joyce8/EMBER2024-capa huggingface dataset:
Function at 0x614d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x614d63
mov eax, dword [esi]
jmp 0x614d65
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x614d8d
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00614c40
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x614da4
mov dword [edi], 0
call fcn.00618d60
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x614ddb
push esi
call fcn.006147b0
add esp, 4
test al, al
je 0x614dd0
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x614e60
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x614e6c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x614eaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x614eaa
cmp eax, 3
je 0x614eaa
cmp eax, 0x7b
je 0x614eaa
cmp eax, 0xf
je 0x614eaa
cmp eax, 0x15
je 0x614eaa
cmp eax, 0x57
je 0x614eaa
cmp eax, 0xa1
je 0x614eaa
cmp eax, 0x35
je 0x614eaa
xor al, al
ret
mov al, 1
ret

Function at 0x614eb0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x614ebc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x614efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x614efa
cmp eax, 3
je 0x614efa
cmp eax, 0x7b
je 0x614efa
cmp eax, 0xf
je 0x614efa
cmp eax, 0x15
je 0x614efa
cmp eax, 0x57
je 0x614efa
cmp eax, 0xa1
je 0x614efa
cmp eax, 0x35
je 0x614efa
xor al, al
ret
mov al, 1
ret
Function at 0x615640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68a372
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x615681
mov eax, dword [edi]
jmp 0x615683
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x6156a2
push esi
push edi
push ebx
call fcn.00614c40
add esp, 0xc
jmp 0x61579e
test eax, 0x400
je 0x61575d
cmp dword [edi + 0x14], 8
jb 0x6156b7
mov eax, dword [edi]
jmp 0x6156b9
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.0047f9b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00451500
cmp esi, 0xffffffff
jne 0x615712
push dword [ebp - 0x34]
push edi
push ebx
call fcn.00614c40
add esp, 0xc
jmp 0x61579e
push edi
call fcn.006147b0
add esp, 4
test al, al
jne 0x615745
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00614890
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x61579e
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x61576f
mov dword [esi], 0
call fcn.00618d60
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x615786
mov dword [ebp - 0x30], 2
call fcn.00614890
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116c3
mov esp, ebp
pop ebp
ret
Function at 0x615c50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68a430
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x79cac4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0x6fbaa0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.0044fec0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
call fcn.005fe8f3
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.0044ff80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x61aef0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68ae61
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x79cac4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push edi
call fcn.0061d9c0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x24]
mov dword [edi + 0x18], 0
mov ecx, esi
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0061b390
mov dword [esi], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov eax, edi
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x620040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68b49e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x79cac4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x79cb08]
cmp eax, 0xffffffff
jne 0x620076
xor ebx, ebx
jmp 0x62007f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x620187
cmp dword [ebx + 0x18], 0
jne 0x6200a1
cmp dword [ebx + 0xc], 0
je 0x62017d
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x620126
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x6200f4
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x6200f4
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.0046c420
add esp, 0x10
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x6200a1
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.0046c420
add esp, 0x10
jmp 0x6200a1
cmp dword [ebx + 0x18], 0
je 0x620097
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
cmp dword [esi + 0x14], 0
je 0x62016e
cmp dword [esi + 0x1c], 0
je 0x62016e
cmp dword [esi + 0x14], 0
jne 0x620163
push 0x2bf
push str.._boost_smart_ptr_shared_ptr.hpp
push str.struct_boost::detail::tss_cleanup_function___thiscall_boost::shared_ptr_struct_boost::detail::tss_cleanup_function_::operator__void__const
push str.px___0
call fcn.0046c420
add esp, 0x10
mov ecx, dword [esi + 0x14]
push dword [esi + 0x1c]
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.0061f170
jmp 0x620126
push 0
call fcn.006201f0
add esp, 4
mov dword [ebp - 4], 1
test ebx, ebx
je 0x6201d1
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x6201d1
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x6201d1
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.0046c420
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6201f0
Capabilities:
Set thread local storage value

Disassembly:
push 0x61eea0
push 0x7a98a8
call fcn.0061e9f0
mov eax, dword [0x79cb08]
add esp, 8
cmp eax, 0xffffffff
je 0x620235
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x62024e
push 0x6e
push str.libs_thread_srcwin32_thread.cpp
push str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
push str.TlsSetValue_current_thread_tls_key__new_data_
call fcn.0046c420
add esp, 0x10
ret
push 0x72
push str.libs_thread_srcwin32_thread.cpp
push str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
push 0x6fc080
call fcn.0046c420
add esp, 0x10
ret

Function at 0x623250
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub ecx, edx
push ebx
inc ecx
xor ebx, ebx
push esi
shr ecx, 1
xor esi, esi
push edi
xor edi, edi
cmp edx, dword [esp + 0x14]
cmova ecx, ebx
test ecx, ecx
je 0x623299
movzx eax, word [edx]
lea edx, [edx + 2]
imul eax, eax, 0xcc9e2d51
inc edi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp edi, ecx
jne 0x623271
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x634f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x79cac4]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x6fbaa2
mov dword [esp + 4], str.___.___
mov dword [esp + 8], 0x7015b4
mov dword [esp + 0xc], 0x7015b8
mov dword [esp + 0x10], 0x7015bc
mov dword [esp + 0x14], 0x7015c0
mov dword [esp + 0x18], 0x6fba9c
mov dword [esp + 0x1c], 0x7015c4
mov dword [esp + 0x20], 0x6fcb18
mov dword [esp + 0x24], 0x7015c8
mov dword [esp + 0x28], 0x7015cc
mov dword [esp + 0x2c], 0x7015d0
mov dword [esp + 0x30], 0x7015d4
mov dword [esp + 0x34], 0x7015d8
mov dword [esp + 0x38], 0x7015dc
mov dword [esp + 0x3c], 0x7015e0
mov dword [esp + 0x40], 0x7015e4
mov dword [esp + 0x44], 0x7015e8
mov dword [esp + 0x48], 0x7011c8
mov dword [esp + 0x4c], 0x7011cc
mov dword [esp + 0x50], 0x7015f4
mov dword [esp + 0x54], 0x7015f8
mov dword [esp + 0x58], 0x6fbaa2
mov dword [esp + 0x5c], 0x6fbaa2
mov dword [esp + 0x60], 0x7015fc
mov dword [esp + 0x64], 0x701600
mov dword [esp + 0x68], str._n_:_
mov dword [esp + 0x6c], 0x701608
mov dword [esp + 0x70], 0x7011d0
mov dword [esp + 0x74], 0x7011d4
mov dword [esp + 0x78], 0x7011d8
mov dword [esp + 0x7c], 0x7011dc
mov dword [esp + 0x80], 0x7011e0
mov dword [esp + 0x84], 0x7011e4
mov dword [esp + 0x88], 0x7011e8
mov dword [esp + 0x8c], 0x7011ec
mov dword [esp + 0x90], 0x70160c
mov dword [esp + 0x94], 0x701610
mov dword [esp + 0x98], 0x7011f0
mov dword [esp + 0x9c], 0x6fbaa2
mov dword [esp + 0xa0], 0x6fbaa2
mov dword [esp + 0xa4], 0x6fbaa2
mov dword [esp + 0xa8], 0x6fbaa2
mov dword [esp + 0xac], 0x6fbaa2
mov dword [esp + 0xb0], 0x6fbaa2
mov dword [esp + 0xb4], 0x6fbaa2
mov dword [esp + 0xb8], 0x6fbaa2
mov dword [esp + 0xbc], 0x7011f4
mov dword [esp + 0xc0], 0x7011f8
mov dword [esp + 0xc4], 0x7011fc
mov dword [esp + 0xc8], 0x6fbaa0
mov dword [esp + 0xcc], 0x701200
mov dword [esp + 0xd0], 0x701204
mov dword [esp + 0xd4], 0x701614
mov dword [esp + 0xd8], 0x701208
mov dword [esp + 0xdc], 0x70120c
mov dword [esp + 0xe0], 0x701210
mov dword [esp + 0xe4], 0x701618
mov dword [esp + 0xe8], 0x701214
mov dword [esp + 0xec], 0x701218
cmp cl, 0x3c
jb 0x635176
mov eax, 0x6fbaa2
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.006116c3
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.006116c3
add esp, 0xf4
ret
Function at 0x6351a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x79cac4]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x63530b
add eax, 4
cmp word [eax], cx
jb 0x635303
sub eax, 2
cmp cx, word [eax]
jb 0x635330
cmp cx, word [eax + 2]
ja 0x635330
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.006116c3
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.006116c3
add esp, 0x9c
ret

Function at 0x63812b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x66f7c1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0066f640

Function at 0x67546b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00674dd9

Function at 0x675476
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00675014
Function at 0x1503cee
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1503d29
lea esp, [esp + 0x14]
add esi, 0x3ea4a739
stc
jmp 0x1503d50
mov edx, 0xc5c596d
mov ebx, ebp
rdtsc
jmp 0x1503d13

Function at 0x1505ce6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
js 0x1505eef
jns 0x1505d3c
ror dword [edx + eax*8 - 0x5b], 1
push esp
out 0x59, al
mov eax, 0x5c88f29b
and al, 3
pop dword [esp + 9]
lea esp, [esp + 0xc]
jmp 0x1505f00
mov dword [esp + 0x34], esp
pushal
mov dword [esp + 0x15], ecx
jmp 0x1505d26
mov dword [esp + 0x34], esp
pushal
mov dword [esp + 0x15], ecx
pop dword [esp + 9]
lea esp, [esp + 0xc]
push word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x40], ebp
call fcn.01505e85
mov eax, 0xee4f18cd
neg cx
mov ecx, edi
jmp 0x1505f22
inc esi
call fcn.0150624b
push ebp
jecxz 0x1505f9e
push ss
in eax, 0x52
lodsd eax, dword [esi]
and al, 0xba
invalid
jo 0x1505f61
not eax
setle ch
jmp 0x1505f87
not eax
setle ch
rdtsc
dec ecx
cmc
call fcn.01505fd7
push ss
lcall 0xff74, 0x299a6f08
outsd dx, dword [esi]
or bh, cl
mov ch, 0x52
pop dx
lea esp, [esp + 2]
jmp 0x1506076
rdtsc
dec ecx
cmc
jmp 0x1505f91
ror esi, 0
mov edx, dword [esp]
ror cx, 0xf
jp 0x1506020
add byte [eax], al
add byte [edi], cl
mov ebp, dword [ebx - reloc.MSVFW32.dll_DrawDibDraw]
and dword [ecx - reloc.MSVFW32.dll_DrawDibDraw], esi
and ebx, dword [edx - 0x4b]
jnp 0x1506052
mov cl, 0x21
mov cl, 0xd0
and edx, dword [esi - reloc.MSVFW32.dll_DrawDibDraw]
movsb byte es:[edi], byte [esi]
xlatb
js 0x150606a
xchg byte [esp], ah
cmp ch, 0x1a
jmp 0x1505f7c
mov ecx, dword [esp]
jmp 0x150603c
add esi, dword [edi]
bt cx, si
jne 0x150607d
mov eax, dword [esp]
jmp 0x1506086
mov ecx, dword [esp]
jmp 0x150603c
xchg byte [esp], ah
cmp ch, 0x1a
pop dx
lea esp, [esp + 2]
dec esi
cmc
jmp 0x1505f4b
mov eax, dword [esp]
jmp 0x1506086
Function at 0x1505e85
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf14f4f3c
jmp 0x1505d67
bswap ecx
sub al, dl
jmp 0x1505d81
sub esp, 8
jmp 0x1505d6b
mov cl, 0xda
jmp 0x1505d47
mov esi, dword [esp + 0x34]
bswap ebp
mov ecx, 0xaae47b0f
setle dh
mov ebp, edi
jmp 0x1505daf
jns 0x1505d51
sub esp, 8
jmp 0x1505d6b
lea esp, [esp + 2]
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
pushfd
jmp 0x1505a54
lea edi, [esp + 8]
xchg edx, ecx
stc
jmp 0x1505ddc
mov cx, 0x6a88
jmp 0x1505de9
push esi
mov dword [esp], ecx
pop word [esp]
jmp 0x1505d9d
jbe 0x1505dbc
mov cx, 0x6a88
jmp 0x1505de9
sub esp, 0xb8
mov ebp, esp
cpuid
bswap ecx
jmp 0x1505e12
lea esp, [esp + 2]
mov dword [esp + 0x40], esi
jmp 0x1505dd2
mov cl, ch
cmc
jmp 0x1505e6d
mov ebx, esi
dec cl
jmp 0x1505e57
lea eax, [eax + ebp]
mov dh, 0xfc
mov edx, 0x9842febe
mov ax, word [esp]
dec cx
jmp 0x1505e87
push word [esp + 1]
jge 0x1505e08
lea esp, [esp + 2]
mov dword [esp + 0x40], esi
push esi
mov dword [esp], ecx
pop word [esp]
jmp 0x1505d9d
jne 0x1505e25
lea eax, [eax + ebp]
mov dh, 0xfc
jmp 0x1505e9d
jg 0x1505e1b
jle 0x1505e1b
add edx, 0xa3b2b782
jmp 0x150b94d
jmp 0x1505e3b
xchg cx, dx
jmp 0x1505ec0
mov edx, 0x9842febe
mov ax, word [esp]
dec cx
jmp 0x1505e87
jmp 0x1505ed5
not esi
bswap eax
xchg cl, dl
bsf ecx, edi
jo 0x1505eaa
jno 0x1505f12
cmp eax, 0xb8492eb8
or byte [0x18cdb884], dl
dec edi
out dx, al
mov eax, 0xee4f18cd
neg cx
mov ecx, edi
jmp 0x1505f22
ror bx, 0
jmp 0x150b9ed
pushal
mov bx, 0x7a17
jmp 0x150b9c1
xchg dword [esp], ebx
jmp 0x150b9cb
xchg dword [esp], ebx
pop word [esp]
lea esp, [esp + 2]
jmp 0x150b9d3
mov esp, esi
push edi
shr bx, cl
jp 0x150b99b
jnp 0x150b9a4
pop word [esp]
lea esp, [esp + 2]
push edx
ret
jg 0x150b96f
pushal
mov bx, 0x7a17
jmp 0x150b9c1

Function at 0x150608b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], esi
mov ax, dx
mov eax, dword [esp]
jmp 0x15060c8
lea esp, [esp + 4]
popal
jmp 0x15060ed
and eax, edx
je 0x15060b2
lea esp, [esp + 4]
popal
movzx ecx, byte [edx]
sub esp, 0x17
push word [esp + 5]
jmp 0x1506114
movzx ecx, byte [edx]
sub esp, 0x17
push word [esp + 5]
jmp 0x1506114
xchg dx, ax
jmp 0x1506151
mov dl, byte [esp + 0x18]
lea esp, [esp + 1]
sub esp, 4
jl 0x15060fa
xchg dx, ax
mov ax, bp
mov byte [esp], dh
mov al, cl
cmc
jmp 0x150613c
mov ax, bp
mov byte [esp], dh
mov al, cl
jmp 0x150613b

Function at 0x15060a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, bx
neg edx
jmp 0x1505fb3

Function at 0x150624b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
neg esi
mov ecx, 0xdde0351b
call fcn.015060a8
bswap ecx
lea esp, [esp + 1]
mov cx, word [esp]
mov eax, dword [esp]
jmp 0x1506168

Function at 0x150644e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
sub cl, 0xe1
mov dx, di
jmp 0x1506481
mov dh, 0xcc
rol dh, cl
jne 0x150646b
sete dh
call fcn.015064e4
mov al, byte fs:[esp]
jmp 0x1506523
Function at 0x15072df
Capabilities:
Execute anti-debugging instructions

Disassembly:
push sp
mov word [esp + 3], bp
mov dword [esp + 0x10], ebx
push dx
push bx
jmp 0x150731c
mov dword [esp + 0x10], esp
pushfd
push word [esp]
jo 0x1507306
mov byte [esp + 3], bh
lea esp, [esp + 2]
mov dword [esp + 0x10], ebp
pushfd
call fcn.01507822
cmp al, 0xcf
test byte [edi - 0x706780b8], 0x48
inc esp
and edx, dword [ebx - reloc.MSVFW32.dll_DrawDibDraw]
dec eax
frstor dword [edi - 0x6d]
dec eax
shl byte [0xd0c94890], cl
nop
dec eax
test ch, bh
nop
dec eax
dec eax
sub byte [ecx - 0x6b0d39b8], dl
dec eax
pop es
les edx, [ebx - 0x6b3b36b8]
dec eax
xor dword [ebx - 0x6d], 0x8f0ec548
dec eax
add edx, dword [eax + edx*4 - reloc.MSVFW32.dll_DrawDibDraw]
dec eax
jae 0x15073b3
invalid
mov word [eax - 0x70271db8], ss
dec eax
add dh, 0x8f
dec eax
pushfd
pop esi
invalid
Function at 0x15f3ff6
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ax
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
setnp bh
rdtsc
cld
jmp 0x15f3ffa
mov ebx, esi
jmp 0x15f3fe0
mov ch, 0xb5
mov ebx, dword [esp + 2]
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
shl ch, cl
mov dh, bh
push dword [esp + 2]
jmp 0x15f4064
popal
mov dl, 4
mov edx, esi
neg edx
xchg ebp, ecx
neg al
jmp 0x15f402b
rdtsc
xchg ebx, esi
mov ebx, ebp
pop edi
mov dword [esp], esi
pushal
jmp 0x15f4041

Function at 0x15f42f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x20]
rdtsc
pop bp
bswap ebp
rdtsc
rdtsc
jmp 0x15f42fc
clc
mov eax, ecx
jmp 0x15f42e1
popal
mov edi, 0x92a4ff71
stc
not cx
push word [esp + 3]
jmp 0x15f4327

Function at 0x15f4675
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror ch, cl
push word [esp + 0x11]
bsf ebp, ebx
bswap eax
sub ecx, 0xd44db4f1
xchg al, dl
jmp 0x15f41d0
xchg byte [esp + 0x15], bh
and eax, ebp
setb ah
cld
neg ch
cmp bl, bh
jmp 0x15f41e6
cpuid
sub esp, 3
jmp 0x15f4275

Function at 0x15f4a30
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts di, cx
cld
lea edi, [esp + eax]
mov bx, word [esp + 4]
mov dl, byte [esp + 2]
lea ebx, [ebp*4]
jmp 0x15f4a50
cpuid
xchg bx, cx
stc
rdtsc
jmp 0x15f4a04
cpuid
mov ecx, edi
push dword [esp + 5]
neg dl
mov dl, byte [esp + 5]
pop dx
jmp 0x15f4d0e
mov word [esp + 2], di
setl al
mov dh, al
lea esp, [esp]
cpuid
push word [esp + 4]
jmp 0x15f4a3a
add esp, 5
cld
lea edi, [edx*4]
lea ecx, [edi*4]
mov word [esp], bx
mov dword [esp], eax
jmp 0x15f4a83
bt bx, di
xchg dword [esp + 8], edx
std
xchg dword [esp + 0xd], eax
mov bh, byte [esp + 0x10]
lea esp, [esp + 9]
jmp 0x15f4a99
add esp, 0x15
not ebp
push ebp
mov edx, esp
push dword [esp + 0xa]
dec di
jmp 0x15f4bda
mov eax, ebp
std
sub esp, 0x17
mov ecx, eax
inc cl
btc si, sp
jmp 0x15f4c69

Function at 0x15f4daa
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
not di
xchg byte [esp + 8], dh
jmp 0x15f4dcc