joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb7b0f9
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [ecx + 0xc]
push esi
push edi
mov eax, edx
movzx edi, byte [esp + 0xc]
mov esi, 0xff
and eax, esi
xor eax, edi
shr edx, 8
mov eax, dword [eax*4 + reloc.MSVCRT.dll_strncpy]
xor eax, edx
mov edx, dword [ecx + 0x14]
mov dword [ecx + 0xc], eax
and eax, esi
add eax, dword [ecx + 0x10]
mov edi, edx
and edi, esi
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 0x10], eax
shr eax, 0x18
xor eax, edi
pop edi
shr edx, 8
mov eax, dword [eax*4 + reloc.MSVCRT.dll_strncpy]
pop esi
xor eax, edx
mov dword [ecx + 0x14], eax
ret 4

Function at 0xb7b349
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
movzx eax, byte [ebp + 0xc]
push esi
push 0x40
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00b8e94f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
add esp, 0xc
xor esi, esi
sub ecx, eax
lea eax, [ebp + esi - 0x40]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc esi
cmp esi, 0x14
jb 0xb7b370
lea ecx, [ebp - 0xa8]
call fcn.00b7a21f
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x40]
push 0x40
push eax
lea ecx, [ebp - 0xa8]
call fcn.00b7aa2f
push dword [ebp + 0x10]
lea ecx, [ebp - 0xa8]
call fcn.00b7aacf
pop esi
leave
ret 0xc

Function at 0xb7b8cf
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test edx, edx
jbe 0xb7b91a
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
xor ecx, ecx
mov cl, byte [esi]
and ebx, 0xff
xor ebx, ecx
mov ecx, 8
call fcn.00b8e61f
mov ecx, dword [ebx*8 + reloc.MSVCRT.dll_strncpy]
xor ecx, eax
mov ebx, dword [ebx*8 + reloc.MSVCRT.dll_strncpy]
mov eax, ecx
xor ebx, edx
inc esi
dec edi
mov edx, ebx
jne 0xb7b8e2
pop edi
pop ebx
pop esi
ret 8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
ret 8

Function at 0xb80acf
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
push esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x20], edi
call fcn.00b80b1f
xor edx, edx
add esi, 0x70
mov eax, edx
mov ecx, 8
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec ecx
jne 0xb80af2
mov dword [esi], eax
inc edx
add esi, 4
cmp edx, 0x100
jb 0xb80aeb
pop edi
pop esi
ret 4

Function at 0xb8676f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, 1
shl edx, cl
mov ecx, dword [esp + 0xc]
xor eax, eax
or ecx, edx
cmp ecx, 1
je 0xb867bb
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x10]
mov edx, ecx
and ecx, 1
shr edx, 1
xor ebx, ebx
mov bx, word [edi + edx*2]
neg ecx
sar ecx, 4
shr ebx, 4
and ecx, 0x7f
xor ebx, ecx
mov ecx, dword [esi + ebx*4]
add eax, ecx
mov ecx, edx
cmp ecx, 1
jne 0xb86792
pop edi
pop esi
pop ebx
ret 0x10
Function at 0xb8680f
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov edx, 1
test edi, edi
je 0xb86859
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov ecx, esi
xor ebx, ebx
and ecx, 1
mov bx, word [ebp + edx*2]
mov ebp, ecx
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
add edx, edx
xor ebx, ebp
mov ebp, dword [esp + 0x20]
shr esi, 1
add eax, dword [ebp + ebx*4]
or edx, ecx
dec edi
jne 0xb86826
pop esi
pop ebp
pop ebx
pop edi
ret 0x10

Function at 0xb875ff
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, 0x100
or esi, edi
mov eax, esi
mov ecx, edi
shr eax, 7
and eax, 1
mov edx, esi
shl ebx, 1
push eax
and ecx, ebx
mov eax, edi
shr edx, 8
add eax, ecx
add edx, eax
lea ecx, [ebp + edx*2]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.00b8754f
shl esi, 1
mov eax, esi
xor eax, ebx
not eax
and edi, eax
cmp esi, 0x10000
jb 0xb87616
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0xb88b6f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
or ch, 1
mov edi, ecx
xor ebx, ebx
shr edi, 8
mov bx, word [esi + edi*2]
mov edi, ecx
shr edi, 7
and edi, 1
neg edi
sar edi, 4
shr ebx, 4
and edi, 0x7f
xor ebx, edi
shl ecx, 1
mov edi, dword [edx + ebx*4]
add eax, edi
cmp ecx, 0x10000
jb 0xb88b83
pop edi
pop esi
pop ebx
ret 0xc

Function at 0xb88bbf
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edx, 0x100
or ch, 1
shl esi, 1
mov edi, edx
mov ebx, ecx
and edi, esi
mov ebp, edx
shr ebx, 8
add ebp, edi
xor edi, edi
add ebx, ebp
mov ebp, dword [esp + 0x14]
mov di, word [ebp + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [esp + 0x20]
shl ecx, 1
mov ebp, dword [ebx + edi*4]
mov edi, ecx
xor edi, esi
add eax, ebp
not edi
and edx, edi
cmp ecx, 0x10000
jb 0xb88bd5
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0xb8d49f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x50]
mov ecx, eax
imul ecx, dword [esp + 0xc]
add edx, ecx
mov dword [esi + 0x50], edx
mov edx, dword [esi + 0x4c]
sub edx, ecx
imul eax, dword [esp + 0x10]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0xb8d4eb
cmp ecx, 0x8000
jae 0xb8d515
neg eax
and eax, 0x7fff
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x54]
push eax
call dword [eax]
mov ecx, dword [esi + 0x4c]
and eax, 0xff
shl ecx, 8
or eax, ecx
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x50]
shl ecx, 8
shl eax, 8
mov dword [esi + 0x48], ecx
mov dword [esi + 0x50], eax
jmp 0xb8d4c6
pop esi
ret 0xc

Function at 0xb8d95f
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x20], ecx
mov dword [eax], reloc.MSVCRT.dll_strncpy
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
ret 4

Function at 0xb8de6f
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.00b8e63e
mov ecx, dword [esp + 0x1c]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.00b8dddf
ret 0xc
Function at 0x19d69e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
mov edi, ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
mov eax, dword [edi + reloc.MSVCRT.dll_strncpy]
mov dword [esp + 0x68], eax
call fcn.019d5d34
push 1
push 0xffffffffffffffff
or edx, reloc.MSVCRT.dll_strncpy
mov ecx, edi
call fcn.019b3444
mov eax, dword [edi + 0x44]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x3f8
push edi
call eax
mov esi, dword [edi + reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov dword [esp + 0x3c], ebx
test esi, esi
je 0x19d6ae7
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x19d6ae7
mov eax, dword [esi]
cmp eax, 1
jge 0x19d6a5f
dec eax
mov ebx, esi
mov dword [esi], eax
mov eax, esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x14], ebx
jmp 0x19d6aa6
lea eax, [ecx + 8]
push eax
call fcn.01a7b839
mov ebx, eax
add esp, 4
mov dword [esp + 0x3c], ebx
mov edx, eax
mov dword [esp + 0x14], ebx
mov dword [ebx], reloc.MSVCRT.dll_strncpy
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
test ecx, ecx
jle 0x19d6a9c
push ecx
lea eax, [esi + 8]
push eax
lea eax, [ebx + 8]
push eax
call fcn.01a7eb04
add esp, 0xc
mov edx, ebx
mov eax, ebx
mov esi, ebx
mov ebx, dword [esp + 0x3c]
test edx, edx
je 0x19d6ae7
cmp dword [eax + 4], 8
jne 0x19d6ae7
cmp dword [esi + 0xc], reloc.MSVCRT.dll_strncpy
jne 0x19d6ae7
test ebx, ebx
je 0x19d6ad2
cmp dword [ebx + 4], 8
jne 0x19d6ad2
cmp dword [ebx + 0xc], reloc.MSVCRT.dll_strncpy
jne 0x19d6ad2
mov edx, dword [ebx + 8]
call fcn.01953d74
jmp 0x19d6ad4
xor eax, eax
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.01953944
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x3c], ebx
test ebx, ebx
je 0x19d83b9
cmp dword [ebx + 4], 8
jle 0x19d839e
mov eax, dword [ebx + 8]
cmp eax, 0x3b9ac9ff
je 0x19d6b0e
cmp eax, 0x5f5e100
jne 0x19d839e
push 0x20
call fcn.01a7b7fb
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [esp + 0x34], esi
push 0
movups xmmword [esi], xmm0
push ebx
movups xmmword [esi + 0x10], xmm0
push esi
mov dword [esi], 0xc
call fcn.01a56fe4
test eax, eax
je 0x19d8398
mov edx, dword [esi + 0x10]
test edx, edx
je 0x19d8398
mov esi, dword [esi + 8]
test esi, esi
je 0x19d8425
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
cmp eax, dword [edi + 0x24]
jne 0x19d8425
mov ecx, edx
cmp esi, 4
jle 0x19d7884
mov eax, dword [edx + 0x10]
test eax, eax
je 0x19d7884
cmp dword [eax + 0x10], 0
je 0x19d7884
mov eax, dword [eax + 8]
test eax, eax
je 0x19d7884
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
push edi
call fcn.019b9724
mov ecx, dword [esp + 0x34]
xor esi, esi
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x10]
cmp dword [eax + 8], esi
jle 0x19d7884
nop dword [eax]
mov esi, dword [esp + 0x34]
jmp 0x19d8398
Function at 0x19eba24
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1017056c
push ecx
movss dword [ebp - 4], xmm2
call fcn.01a89e06
mov esi, eax
add esp, 8
test esi, esi
je 0x19ebad3
push 2
push 0
push esi
call fcn.01a8a1d8
add esp, 0xc
push esi
call fcn.01a89d3a
add esp, 4
mov ebx, eax
push 0
push 0
push esi
call fcn.01a8a1d8
add esp, 0xc
lea ecx, [ebx + 1]
push ecx
call fcn.01a8b917
mov edi, eax
add esp, 4
test edi, edi
je 0x19ebabd
push esi
push ebx
push 1
push edi
call fcn.01a8b867
add esp, 0x10
cmp eax, ebx
jne 0x19ebabd
push esi
mov byte [ebx + edi], 0
call fcn.01a89e93
movss xmm2, dword [ebp - 4]
add esp, 4
mov ecx, edi
call fcn.019eb714
push edi
mov esi, eax
call fcn.01a8b696
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.01a89e93
add esp, 4
test edi, edi
je 0x19ebad3
push edi
call fcn.01a8b696
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x19ff554
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
jne 0x19ff573
xorps xmm0, xmm0
movups xmmword [edi], xmm0
push edx
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
mov edx, ecx
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x68], 0x67452301
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.019feb34
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x70]
call fcn.019febf4
xorps xmm0, xmm0
xor esi, esi
movups xmmword [edi], xmm0
movups xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x10170598
push edi
call fcn.019feaf4
inc esi
add esp, 0xc
add edi, 4
cmp esi, 0x10
jl 0x19ff5d4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01a7b7e8
mov esp, ebp
pop ebp
ret 8
Function at 0x1a0a6e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x138
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor eax, esp
mov dword [esp + reloc.MSVCRT.dll_strncpy], eax
push esi
push edi
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0xd4], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0xc4], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x9c], eax
mov eax, dword [ebp + 0x64]
mov esi, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x68]
mov edi, dword [ebp + 0x78]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x18], esi
mov dword [esp + 0x90], edx
mov dword [esp + 0x98], eax
test edi, edi
jne 0x1a0a7ed
mov edi, dword [reloc.MSVCRT.dll_strncpy]
test edi, edi
cmove edi, edi
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x28], eax
test al, 1
je 0x1a0a840
call fcn.01a8918f
sub eax, dword [reloc.MSVCRT.dll_strncpy]
cmp eax, 0x12c
jge 0x1a0a840
cmp edi, dword [reloc.MSVCRT.dll_strncpy]
jne 0x1a0a840
mov dword [reloc.MSVCRT.dll_strncpy], 0
call fcn.0193d964
mov ecx, dword [esp + 0x54]
call fcn.01a40af4
pop edi
pop esi
mov ecx, dword [esp + reloc.MSVCRT.dll_strncpy]
xor ecx, esp
call fcn.01a7b7e8
mov esp, ebp
pop ebp
ret 0x74
invalid
cmp byte [0x1018a6e1], 0
Function at 0x1a92bd7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01a92a56

Function at 0x1a9b024
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1a9b051
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], reloc.MSVCRT.dll_strncpy
jne 0x1a9b051
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1bd6c8d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1bd6c77
mov eax, esp
neg edx
cmc
jmp 0x1bd6ca4
mov ecx, edi
mov ebx, edx
mov edx, dword [esp]
bts ebx, ecx
jbe 0x1bd6c61
mov eax, esp
neg edx
cmc
jmp 0x1bd6cba
mov dl, byte [esp]
bswap edx
sub esp, 0x15
lea esp, [esp + 1]
jmp 0x1bd6cf3
mov dl, byte [esp]
bswap edx
jmp 0x1bd6ca9
mov ah, byte [esp]
mov eax, 0xfe6d610
jmp 0x1bd6d05
lea esp, [esp + 0x14]
neg edi
rdtsc
mov ah, bl
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x1bd6cdd
rol edi, 0
rdtsc
mov bh, byte [esp]
dec bl
jmp 0x1bd6d4b
btr ebx, esp
bsr bx, sp
mov eax, edx
mov ebx, 0x15066de5
jmp 0x1bd6d74
mov eax, edx
mov ebx, 0x15066de5
jmp 0x1bd6d74
jle 0x1bd6d15
btr ebx, esp
bsr bx, sp
jmp 0x1bd6d35
mov ebx, edx
add edi, 0x1971332c
mov eax, 0x9f938cfc
jmp 0x1bd6d89
ror edi, 0
mov ebx, dword [esp]
xchg dh, dl
lea edx, [edx*4]
btr bx, dx
jmp 0x1bd6ddc
lea ebx, [edx*4]
lea eax, [edx + edi]
lea ebx, [esi + edi]
mov bx, word [esp]
call fcn.01bd6dff
ror byte [ebp - 0x24], cl
jne 0x1bd6d56
mov ebx, edx
jmp 0x1bd6d58

Function at 0x1bde6de
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1bc4a93
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1bc4aad
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1bc4a9c
pop esi
jmp 0x1bc4ab8
ret 4
push ebp
lea esp, [esp + 4]
jmp 0x1bc4a86

Function at 0x1caf823
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], eax
lea edx, [edx - 0xf8]
pop dx
xchg byte [esp], al
jmp 0x1caf83b
jmp 0x1caf80d
cmc
mov ah, 1
mov dx, 0xd196
not edx
mov si, word [esp + 1]
rdtsc
jmp 0x1caf84f
neg dx
inc ecx
xchg word [esp + 1], di
xchg ah, al
rdtsc
mov edx, 0x56e24ea6
jmp 0x1caf825
mov dword [esp], ebx
mov word [esp + 1], si
not bh
mov dx, 0x4ff8
xchg ebp, ebx
bsr esi, ebp
jmp 0x1caf8ad
push word [esp + 3]
mov bh, 0x50
mov cl, byte [esp + 3]
push dword [esp + 5]
bswap edi
sub esp, 2
jmp 0x1caf892

Function at 0x1cb00f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov byte [esp + 6], dl
mov esi, dword [esp + 1]
pop dword [esp]
clc
pop bx
jmp 0x1cb00ad
mov bx, ax
pop ebx
cld
mov ebp, dword [esp + 1]
lea esi, [edi + 0x72]
mov si, word [esp + 6]
jmp 0x1cb0033
add esp, 1
call fcn.01cb008b
dec ecx
retf 0x3f58
xchg si, cx
setne al
mov word [esp], dx
xchg word [esp], si
rdtsc
inc eax
jmp 0x1cb0062
setae dl
push word [esp + 1]
mov dx, word [esp + 3]
cpuid
mov byte [esp + 1], bl
add esp, 2
jmp 0x1cb0078
mov dl, 0x53
cmc
jmp 0x1cb004f

Function at 0x1cb02ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, ecx
mov dl, byte [esp]
lea esp, [esp + 0x2a]
jmp 0x1cb02eb
setp ch
mov dh, byte [esp]
lea eax, [eax*4]
bswap edx
stc
lea ecx, [eax + eax]
jmp 0x1cb02d5
Function at 0x1cb0403
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xb
xchg byte [esp + 9], dh
mov word [esp + 1], bp
mov byte [esp + 0x14], bl
mov cl, byte [esp + 0x15]
jmp 0x1cb04b8
xchg dword [esp + 9], eax
mov ch, byte [esp + 6]
call fcn.01cb048c
rol dword [edx + ebx*8 - 0x43], 1
dec esp
in eax, 0x71
jo 0x1cb04c0
push di
push bx
pop edx
bts cx, cx
mov ah, byte [esp + 0xa]
mov word [esp + 2], ax
jmp 0x1cb0437
push ebp
rdtsc
rdtsc
cld
xchg si, dx
mov dword [esp + 0xb], edi
jmp 0x1cb044d
cpuid
lea esi, [ecx + ebx]
xchg bl, dh
push word [esp + 0x16]
push dword [esp + 0x16]
add esp, 0xf
lea ebx, [edx + ebx]
jmp 0x1cb0467

Function at 0x1cb04f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 5], si
xchg word [esp + 6], si
push dword [esp]
lea ebx, [eax + edx]
ror bx, cl
jmp 0x1cb0546
pop word [esp]
lea ebp, [ecx + edx]
xchg byte [esp + 8], al
pop dword [esp + 2]
btc bx, ax
mov ebp, eax
jmp 0x1cb051e
Function at 0x1cb1290
Capabilities:
Execute anti-debugging instructions

Disassembly:
setne ch
push dword [esp]
rdtsc
inc ebx
mov di, 0xf860
lea edi, [edx + ebx]
jmp 0x1cb1244
mov ebx, dword [esp]
mov esi, esp
mov word [esp + 9], bp
shl bx, 0xd
cmc
mov dh, byte [esp + 7]
jmp 0x1cb1203
sub esp, 0x15
xchg bx, ax
xchg bp, ax
std
setne cl
bt bp, cx
jmp 0x1cb1270
xchg di, ax
mov edx, edi
push dword [esp + 6]
std
push word [esp + 0x10]
lea esi, reloc.MSVCRT.dll_strncpy
jmp 0x1cb122e
add esp, 0x25
pop eax
mov bl, 0x8f
sub esp, 0x1b
pop word [esp + 1]
jmp 0x1cb12af
pop ebx
mov dword [esp + 0xa], edx
xchg word [esp + 3], bp
mov dh, 0x85
lea edx, [edx*4]
xchg ch, bl
jmp 0x1cb125a
jmp 0x1cb1219
shr di, cl
mov bp, si
mov edx, dword [esp + 5]
lea esp, [esp + 6]
inc ebp
bswap edx
jmp 0x1cb12dc
bsr edi, eax
lea edx, [esp + ebp]
not ecx
cld
mov ebp, 0xd9a97520
stc
jmp 0x1cb1292
pop dword [esp + 3]
xchg bp, dx
sub esp, 0x13
pop word [esp + 0xb]
mov ebx, dword [esp + 0xc]
jmp 0x1cb12ee
mov ch, dl
pop bx
lea ebx, [esp + ebx]
xchg dl, al
mov di, 0x2719
add esp, 8
jmp 0x1cb12c0
mov word [esp + 6], di
mov edi, dword [esp + 0xa]
mov bp, 0x358b
pop word [esp + 0x12]
cpuid
rdtsc
jmp 0x1cb133f
mov cx, word [esp + 4]
clc
mov byte [esp + 0xb], al
mov bl, byte [esp + 0xc]
bsf eax, eax
xchg byte [esp + 1], al
jmp 0x1cb1351
add esp, 9
cld
cpuid
xchg dword [esp + 6], ecx
dec al
push dword [esp + 1]
jmp 0x1cb1323
mov ebp, dword [esp]
add esp, 5
pop dword [esp + 5]
cpuid
push dword [esp + 9]
mov al, byte [esp + 0xc]
jmp 0x1cb13a8
xchg edx, edi
lea ebp, [ecx + ebp]
xchg ch, ah
add esp, 4
xchg si, cx
mov edx, 0xf7b65345
jmp 0x1cb1526
lea ebp, [esi + 0xea]
mov dword [esp + 9], edx
pushfd
push ebx
dec eax
mov bl, 2
jmp 0x1cb1386
lea ecx, [edx + ebx]
mov edx, dword [esp + 1]
pop word [esp + 2]
mov dword [esp], edx
jmp 0x1cb141e
pop si
rdtsc
add esp, 0
neg cl
neg edx
mov edx, ebp
jmp 0x1cb13b9
mov byte [esp], al
mov di, 0xd
sbb bh, ch
mov ax, 0xa45
mov bl, 0xd2
mov ecx, dword [esp + 6]
jmp 0x1cb13cf
rdtsc
mov byte [esp], bh
pushal
pop dword [esp + 0xa]
lea ecx, [edx + ebp]
jmp 0x1cb1449
pop word [esp + 1]
bswap ebx
mov dx, sp
xchg dword [esp], ecx
setg ah
bsf ecx, edi
jmp 0x1cb1408
rdtsc
bswap ecx
clc
xchg bp, bx
xchg bh, dh
neg ebp
jmp 0x1cb14aa
xchg word [esp + 0x19], bp
setge ch
lea ecx, reloc.MSVCRT.dll_strncpy
mov word [esp + 0x18], di
pop word [esp + 0x11]
mov al, dh
jmp 0x1cb1433
rcl dl, 2
xchg di, cx
rcl bl, cl
cld
rol cx, 3
xchg bp, si
jmp 0x1cb13f3
bt ax, sp
mov cx, word [esp + 0x15]
xchg byte [esp + 0xa], bh
mov al, byte [esp + 0x19]
mov edi, ebp
shl al, cl
jmp 0x1cb14f2
inc ebx
mov bl, 0x89
mov ecx, dword [esp + 0x1b]
xchg bp, bx
xchg bh, al
mov edi, dword [esp + 0x1d]
jmp 0x1cb148d
lea esp, [esp]
lea ecx, [ebx*4]
cpuid
pushfd
cld
pop cx
call fcn.01cb1505
sahf
neg bl
lea esp, [esp]
lea esp, [esp + 0x1c]
pop ax
add esp, 0
mov cx, word [esp]
jmp 0x1cb14bc
xchg dword [esp + 8], ebx
bt dx, cx
dec edi
neg al
cpuid
bts cx, bp
jmp 0x1cb14d2
xchg dword [esp + 0xd], edi
lea esi, [eax*4]
xchg dl, bl
lea esp, [esp + 0xb]
xchg al, bl
pushfd
jmp 0x1cb1478
Function at 0x1cb1921
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [ecx + edx]
mov byte [esp + 2], dl
mov edx, eax
mov bp, word [esp + 3]
jmp 0x1cb1954
mov bx, word [esp + 5]
mov di, word [esp + 8]
lea edx, reloc.MSVCRT.dll_strncpy
xchg word [esp + 5], di
jmp 0x1cb190b
mov di, bp
setbe ah
add esp, 0xa
mov di, si
bsf dx, cx
xchg byte [esp], bh
jmp 0x1cb1967
xchg dword [esp + 4], edx
push dword [esp + 2]
sub esp, 1
pop bx
cpuid
rdtsc
jmp 0x1cb1938
lea esp, [esp]
sub esp, 0x12
btr dx, bp
pop si
mov ch, byte [esp + 8]
adc edi, ebp
jmp 0x1cb1a08
mov eax, dword [esp]
dec bx
cpuid
add esp, 0
bt ebp, esi
xchg dl, dh
jmp 0x1cb19e1
setbe bh
pop word [esp + 5]
lea esp, [esp + 9]
bswap eax
mov si, bx
xchg bl, al
jmp 0x1cb19a0
xchg ecx, ebx
mov al, cl
add esp, 0
mov esi, 0x6beca0df
xchg byte [esp], dh
jmp 0x1cb1b7c
lea esp, [esp + 2]
cld
lea edi, [edi + ebp]
xchg byte [esp], dl
mov bh, ch
xchg byte [esp], al
jmp 0x1cb19cb
xchg cx, ax
pop dword [esp + 8]
xchg word [esp + 0xa], cx
xchg ecx, edx
rdtsc
cpuid
jmp 0x1cb19b6
sub esp, 0xe
lea eax, [eax + edi]
pop bx
mov ecx, edx
call fcn.01cb1a74

Function at 0x1cb1fde
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.01cb1005
pop word [esp]
pushfd
lea esp, [esp + 2]
jmp 0x1cb1f90
mov dword [esp + 0x20], edx
push esp
push dword [esp]
mov dword [esp + 3], ecx
pop dword [esp]
mov dword [esp + 0x20], ebx
jmp 0x1cb1fd0
mov dword [esp + 0x1c], esp
push esi
push dword [esp + 1]
call fcn.01cb1fba
pop word [esp + 2]
mov dword [esp], edi
jmp 0x1cb1ff9
lea esp, [esp + 2]
mov dword [esp + 0x24], esi
push edx
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x1cb20cc
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1cb1000
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1cb208b