joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44525c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x18]
mov eax, esi
call fcn.00436824
add eax, dword [esi + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x1c], eax
mov cx, 1
mov edx, 0x40
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
cmp word [eax], 0x5a4d
jne 0x44534c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [eax + 0x3c]
xor ecx, ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x1c]
cmp eax, dword [edx + 0x3c]
jne 0x44534c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea edx, [eax + 0xc]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
cmp eax, 4
jne 0x44534c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0xc], 0x4550
jne 0x44534c
mov eax, esi
call fcn.00436824
add eax, dword [esi + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x10], eax
mov cx, 1
mov edx, 0x14
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
cmp word [eax], 0x14c
jne 0x44534c
mov eax, esi
call fcn.00436824
add eax, dword [esi + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x14], eax
mov cx, 1
mov edx, 0xe0
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x445f4c
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
int 0x2e
pop ebp
ret 8

Function at 0x445f81
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x445fbc
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x445ff8
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x446034
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x14
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x446070
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4460ac
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x1c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4460e8
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x45862c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x458632
ret

Function at 0x4629a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x462b65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x462b41
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x462b41
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x462974]
call fcn.00408978
add esp, 4
lea eax, [ebp - 4]
call fcn.00409db0
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x551b14]
push eax
call fcn.00456c10
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004087b0
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.004048f4
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x458138]
call fcn.0045f570
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x462b1f
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.00461154
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.0045fe90
call fcn.0045b3a8
push eax
call fcn.0040bec4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.004601e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462b41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462b6c
lea eax, [ebp - 8]
mov edx, dword [0x462974]
call fcn.00408984
lea eax, [ebp - 4]
call fcn.00409db0
ret
Function at 0x4c65c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
dec eax
test eax, eax
jl 0x4c65dd
inc eax
xor edx, edx
mov ecx, dword [ebx + 4]
add ecx, edx
xor byte [ecx], 0x5b
inc edx
dec eax
jne 0x4c65d1
pop ebx
ret
Function at 0x4d1a58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
add eax, 0x1c
xor ecx, ecx
mov edx, 0xf8
call fcn.004048f4
mov eax, dword [ebp + 8]
lea edx, [eax - 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x4d1b48
mov eax, dword [ebp + 8]
cmp word [eax - 0x40], 0x5a4d
jne 0x4d1b48
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 4]
jne 0x4d1b48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
lea edx, [eax + 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x4d1b48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
cmp dword [eax + 0x1c], 0x4550
jne 0x4d1b48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
lea edx, [eax + 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x4d1b48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
cmp word [eax + 0x20], 0x14c
jne 0x4d1b48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
movzx ecx, word [eax + 0x30]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
lea edx, [eax + 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x48]
movzx edx, word [edx + 0x30]
cmp eax, edx
jne 0x4d1b48
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4d21c8
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
movzx eax, word [eax + 0x22]
dec eax
test eax, eax
jl 0x4d2293
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x4d222d
test eax, 0x40000000
je 0x4d2219
test eax, 0x80000000
je 0x4d2214
or edx, 0x40
jmp 0x4d2254
or edx, 0x20
jmp 0x4d2254
test eax, 0x80000000
je 0x4d2228
or edx, 0x80
jmp 0x4d2254
or edx, 0x10
jmp 0x4d2254
test eax, 0x40000000
je 0x4d2245
test eax, 0x80000000
je 0x4d2240
or edx, 4
jmp 0x4d2254
or edx, 2
jmp 0x4d2254
test eax, 0x80000000
je 0x4d2251
or edx, 8
jmp 0x4d2254
or edx, 1
test eax, 0x4000000
je 0x4d2261
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xffffffbc
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*8]
push eax
call fcn.00447b6c
inc ebx
dec dword [ebp - 4]
jne 0x4d21e7
mov al, 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d50c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov esi, eax
test esi, esi
je 0x4d50dd
test edi, edi
je 0x4d50dd
test ebp, ebp
jne 0x4d50e6
mov byte [esp], 0
jmp 0x4d51df
mov byte [esp + 1], 0
cmp byte [esp + 1], 0
jne 0x4d510c
movzx eax, word [ebp]
cmp ax, word [edi]
jne 0x4d510c
cmp word [ebp], 0
je 0x4d510c
add edi, 2
mov byte [esp + 1], 1
jmp 0x4d50eb
cmp word [edi], 0
jne 0x4d511f
cmp word [esi], 0
sete byte [esp]
jmp 0x4d51df
cmp byte [esp + 1], 0
je 0x4d512a
mov bl, 1
jmp 0x4d515d
mov eax, 0x4d51ec
mov dword [esp + 4], eax
movzx eax, word [edi]
cmp ax, 0x100
jae 0x4d514b
movzx eax, word [edi]
mov edx, dword [esp + 4]
movzx eax, al
bt dword [edx], eax
jb 0x4d514f
xor eax, eax
jmp 0x4d5151
mov al, 1
mov byte [esp + 8], al
movzx ebx, byte [esp + 8]
xor bl, 1
test bl, bl
je 0x4d517f
movzx eax, word [esi]
cmp ax, word [edi]
je 0x4d516f
mov byte [esp], 0
jmp 0x4d51df
add esi, 2
add edi, 2
mov byte [esp + 1], 0
jmp 0x4d50eb
movzx eax, word [edi]
sub ax, 0x2a
je 0x4d5193
sub ax, 0x15
je 0x4d51c8
jmp 0x4d50eb
cmp word [edi + 2], 0
jne 0x4d51a0
mov byte [esp], 1
jmp 0x4d51df
add edi, 2
jmp 0x4d51bd
mov ecx, ebp
mov edx, edi
mov eax, esi
call fcn.004d50c4
test al, al
je 0x4d51ba
mov byte [esp], 1
jmp 0x4d51df
add esi, 2
cmp word [esi], 0
jne 0x4d51a5
jmp 0x4d50eb
cmp word [esi], 0
jne 0x4d51d4
mov byte [esp], 0
jmp 0x4d51df
add esi, 2
add edi, 2
jmp 0x4d50eb
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d8050
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004048f4
ret
Function at 0x4fcac8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x4fcae4
add esp, 0xfffffff0
call fcn.00405420
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x4fcbbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x42a060]
call fcn.004367c4
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [0x551c9c]
mov eax, dword [eax]
call eax
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebx]
mov ecx, 0
call fcn.004064ac
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0xc]
call fcn.00406ffc
mov eax, dword [esi + 4]
cmp dword [eax + 0x58], 0
je 0x4fcba1
xor ebx, ebx
push 2
push ebx
push 0x4fcbe8
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [0x551b90]
mov eax, dword [eax]
call eax
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4fcba1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 6
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4fcbf8
call fcn.0041298c
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4fcb4a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcbc6
lea eax, [ebp - 0x10]
call fcn.00406dc0
lea eax, [ebp - 0xc]
call fcn.004061c8
ret
Function at 0x58c910
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ax, cl
bsf ax, di
mov eax, dword [esi + 0x28]
test cx, bp
test ch, ah
cmp cl, 0xca
cmp edi, eax
push ebp
pushal
pushfd
lea esp, [esp + 0x28]
jae 0x71f56f
dec dl
dec dx
not dl
not dh
dec eax
rol edx, cl
cmc
neg dx
bts edx, esi
mov edx, edi
clc
test bl, dl
pushal
cmp edi, eax
pushfd
lea esp, [esp + 0x24]
jae 0x71f558
setge al
pushal
test al, 0xbd
bsr ax, di
lea ecx, [edi + edi*2]
stc
aad 0x82
cwde
movsx di, dl
add ecx, ecx
test si, dx
bswap ax
add ecx, ecx
neg ax
push eax
mov eax, dword [esi + 0x20]
add di, cx
movzx edi, dl
cmc
clc
mov edi, dword [eax + ecx + 0xc]
mov byte [esp + 8], 0x78
add eax, ecx
push edx
jmp 0x58fb30
mov word [esp + 4], bx
mov word [esp], si
mov dword [eax], edi
bswap di
mov edi, dword [eax + 0x10]
call fcn.00586ff2

Function at 0x5ef23b
Capabilities:
Encode data using xor

Disassembly:
inc edi
sti
aaa
in al, 0x37
or dword [0xf1070be1], esi
pop esp
sbb eax, 0x58862a45
pushfd
pushfd
pushfd
pushfd
call fcn.00743655
jle 0x5ef272
arpl word [eax], si
bound eax, qword [ebx - 0x29]
ror dword [esi], 0x7c
push esp
mov ecx, 0xf135dcc9
sahf
pop ds
xor al, 0xaa
daa
lodsd eax, dword [esi]
push ds
push 0x3e
dec ebp
push ebp
xchg byte [edx*8 + 0x73203daf], ah
dec edx
cmp bl, byte [ebx + eax*8 + 0x7c]
test eax, 0x2c3fb26d
ror dword [ebx - 0x6c0416a6], cl
pop edx
jmp 0x4c868673
sti
xchg ebx, eax
daa
dec esp
mov ecx, 0x501f3f4c
jbe 0x5ef229
xchg esi, eax
mov byte [esi + 0x4e513d31], bl
xor dword cs:[edx - 0x16d1fae9], esp
push esi
ficom word [ecx]
stosd dword es:[edi], eax
shr byte [ebp + 0x47], 0xe7
inc edi
aad 0x82
xchg edi, eax
lahf
salc
scasd eax, dword es:[edi]
pop ecx
and dl, byte [0x82618967]
jb 0x5ef274
dec esi
invalid

Function at 0x5fe464
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb5f4b6bb
push esp
adc edx, dword [esp + 0x14]
pushfd
stc
add esp, 0x1c
call fcn.0080863a
call fcn.0067f1fe
not si
pushfd
nop
mov word [esp], 0x8b04
mov esi, dword [esp + 4]
pushfd
xchg dword [esp + 0xc], esi
mov byte [esp + 8], dh
mov byte [esp], al
pushfd
mov dword [esp + 0xc], esi
pushfd
jmp 0x6a86e3
pop esi
mov esi, 0x52d3de
mov word [esp + 8], sp
push ebx
mov esi, dword [esi + 0x1516b7]
call fcn.006ba7dc

Function at 0x5fe47d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb5f4b6bb
push esp
adc edx, dword [esp + 0x14]
pushfd
stc
add esp, 0x1c
call fcn.0080863a
call fcn.0067f1fe
not si
pushfd
nop
mov word [esp], 0x8b04
mov esi, dword [esp + 4]
pushfd
xchg dword [esp + 0xc], esi
mov byte [esp + 8], dh
mov byte [esp], al
pushfd
mov dword [esp + 0xc], esi
pushfd
jmp 0x6a86e3
pop esi
mov esi, 0x52d3de
mov word [esp + 8], sp
push ebx
mov esi, dword [esi + 0x1516b7]
call fcn.006ba7dc
Function at 0x624cba
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp], edi
jmp 0x6685a0
sbb dword [esp + 0x24], edx
push esp
jmp 0x65af2b
mov edx, dword [esp + 0x4c]
pushfd
pushal
push edx
call fcn.007e815e
lea esp, [esp + 0x24]
call fcn.00436824
js 0x81c8fb
push edx
shr dh, 1
sal dl, 4
push eax
aaa
movzx ax, dl
xor ah, al
mov eax, esi
jmp 0x79e45b
call fcn.007457c1
bswap dx
mov eax, dword [esp + 0x24]
bswap dx
mov edx, dword [esp + 0x28]
jmp 0x65a8af
adc edx, dword [esp + 8]
clc
pushfd
jmp 0x7530c5
add esp, 0x10
push edx
pushal
mov dword [esp + 0x20], edx
mov edx, 0x6792a7eb
lea edx, [edx*4 - 0x3d47908c]
mov dword [esp + 0x1c], eax
call fcn.007e5e08
cdq
pushfd
cmc
pushfd
add eax, dword [esp + 8]
push ebx
pushfd
pushal
adc edx, dword [esp + 0x34]
stc
add esp, 0x38
jmp 0x7e5fe4
push edx
bswap edx
not edx
push eax
xchg dx, ax
push 0
rdtsc
not dl
push 0xa00000
xchg dh, ah
rdtsc
mov eax, dword [esp + 0x28]
pushal
lea edx, [ecx*2 + 0x6b53bf74]
jmp 0x5df6c6
cmc
clc
push edx
sar dl, cl
add dh, ah
push eax
shl ah, cl
mov eax, esi
dec dl
cdq
push 0xb951627d
add eax, dword [esp + 4]
lea esp, [esp + 4]
je 0x584f20
pushfd
mov byte [esp], 0x9f
adc edx, dword [esp + 8]
clc
pushfd
add esp, 0x10
pushal
pushfd
mov byte [esp + 0xc], 6
xchg dword [esp + 0x20], edx
setbe dh
xchg dword [esp + 0x1c], eax
bswap eax
mov dword [esp + 0x18], 0
setne ah
mov dword [esp + 0x14], 0xa00000
pushal
mov eax, dword [esp + 0x5c]
setae dh
push 0x53f37438
pop edx
push dword [esp]
mov edx, dword [esp + 0x64]
pushfd
mov byte [esp], dl
lea esp, [esp + 0x3c]
call fcn.00408228
cmp eax, esp
sub dword [esp], eax
pushal
inc eax
inc al
jmp 0x588eb8

Function at 0x63cff5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], al
pushfd
jmp 0x5f8dd0

Function at 0x649fd5
Capabilities:
Encode data using add xor sub operations

Disassembly:
bswap edi
lea edi, [edi + 0x785a6275]
mov edi, 0x53d1da
call fcn.005ea804
mov bh, byte [edx]
dec edi
push esi
pushal
pop esi
mov esi, 0x34e6af23
out dx, eax
cmc
sub byte [ebp + 0x6c], 0x5f
invalid
Function at 0x689516
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [0x8f9ae900]
adc byte [eax], al
mov byte [esp + 0xc], 0xa4
movsb byte es:[edi], byte [esi]
mov edx, dword [edx + 0x273251]
call fcn.0058c0f0
loope 0x6894cc
or al, ch
xchg ebx, eax
movsd dword es:[edi], dword [esi]
test byte [edi + 0x78], bl
or al, al
pushal
popfd
push ecx
popfd
xor al, 0x52
inc esp
wait
push ds
mov esi, 0x96f9a3ef
or ebx, ebp
xchg esi, eax
push edi
push ds
mov ebx, 0x2868fef8
xchg ebp, eax
sbb al, 0x98
loop 0x68951a
lahf
or byte [edi], 0xd9
stosb byte es:[edi], al
mov cl, 0x88
xchg esi, eax
lea eax, [ebx]
lea esi, [ebx]
xor bp, word ss:[edi + 0x46d4166f]
inc ebx
salc
or byte [ebx - 0x455ab1ee], ch
push ecx
popfd
call 0x2646261
fisub dword [edi + 0xb]
dec ebp
mov byte [0x1bd0e63b], al
fsub dword [esi + 0x47]
jo 0x68956e
adc eax, 0x1a17baa1
xchg edx, eax
jae 0x6895f9
mov dl, ch
xor byte [edx - 0x35], dh
inc ecx
sar dword [eax - 0x6b75778d], 1
xor al, 0x25
insb byte es:[edi], dx
sub dword [edi], edi
push esp
and eax, 0x196ed7b8
fadd dword [edx + 0x3f]
das
outsb dx, byte [esi]
aad 0x42
push cs
jmp 0x68956e
or eax, 0x45a429f6
add ah, bl
call 0x60f0365c
je 0x6895f0
test dword [eax + 0x17746087], esp
aam 0xaa
sti
or esp, eax
xchg byte [ecx + 0x76a67e94], bh
mov bh, 0x62
dec ebp
pop ss
cwde
push ds
cmp dword [ebx], edi
outsb dx, byte [esi]
lodsb al, byte [esi]
cmp dword [ebx - 0x4f], ebp
cdq
mov cl, 0xf3
cdq
salc
inc eax
rcl byte [esp + ebp*8], cl
pop es
clc
jp 0x6895d3
dec esi
sub byte [ecx - 0x4d1e7fda], cl
pop esp
pop edx
jb 0x689616
rcr cl, 1
lea esi, [esi + 0x753e882a]
dec esi
invalid
jo 0x68964a
out dx, al
dec eax
out dx, eax
inc eax
fcomp qword [esi]
pop esp
adc esp, dword [ecx - 0xed8f11c]
jne 0x6895cb
clc
invalid
add esi, ebx
fild dword [ecx]
mov eax, 0xde51c303
fidiv word [esi]
jecxz 0x6895f5
invalid

Function at 0x690756
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x46046d
mov word [esp], bp
mov dword [esp + 8], 0xb287c8d
sub byte [ebx], cl
mov ebp, dword [ebp + 0x29daeb]
pushfd
push dword [esp]
lea ebp, [ebp + 0x73f4ec16]
pushfd
push dword [esp]
call fcn.00832d48
xchg ecx, eax
cmp al, 0x98
xor edx, dword [ebp + 0x41]
jge 0x690765
xlatb
mov esp, 0x1c52e7e2
cmpsd dword [esi], dword es:[edi]
inc ebx
scasd eax, dword es:[edi]
mov cl, 0xe1
mov ebx, 0x5640473a
cmp ebp, dword [ebp - 0x7c]
hlt

Function at 0x6acc78
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x5c
mov byte [esp + 4], 0
lea eax, [eax + 0x6cefdd5a]
call fcn.006fdf7c

Function at 0x6e045e
Capabilities:
Access peb ldr_data

Disassembly:
not ax
lahf
mov dword [ebp - 0x148], 0x148
pushfd
mov dword [esp], 0
movsx ax, cl
mov ah, ah
lea eax, [ebp - 0x148]
pushfd
mov dword [esp], eax
push 0x75b3da6d
pushfd
pushal
push dword [esp + 0x10]
mov dword [esp + 0x28], 0
pushfd
jmp 0x5d324d
mov dword [esp + 0x28], 0
call fcn.005ce99a
mov dword [esp + 0xc], ebp
pushal
pushfd
push 0xde55cb2
mov dword [esp + 0x30], 0x7b8775
mov byte [esp + 0xc], dh
push dword fs:[eax]
pop dword [esp + 0x2c]
push 0x40e77dce
mov word [esp], 0x8503
pushfd
lea esp, [esp + 0x34]
mov dword fs:[eax], esp
cwde
jmp 0x58bff0
Function at 0x6e4050
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x14]
jne 0x78d468
or dx, cx
bsf dx, si
movzx dx, cl
rol dx, 2
cmp eax, dword [esp]
bswap dx
pop edx
pushal
pop eax
bswap ax
mov eax, dword [esp + 0x1c]
call fcn.005ccf99
dec edi
invalid

Function at 0x6f63d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x43
pushfd
push dword [esp + 4]
lea esp, [esp + 0x2c]
jae 0x71f56f
pushal
pop edx
movsx edx, dl
dec eax
clc
shr dx, cl
mov edx, edi
sub esp, 0xffffffe4
jb 0x812668
pushfd
cmp edi, eax
pushfd
lea esp, [esp + 8]
jae 0x71f558
ror al, 3
clc
sar cl, cl
push 0x7bb701e8
lea ecx, [edi + edi*2]
movzx di, cl
add ecx, ecx
add al, 0x24
add di, sp
push ebx
clc
add ecx, ecx
add esp, 8
pop ecx
xchg byte [edx + 0x41], bh
sub dh, byte [edi + 0x9102216]
push es
or ch, bh
outsb dx, byte [esi]
and eax, 0xa66cf683
scasb al, byte es:[edi]
call 0x6e7936ae
salc
imul eax, dword [edx - 0x154edc8a], 0x7a
fmul qword [ebp - 0x31]
int3
mov eax, 0xa2782870
js 0x81256b
xor ebp, esi
and al, 0x57
test esi, edi
mov dword [edi], ebx
cli
xchg dword [ecx], ebp
mov es, word [esi + 0xf]
cwde
xchg esp, eax
lahf
sub bl, byte [esi]
aad 0x51
inc edx
sub eax, 0xc6c3f5ff
or al, 0x63
or edx, ecx
hlt
cmp ebx, edi
push edx
sal byte [esi - 0x60], 0x8d
sub edx, dword [ebp + 0x7ba17e81]
js 0x8125c4
pop ecx
mov bl, 0x70
popfd
jo 0x8125c7
xchg ecx, eax
and ah, bh
sub ebp, dword [eax]
mov dl, byte [eax + ebx*8 - 0x9dc35a1]
sub al, 0xe4
cmp ebp, dword [edx]
insb byte es:[edi], dx
pushal
mov bh, 0xbd
pop ebp
salc
loopne 0x812628
ljmp 0x8543:0xdc3fdcd5
call fcn.00730361
out 0xe0, eax
test al, 0xee
mov dword [0x570f28f6], eax
loop 0x812617
test byte [edi - 0x11], 0xe6
int1
loope 0x812663
cmpsb byte [esi], byte es:[edi]
dec dword [ebp + 0x15dfda06]
arpl word [edi], sp
sbb dword [eax + 0x5e], 0x258e497f
imul edx, dword [edx - 0x80], 0x4b
sub esi, dword [esi + edi*2]
int1
inc eax
salc
ror dword [edi - 0x5c], cl
xor esi, eax
xchg esi, eax
cmc
jecxz 0x8126a4
sbb al, 0xa9
xchg edi, eax
popfd
cmc
inc edx
push ds
cld
and eax, 0xcba68022
push eax
popal
hlt