word [esp + 2]
mov dword [esp + 0x17], eax
jmp fcn.005c8e3f

Function at 0x5f25a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esi]
not ch
dec eax
jmp 0x5f25c9
neg cl
mov eax, ebx
call fcn.005f25fb
loop 0x5f25c8
mov bl, 0x27
mov bh, 0xd2
and esp, ebp
fidivr dword [edx + 0x35715db4]
jmp 0x5f257f
mov dword [esi - 0x41], esi
jbe 0x5f258a
neg cl
mov eax, ebx
jmp 0x5f258e

Function at 0x5f296d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebx
push esp
push dword [esp + 2]
pop word [esp + 1]
mov dl, dh
pop edx
jmp 0x5f2a6e
mov edx, 0x5ac78004
lea eax, [ebp*4]
inc dh
shr ah, 1
mov dx, 0x814d
jmp 0x5f2954
rdtsc
push dword [esp]
ret 4
mov eax, ecx
xchg dword [esp], ebx
stc
xchg edx, eax
mov dh, byte [esp]
add edx, ebp
jmp 0x5f29ce
lea esp, [esp + 2]
lea ebx, [ebx - 0x32]
rdtsc
stc
mov ax, word [esp]
inc dl
jmp 0x5f2a01
Function at 0x5f350d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + edi]
mov ax, dx
jmp 0x5f3626
inc dl
jmp 0x5f378b
bswap eax
call 0x5f35f8
sbb byte [eax], al
add byte [eax], al
das
xchg dword [esp + 8], ecx
xchg edx, eax
bsf dx, ax
rcr dh, 7
pushal
jmp 0x5f3607
and dword [esi - 0x75], edx
adc al, 0x24
push dword [esp]
mov dx, di
mov eax, edi
jmp 0x5f35e1
mov dword [esp + 7], esi
lea ecx, [ecx - 0x2f]
call fcn.005f362d
jp 0x5f35f7
jo 0x5f362e
loop 0x5f3670
mov eax, 0x21d2b727
popfd
invalid
mov eax, 0xcf757a4e
jmp 0x5f365b
les eax, [ecx]
push word [esp + 2]
mov dh, ch
mov dx, sp
jmp 0x5f3640
lea esp, [esp + 1]
xchg dword [esp + 0x2c], ecx
mov dx, word [esp]
jmp 0x5f3695
bswap edx
inc eax
jp 0x5f35d9
bswap eax
jmp 0x5f3673
push dword [esp + 0x2c]
ret 0x30
mov al, 0xf6
rol edx, 0x1d
lea eax, [edx + ebx]
jmp 0x5f35c1
lea edx, [eax*4]
inc dl
lea edx, [eax*4]
bsr dx, cx
jmp 0x5f366c
lea eax, [ebp + 0x17]
not eax
call 0x5f36b7
inc ecx
invalid
xchg dh, dl
xor dx, 0x1090
mov dl, cl
jmp 0x5f36cf
rdtsc
jmp 0x5f36e8
add cl, bl
neg edx
jbe 0x5f3750
rdtsc
xchg dh, dl
xor dx, 0x1090
jmp 0x5f36ef

Function at 0x5f35dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + edi]
mov ax, dx
jmp 0x5f3626
inc dl
jmp 0x5f378b
bswap eax
call 0x5f35f8
sbb byte [eax], al
add byte [eax], al
das
xchg dword [esp + 8], ecx
xchg edx, eax
bsf dx, ax
rcr dh, 7
pushal
jmp 0x5f3607
and dword [esi - 0x75], edx
adc al, 0x24
push dword [esp]
mov dx, di
mov eax, edi
jmp 0x5f35e1
mov dword [esp + 7], esi
lea ecx, [ecx - 0x2f]
call fcn.005f362d
jp 0x5f35f7
jo 0x5f362e
loop 0x5f3670
mov eax, 0x21d2b727
popfd
invalid
mov eax, 0xcf757a4e
jmp 0x5f365b
les eax, [ecx]
push word [esp + 2]
mov dh, ch
mov dx, sp
jmp 0x5f3640
lea esp, [esp + 1]
xchg dword [esp + 0x2c], ecx
mov dx, word [esp]
jmp 0x5f3695
bswap edx
inc eax
jp 0x5f35d9
bswap eax
jmp 0x5f3673
push dword [esp + 0x2c]
ret 0x30
mov al, 0xf6
rol edx, 0x1d
lea eax, [edx + ebx]
jmp 0x5f35c1
lea edx, [eax*4]
inc dl
lea edx, [eax*4]
bsr dx, cx
jmp 0x5f366c
lea eax, [ebp + 0x17]
not eax
call 0x5f36b7
inc ecx
invalid
xchg dh, dl
xor dx, 0x1090
mov dl, cl
jmp 0x5f36cf
rdtsc
jmp 0x5f36e8
add cl, bl
neg edx
jbe 0x5f3750
rdtsc
xchg dh, dl
xor dx, 0x1090
jmp 0x5f36ef
Function at 0x5f35f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + edi]
mov ax, dx
jmp 0x5f3626
inc dl
jmp 0x5f378b
bswap eax
call 0x5f35f8
sbb byte [eax], al
add byte [eax], al
das
xchg dword [esp + 8], ecx
xchg edx, eax
bsf dx, ax
rcr dh, 7
pushal
jmp 0x5f3607
and dword [esi - 0x75], edx
adc al, 0x24
push dword [esp]
mov dx, di
mov eax, edi
jmp 0x5f35e1
mov dword [esp + 7], esi
lea ecx, [ecx - 0x2f]
call fcn.005f362d
jp 0x5f35f7
jo 0x5f362e
loop 0x5f3670
mov eax, 0x21d2b727
popfd
invalid
mov eax, 0xcf757a4e
jmp 0x5f365b
les eax, [ecx]
push word [esp + 2]
mov dh, ch
mov dx, sp
jmp 0x5f3640
lea esp, [esp + 1]
xchg dword [esp + 0x2c], ecx
mov dx, word [esp]
jmp 0x5f3695
bswap edx
inc eax
jp 0x5f35d9
bswap eax
jmp 0x5f3673
push dword [esp + 0x2c]
ret 0x30
mov al, 0xf6
rol edx, 0x1d
lea eax, [edx + ebx]
jmp 0x5f35c1
lea edx, [eax*4]
inc dl
lea edx, [eax*4]
bsr dx, cx
jmp 0x5f366c
lea eax, [ebp + 0x17]
not eax
call 0x5f36b7
inc ecx
invalid
xchg dh, dl
xor dx, 0x1090
mov dl, cl
jmp 0x5f36cf
rdtsc
jmp 0x5f36e8
add cl, bl
neg edx
jbe 0x5f3750
rdtsc
xchg dh, dl
xor dx, 0x1090
jmp 0x5f36ef

Function at 0x5f37fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
jmp 0x5f3739
lea esp, [esp + 1]
lea esp, [esp + 2]
stc
jo 0x5f376c
mov al, 0x84
lea esp, [esp + 1]
jmp 0x5f3770
lea esp, [esp + 1]
jmp 0x5f3770
mov al, 0x84
jmp 0x5f3754
not dl
lea eax, [ecx + ebx]
mov al, 0x6a
bsr ax, cx
je 0x5f37b7
lea eax, [esi - 0x3d]
bsf ax, ax
jmp 0x5f37b9
lea eax, [esi - 0x3d]
bsf ax, ax
inc al
mov ax, word [esp]
lea eax, [esi + edi]
xchg al, ah
jmp 0x5f3857
jmp 0x5f379f
inc al
mov ax, word [esp]
lea eax, [esi + edi]
jmp 0x5f37af
mov al, byte [esp]
setl al
bsr ax, cx
call fcn.005f37f5
jl 0x5f37fc
jne 0x5f3770
xor cl, cl
push 0xc48ac80f
bswap eax
mov al, ah
jmp 0x5f37d8
mov word [esp], sp
xchg dword [esp], eax
jmp 0x5f3881
bsr ax, bp
jbe 0x5f37ef
bswap eax
mov al, ah
mov al, byte [esp]
setl al
bsr ax, cx
jmp 0x5f37e2
xor dl, 0xff
not ah
setge al
lea eax, [esi - 0x1d]
mov ax, word [esp]
jmp 0x5f3816
push word [esp + 3]
push word [esp + 3]
neg ax
lea eax, [ebp + 0x66dbefcf]
jmp 0x5f3890
setb al
rcl al, 3
jp 0x5f3868
push word [esp + 3]
jmp 0x5f38b4
lea esp, [esp + 8]
rol dl, 0
btr eax, edx
jle 0x5f39d1
jg 0x5f395a
jmp 0x5f3922
push word [esp + 3]
neg ax
lea eax, [ebp + 0x66dbefcf]
jmp 0x5f3890
shr ah, 1
mov ax, 0xc325
jmp 0x5f38ea
add bl, dl
lea eax, [eax + 0x49]
pushal
clc
ja 0x5f390b
mov dword [esp + 0x17], esi
jmp 0x5f3934
cmc
jb 0x5f38dd
shr ah, 1
mov ax, 0xc325
jmp 0x5f38ea
jmp 0x5f3930
sub eax, dword [edx - 3]
int3
mov al, 0x42
neg ax
jmp 0x5f39df
mov dword [esp + 0x17], esi
mov al, ah
mov ax, word [esp]
mov al, byte [esp]
jmp 0x5f3926
mov al, ah
mov ax, word [esp]
mov al, byte [esp]
mov al, 0x42
neg ax
xchg ah, al
not ax
mov al, 0x70
jmp 0x5f3900
Function at 0x5f3e26
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x20]
ret 0x24
je 0x5f3e4c
and dl, al
and al, 0
not eax
lea eax, [edx*4]
jmp 0x5f3e58
enter 0xffffffffffffa30f, 0xffffffffffffffd0
pushal
lea eax, [ebp + 0xf]
bswap eax
jmp 0x5f3e25
sub esi, 2
mov eax, 0x59d4aa9c
call fcn.005f3eb3
adc ebx, dword [ecx + 0x5b9b6809]
js 0x5f3ec8
mov dl, 0xad
mov esp, 0x95048d
add byte [eax], al
add bl, ch
fild word [ebx + edx - 0x5bea197d]
sbb dl, byte [edx + ecx - 0x7ed16393]
inc eax
add edi, esi
inc al
push dword [esp]
ret 4
push word [esp + 1]
jmp 0x5f3ed1
push esp
xchg word [esp], ax
jmp 0x5f3f70
int1
rol byte [eax - 0x2a], cl
mov cl, 0x40
cmp dword [ebp + 0x4c], 0xffffff8d
and al, 2
lea esp, [esp + 2]
shl edx, cl
setbe ah
mov eax, dword [esp]
jmp 0x5f3eb9
push edx
lea esp, [esp + 3]
mov eax, ecx
lea esp, [esp + 1]
jmp fcn.005c8e3f
lea esp, [esp + 2]
pushfd
pop dword [esi]
not ax
jmp 0x5f3f13
mov dword [esi + 4], edx
pushal
mov cx, dx
xchg ch, dl
pop word [esp + 0x17]
jmp 0x5f3f4d

Function at 0x5f3eb3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x5f3ed5
neg al
js 0x5f3e90
jns 0x5f3e9b
Function at 0x5f4716
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 5]
lea esp, [esp + 2]
jmp 0x5f4b9f
lea edx, [edx + ebp]
inc ch
pop dx
lea esp, [esp + 2]
jmp 0x5f4847
dec ax
lea ecx, [eax + 0x91]
xchg ch, cl
pushal
btr edx, edx
jmp 0x5f488e
push word [esp + 0xf]
mov dl, 0xb4
jmp 0x5f4b3b
xchg dx, cx
neg ecx
cwde
jmp 0x5f47f9
mov dx, si
call fcn.005f4830
mov cx, 0x82c5
jmp 0x5f4819
jmp 0x5f47ed
push edx
mov edx, esi
mov dword [edx], eax
pop edx
jmp fcn.005c8e3f
lea esp, [esp + 0x1c]
inc ax
mov cl, 0x5a
ror edx, 9
jb 0x5f4817
xchg dx, cx
neg ecx
jmp 0x5f47f2
pop dx
lea esp, [esp + 2]
jmp 0x5f4847
je 0x5f47ab
lea edx, [edx + ebp]
inc ch
jmp 0x5f486a
sub esp, 0
mov byte [esp + 0x16], dh
push word [esp + 0xf]
jmp 0x5f47e1
sub esp, 0
mov byte [esp + 0x16], dh
push word [esp + 0xf]
push word [esp + 0xf]
mov dl, 0xb4
setb cl
lea esp, [esp + 0x20]
jmp 0x5f47c8
lea esp, [esp + 0x18]
neg ax
sub esp, 0x1c
jg 0x5f4b28
jle 0x5f48a8
invalid
xchg ch, cl
add bx, dx
jne 0x5f4c47
je 0x5f4c1e
jno 0x5f4bb3
jg 0x5f4be0
jmp 0x965fe50d
mov byte [esp], ch
pop cx
jmp 0x5f4bb5
adc al, byte [eax + 0x13d012e7]
mov ah, byte [0xf6ec754]
mov bl, 0xd1
jae 0x5f4bd2
mov byte [esp], ch
pop cx
xchg ch, cl
jmp 0x5f4bb7
xchg ch, dl
jmp 0x5f4c54
sete ch
shr dx, cl
jne 0x5f4c2b
sub ch, dh
jmp 0x5f4c88
mov edx, ebp
lea edx, [ebx*4]
bswap edx
jmp 0x5f4bf9
sub ch, dh
xchg edx, ecx
sub esp, 0xc
inc edx
bswap edx
xchg byte [esp + 1], ch
xchg dh, ch
pop ecx
pop word [esp + 3]
add ebp, ebx
invalid
mov edx, ebp
lea edx, [ebx*4]
bswap edx
xchg ch, dl
sub edi, 2
setae ch
setle ch
mov cx, bp
jmp 0x5f4bfd
bswap edx
jmp 0x5f4c35
xchg dword [esp], edx
lea esp, [esp + 2]
rol ax, 0
xchg cx, dx
lea edx, [ebp - 0x5f6caa49]
jmp 0x5f4c90
xchg edx, ecx
sub esp, 0xc
inc edx
jmp 0x5f4c62
mov cx, 0x8c53
lea edx, [ecx - 0xa3]
pushal
inc ch
js 0x5f4cd8
jns 0x5f4cc0
jmp 0x6aff4510
xchg word [esp + 0x11], cx
jmp 0x5f4d12
xchg word [esp + 0x11], cx
jmp 0x5f4d12
mov cx, 0x31e3
mov edx, dword [esp]
mov cl, byte [esp]
not dh
inc ch
mov ecx, dword [esp]
stc
jmp 0x5f4dda
lea esp, [esp + 0x24]
dec ax
stc
jb 0x5f4cf9
jae 0x5f4d25
adc byte [edx + ecx - 0x7ed26393], dl
inc eax
mov cx, 0x31e3
mov edx, dword [esp]
mov cl, byte [esp]
jmp 0x5f4d35
not dh
inc ch
jmp 0x5f4d07
shl ecx, 1
call fcn.005f4d96
inc ebp
into
pop esp
cmp edx, esi
adc eax, 0x96f363d5
mov eax, dword gs:[0x53d05126]
neg ax
lea edx, [esi - 0x1091720b]
mov edx, dword [esp]
adc al, 0x24
inc dl
jmp 0x5f4dbc
pushal
add esp, 0x35
and ecx, eax
jmp 0x5f4e60
jge 0x5f4d5c
shl ecx, 1
jmp 0x5f4d5e
jae 0x5f4e55
shl ch, 1
sub esp, 0x18
jmp 0x5f4d8b
shl ch, 1
sub esp, 0x18
pushal
add esp, 0x35
and ecx, eax
lea esp, [esp + 3]
jmp 0x5f4d73

Function at 0x5f4830
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr cx, cx
ja 0x5f4801
mov cx, 0x82c5
jmp 0x5f4819
Function at 0x5f5002
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
inc ax
mov dx, 0x9b39
lea ecx, [esi - 0x61fbf233]
not dx
jmp 0x5f505a
mov ch, 0x30
xchg dword [esp], edx
clc
jmp 0x5f4fab
bswap edx
mov ch, 0x30
xchg dword [esp], edx
clc
jmp 0x5f4fab
xor dx, 0xfc12
jp 0x5f4fe7
bswap edx
jmp 0x5f4fcb
lea ecx, [ecx - 0x5c8a68ed]
mov dx, cx
jmp fcn.005c8e3f
mov word [esi], ax
bswap ecx
btc ecx, esp
jg 0x5f500d
jle 0x5f5042
sub ch, byte [eax + 0x1ba8593e]
inc ebp
hlt
lea ecx, [ecx - 0x5c8a68ed]
mov dx, cx
jmp fcn.005c8e3f
mov cl, ch
jmp 0x5f502e

Function at 0x5f7189
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 3]
lea esp, [esp + 1]
jmp 0x5f71ed
mov cl, byte [esp]
mov dx, word [esp]
jmp fcn.005c8e3f
sub dx, 0x4e90
jmp 0x5f71b9
mov word [esp], dx
lea esp, [esp + 3]
bsr cx, bp
jns 0x5f71d1
sub dx, 0x4e90
mov cl, byte [esp]
mov dx, word [esp]
jmp fcn.005c8e3f

Function at 0x5ff0dc
Capabilities:
Encode data using xor

Disassembly:
push ds
scasb al, byte es:[edi]
pop es
scasb al, byte es:[edi]
mov ecx, 0x66d2fb98
push word [esp + 1]
sub esp, 0x1c
call fcn.005ff043
dec esi
int 0x5d
and al, 0xd7
adc ebx, eax
pop esi
int3
mov ch, 0x62
jl 0x5ff061
invalid

Function at 0x6008ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006008ba
lea esp, [esp + 3]
jmp 0x6008e0
mov eax, dword [ecx + 4]
stc
call 0x6008ea
int1
push word [esp + 1]
pushal
lea esp, [esp + 2]
jmp 0x600958
cmp eax, 8
call 0x600922
into
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x600aa6
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
je 0x5bd84f
jne 0x600919
jecxz 0x6009c9
in al, dx
mov eax, dword [esi - 0x3cac10cd]
cmpsb byte [esi], byte es:[edi]
push ebp
aam 0x56
rol dword [eax + 0x2424648d], 0x85
shl byte [eax + 0x66], 0x8f
inc esp
and al, 0x13
lea esp, [esp + 0x24]
test eax, eax
pushal
pop word [esp + 0x13]
mov byte [esp + 0xf], ch
jmp 0x600939
dec edi
xchg ebx, eax
cdq
lds ebx, [ecx - 0x5e]
mov dh, cl
sub cl, ah
lodsd eax, dword [esi]
jnp 0x6009e2
dec eax
sub al, 0xf5
invalid
salc
fidiv dword [edx + 0x4800fb46]
and dword [eax - 0x73], eax
jo 0x6009e6
sti
add byte [eax + 0x21], cl
inc eax
push word [esp + 1]
jmp 0x600cb4
lodsb al, byte [esi]
and al, byte [ebp - 0x4c]
or ah, byte [ecx + edi*4]
sub dword [eax - 0x45], ecx
jnp 0x600cb9
jnp 0x600cf5
lea esp, [esp + 0x1c]
add ecx, dword [ecx + 4]
push edx
mov dword [esp], esi
pop word [esp]
jmp 0x600c8d
lea esp, [esp + 4]
jne 0x6004b1
test ebx, esi
idiv edi
dec dword [edi]
test byte [ebx + 0x5bfffbcb], cl
je 0x5bd84f
pop word [esp]
lea esp, [esp + 2]
jmp 0x600cf9
pop edx
mov ch, 0xa4
xlatb
leave
call fcn.00600d1c
and dword [edx + edx*2 + 0x2971c435], edi
mov dword [ecx], ebx
js 0x600c95
push cs
test al, 0x2a
mov eax, 0xcb992adf
bound ebx, qword [ebp - 0x17bf3fcd]
iretd
Function at 0x600922
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006008ba
lea esp, [esp + 3]
jmp 0x6008e0
mov eax, dword [ecx + 4]
stc
call 0x6008ea
int1
push word [esp + 1]
pushal
lea esp, [esp + 2]
jmp 0x600958
cmp eax, 8
call 0x600922
into
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x600aa6
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
je 0x5bd84f
jne 0x600919
jecxz 0x6009c9
in al, dx
mov eax, dword [esi - 0x3cac10cd]
cmpsb byte [esi], byte es:[edi]
push ebp
aam 0x56
rol dword [eax + 0x2424648d], 0x85
shl byte [eax + 0x66], 0x8f
inc esp
and al, 0x13
lea esp, [esp + 0x24]
test eax, eax
pushal
pop word [esp + 0x13]
mov byte [esp + 0xf], ch
jmp 0x600939
dec edi
xchg ebx, eax
cdq
lds ebx, [ecx - 0x5e]
mov dh, cl
sub cl, ah
lodsd eax, dword [esi]
jnp 0x6009e2
dec eax
sub al, 0xf5
invalid
salc
fidiv dword [edx + 0x4800fb46]
and dword [eax - 0x73], eax
jo 0x6009e6
sti
add byte [eax + 0x21], cl
inc eax
push word [esp + 1]
jmp 0x600cb4
lodsb al, byte [esi]
and al, byte [ebp - 0x4c]
or ah, byte [ecx + edi*4]
sub dword [eax - 0x45], ecx
jnp 0x600cb9
jnp 0x600cf5
lea esp, [esp + 0x1c]
add ecx, dword [ecx + 4]
push edx
mov dword [esp], esi
pop word [esp]
jmp 0x600c8d
lea esp, [esp + 4]
jne 0x6004b1
test ebx, esi
idiv edi
dec dword [edi]
test byte [ebx + 0x5bfffbcb], cl
je 0x5bd84f
pop word [esp]
lea esp, [esp + 2]
jmp 0x600cf9
pop edx
mov ch, 0xa4
xlatb
leave
call fcn.00600d1c
and dword [edx + edx*2 + 0x2971c435], edi
mov dword [ecx], ebx
js 0x600c95
push cs
test al, 0x2a
mov eax, 0xcb992adf
bound ebx, qword [ebp - 0x17bf3fcd]
iretd

Function at 0x600a5a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ds
cmp eax, 0x46b2dad6
lea esp, [esp + 8]
je 0x600473
jne 0x6004cd
or al, 0x88
push ds
jns 0x6009e0
cmp dword [ebp + 0x74ff6654], esp
and al, 3
push esp
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x600a43

Function at 0x600aa0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
jmp 0x600cc4
call fcn.00600cca
inc ebp
rol dword [ebx + 0x26], cl
aad 0x11
fst qword [edx + ecx*8 - 0x53]
pop esp
jmp 0x5bd8ba
fiadd dword [edx + ebx*8 - 0x43]
dec esp
bnd jno 0x5bd92a
invalid
mov al, byte [0x38a8e84d]
add al, 0
jbe 0x5bd988
lds ebp, [edi + ebx*2 - 0x2108bb62]
pop es
scasb al, byte es:[edi]
mov ecx, 0xffffd8e8
call [edx]
pop eax
salc
inc esp
and ebx, esi
insb byte es:[edi], dx
retf 0xdb4b
mov edi, 0xef71f84a
jg 0x5bd9a9
jmp 0x8d995bd6
stc
fdivr dword [ebx]
adc bh, byte [ebp - 0x74]
dec edx
lea esi, [eax - 8]
push esp
shr esi, 1
pushal
call 0x6009f8
aad 0xe9
xchg edx, eax
add byte [eax], al
add byte [ebp - 0x3a], al
push esp
xor ecx, esi
or dh, ch
jnp 0x6009f1
invalid
mov si, word [esp]
inc esi
jmp 0x6009eb
pop dword [esp + 4]
push edx
lea esp, [esp + 0x20]
jb 0x5bd84f
lea esi, [eax*4]
jmp 0x600a12
popal
mov al, byte [0x64751ae3]
jb 0x5bd84f
cmc
cmp dword [ebp - 8], eax
pushal
jmp 0x600a2b
pop ebx
jmp 0x5bd867
Function at 0x600b73
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
jmp 0x600bfa
and eax, 0xfff
mov edx, dword [esp]
mov dx, 0xf29b
mov edx, dword [esp]
mov edx, dword [esp]
jmp 0x600bcc
add eax, dword [ecx]
mov dx, 0x8245
mov dh, 0x96
add eax, dword [ebp - 0xc]
jmp 0x600ba6
lea esp, [esp + 4]
jne 0x60045a
neg dx
lea edx, [ecx + edx]
jmp 0x600b7c

Function at 0x600c5d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 4]
clc
jmp 0x600c16
movzx eax, word [ecx + eax*2 + 8]
not edx
mov dh, 0xfa
add bx, 0xf8de
push dword [esp]
call fcn.00600c46
lea esp, [esp + 0xc]
jb 0x6004cd
jae 0x600473
leave
push edi
invalid

Function at 0x6017b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
neg dh
jmp 0x6017e4

Function at 0x60180a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cl, ch
jmp 0x601812
mov word [esi], dx
shr dh, 7
jno 0x60184d
sbb dx, 0xaec6
mov eax, dword [esp]
jmp 0x60186e
sbb dx, 0xaec6
jmp fcn.0060182f
lea ecx, [esi*4]
jmp fcn.005c8e3f

Function at 0x60259d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword ss:[edx], eax
mov cx, 0x3b55
lea ecx, [ecx + 0x385b626b]
jmp 0x602579
jmp 0x602560
mov cx, 0x3dc7
setae ch
jmp 0x5c81f0
add byte [eax], al
lea ecx, [eax - 9]
clc
jg 0x602577
jle 0x602560

Function at 0x602cb9
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ebx + eax*2 - 0xfba492d], ebp
xchg edx, eax
add al, 0x9a
std
or al, 0xc9
xor dword [esi + 0x4c2238ef], edx
xor cl, byte [esi - 0xaefc3b4]
cmp eax, 0xcce3bce8
push ss
insb byte es:[edi], dx
cmp dl, bh
lea edx, [edi]
insb byte es:[edi], dx
out 0x7d, eax
sbb byte [esi], 0x5d
fdivr qword [edi]
xor byte [ebx + 0x61], cl
jl 0x602ce5
leave
and ecx, dword [eax - 0x20]
sbb ebx, dword [edi]
push ds
fdiv qword [edx + 0x6062a46b]
arpl word [ecx], sp
pop ss
push ds
fsub qword [edx - 0x739c6d9d]
dec edx
sub dh, dh
cmpsb byte [esi], byte es:[edi]
jmp [ebx - 0x242c4403]

Function at 0x60325c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6033bf
pop ecx
call fcn.006033a4
mov cx, 0xdc53
mov cl, 0xd2
add dx, 0x9624
jmp 0x6035e1
jbe 0x603612
mov ch, bh
jmp fcn.00603614
mov ch, bh

Function at 0x6033a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.005c8e3f
bsr cx, cx
jno 0x60338d
jo fcn.005c8e3f
dec ebx
les ebx, [edx + 0x3d]
int3

Function at 0x603626
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dh
jmp 0x603653
mov cl, byte [esi + 2]
setnp dh
stc
jns 0x603657
js 0x603657
aas
jae 0x60362e
jb 0x60362e
call fcn.006036c0
das
mov dl, 0x20
inc edi
mov dl, 7
adc esi, dword [edi + 0x38b14227]
sub ch, byte [eax + 0x1ba8593e]
inc ebp
hlt

Function at 0x6036c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr dx, cx
jnp 0x60367f
jp 0x60367f
jmp 0x60369d