joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b4740d9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1b4740fb
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1b4740fb
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1b4740fb
ret
cmp word [ebx + 4], 0x14c
jne 0x1b4740fb
test word [ebx + 0x16], 2
je 0x1b4740fb
test word [ebx + 0x16], 0x100
je 0x1b4740fb
cmp word [ebx + 0x18], 0x10b
jne 0x1b4740fb
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1b4740fb
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1b474187
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1b47411b
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1b45b066
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1b4740fb
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1b474187
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1b4740fb
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1b4740fb
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1b4740fb
ret
cmp word [ebx + 4], 0x14c
jne 0x1b4740fb
test word [ebx + 0x16], 2
je 0x1b4740fb
test word [ebx + 0x16], 0x100
je 0x1b4740fb
cmp word [ebx + 0x18], 0x10b
jne 0x1b4740fb
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1b4740fb
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1b474187
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1b47411b
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1b45b066
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1b4740fb
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1b47423e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1b474297
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1b47423e
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1b47424d
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1b879ef0
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1b47429e
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1b45b114
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1b47433d
add edi, 4
add eax, 2
dec ecx
jne 0x1b474283
call 0x1b4742ea
loope 0x1b4742e0
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1b47433a
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1b47434b
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1b4742fe
cmp eax, ecx
ja 0x1b4742fe
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1b474388
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1b47437e
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1b45b5f3
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1b47424d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1b474297
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1b47423e
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1b47424d
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1b879ef0
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1b47429e
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1b45b114
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1b47433d
add edi, 4
add eax, 2
dec ecx
jne 0x1b474283
call 0x1b4742ea
loope 0x1b4742e0
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1b47433a
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1b47434b
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1b4742fe
cmp eax, ecx
ja 0x1b4742fe
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1b474388
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1b47437e
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1b45b5f3
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x43c0b2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub ebp, 1
jne 0x43c0b3
pop ebp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov edi, dword [eax + 0x10]
call 0x43c0cd
pop esi
lea edx, [edi + 0x1000]
lea ecx, [edx + 0x1c800]
lea ebx, [esi + 0x273]
lea ebp, [ebx + 0x20]
push edx
push ecx
push ebx
push ebp
call section.sect_4
add esp, 0x10
lea eax, [edi + 0x8430]
jmp eax
Function at 0x10001c10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x1005839c], 0x214c
mov dword [ebp - 0xc], 0
mov dword [0x1005839c], 0x1a44
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [0x1005839c], 0x15d3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
jmp 0x10001ced
mov dword [0x10058398], 0x553
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
je 0x10001d74
jmp 0x10001da0
mov dword [0x1005839c], 0x2695
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x10001d11
jmp 0x10001dab
jmp 0x10001da9
mov dword [0x1005839c], 0x178b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x10001cf8
jmp 0x10001cfa
mov eax, dword [0x10058398]
sub eax, 0xc08
mov dword [0x10058398], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
je 0x10001d52
jmp 0x10001da4
cmp dword [ebp - 0x10], 0x104
jl 0x10001caa
jmp 0x10001c84
jmp 0x10001c84
mov dword [0x10058398], 0x2527
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10001ced
mov dword [0x10058398], 0x1b7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x10001da9
mov dword [0x10058398], 0x17a7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x10001cc7
jmp 0x10001ca5
mov dword [0x10058398], 0xa9c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
je 0x10001c5f
jmp 0x10001da2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + eax*2 - 0xe]
cmp eax, 0x6c
jne 0x10001d9e
mov eax, dword [0x1005839c]
sub eax, 0x136c
mov dword [0x1005839c], eax
mov dword [ebp - 8], 1
jmp 0x10001dbc
jmp 0x10001da0
jmp 0x10001da2
jmp 0x10001da4
jmp 0x10001ca5
jmp 0x10001dab
mov dword [0x10058398], 0x21c9
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 0x10
pop ebp
ret

Function at 0x100020c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.100020c0]
mov dword [ebp - 8], eax
jmp 0x100020f9
mov al, 1
test al, 1
jne 0x100020f9
jmp 0x100020e1
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10002136
mov eax, dword [0x10058398]
add eax, 0x218a
mov dword [0x1005839c], eax
mov dword [ebp - 4], 0
jmp 0x10002136
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1000211a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x100020d9
jmp 0x1000211a
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov dword [0x1005839c], 0xe24
jmp 0x100020d1
mov eax, dword [ebp - 4]
add esp, 8
pop ebp
ret
Function at 0x1917028
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01917178
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x191704e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x191703a
add dl, dl
jne 0x1917059
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19170ac
xor eax, eax
add dl, dl
jne 0x1917066
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x191714d
add dl, dl
jne 0x1917075
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1917080
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x191708b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1917096
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x19170a2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1917045
mov eax, 1
add dl, dl
jne 0x19170ba
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19170c5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19170b1
sub eax, ebx
mov ebx, 1
jne 0x19170f8
mov ecx, 1
add dl, dl
jne 0x19170de
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19170e9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19170d5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1917045
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x191710f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x191711a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1917106
cmp eax, 0x7d00
jae 0x191713d
cmp eax, 0x500
jb 0x1917138
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1917045
cmp eax, 0x7f
ja 0x1917140
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1917045
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x191716e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1917045
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4019c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4370c0], 0x24e1
mov eax, dword [0x4370c0]
sub eax, 0x24e1
mov dword [0x4370c0], eax
mov ecx, 1
test ecx, ecx
je 0x401a6b
mov edx, dword [0x4370c0]
cmp edx, dword [ebp + 0xc]
jb 0x4019f7
jmp 0x401a6b
cmp dword [0x4370c0], 0
jne 0x401a15
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401a15
xor eax, eax
jmp 0x401a6b
mov eax, dword [ebp + 8]
add eax, dword [0x4370c0]
mov ecx, dword [eax]
add ecx, dword [0x4370c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4370c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x156
mov eax, dword [0x4370c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4370c0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4370c0]
add ecx, 4
mov dword [0x4370c0], ecx
jmp 0x4019dd
mov esp, ebp
pop ebp
ret

Function at 0x401a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401aea
cmp dword [ebp - 0x118], 0
je 0x401aea
jmp 0x401b4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b4c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4370b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4370d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4370cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401980
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401aea
mov esp, ebp
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x84126c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edi - 0xe9]
mov cx, word [esp]
xchg di, dx
xchg dword [esp], edx
jmp 0x8412b5
xchg cx, bx
inc al
mov cx, word [esp]
adc bx, 0xdcaa
neg cl
jmp 0x841404
lea edx, [edx + 0x49]
not esi
clc
call fcn.0084139b

Function at 0x8fb63d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
sub esp, 3
add esp, 4
jmp 0x8fb620

Function at 0x8fb865
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x1a], ax
pop word [esp + 0xc]
add esp, 0xa
pop word [esp + 0xb]
jmp 0x8fb84f

Function at 0x8fd4fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 6], cx
pop word [esp + 5]
xchg byte [esp + 0xa], cl
std
jmp 0x8fd512
jmp 0x8fd4e4
rcr bx, cl
lea esp, [esp + 8]
mov di, word [esp + 4]
lea esp, [esp]
jmp 0x8fd521
mov ah, ch
pop si
rdtsc
rcr bl, 7
mov ebx, eax
pop si
jmp 0x8fd4fc
push dword [esp + 1]
mov ecx, dword [esp + 5]
mov bh, ch
pop bx
mov ecx, dword [esp + 1]
push dword [esp + 3]
jmp 0x8fd562
mov dword [esp], eax
mov edi, dword [esp + 7]
mov edi, dword [esp + 8]
std
cld
jmp 0x8fd578
pop word [esp + 2]
mov bp, 0x3671
xchg al, ah
mov ebx, dword [esp + 2]
bsf si, cx
std
jmp 0x8fd54c
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
pushal
mov bx, word [esp + 0x24]
mov di, dx
shr bx, cl
rdtsc
jmp 0x8fd5b3
inc bp
rcr bh, cl
neg eax
sub ebp, 0x537d391a
setnp bl
jmp 0x8fd648
xchg al, dh
lea esi, [edx*4]
xchg byte [esp + 5], dh
jmp 0x8fd629
mov bh, 0x27
mov bl, 0xd2
push word [esp + 3]
setae al
mov bl, byte [esp + 2]
mov bh, byte [esp + 0xc]
jmp 0x8fd5e2
mov esi, dword [esp + 1]
sub esi, 0xe30ab2cf
xchg ebp, esi
shl cl, cl
xchg byte [esp + 8], ch
std
jmp 0x8fd5f8
mov byte [esp + 7], al
lea edx, [ecx*4]
shl bl, 3
add ebx, ebp
add esp, 0xc
ror edi, cl
jmp 0x8fd66f
bsr bp, si
push ecx
ror cl, cl
popal
push dword [esp + 3]
xchg bp, di
jmp 0x8fd614
btr bp, bp
bswap esi
bsf edx, edx
lea ebx, [ebx + edi]
jmp 0x8fd684
mov cl, bh
push word [esp + 6]
neg ebx
mov ax, 0xc631
not ebp
mov bp, 0x4ce2
jmp 0x8fd659
mov cx, word [esp + 5]
mov si, word [esp + 5]
mov dword [esp + 5], edi
shr bh, 5
and ah, 0x6a
call fcn.008fdd23
xchg byte [ecx], dh
xor byte [ebx], dh
Function at 0x8fdd6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub bl, 0x80
rcr edi, cl
mov al, bl
lea esi, [esi + ebp]
mov word [esp + 0xc], cx
jmp 0x8fdda2
std
lea esi, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov eax, dword [esp + 1]
xchg esi, edi
pop ebx
jmp 0x8fdd56
neg ax
not cx
pop dx
pop bp
rdtsc
lea ebx, [ebx*4]
jmp 0x8fdd8c

Function at 0x8ff0b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, esi
mov dword [esp + 0x15], eax
push word [esp + 0x10]
mov byte [esp + 0x19], ah
jmp 0x8ff09e
mov bp, word [esp + 0x13]
inc cl
xchg cl, bl
rdtsc
neg bx
rdtsc
jmp 0x8ff076
rdtsc
mov edi, dword [esp + 0xb]
push dword [esp + 6]
mov bp, 0x2cb7
bsf di, dx
jmp 0x8ff0c6
push di
lea esp, [esp + 8]
mov ebx, dword [esp + 0xf]
shl ebp, cl
jmp 0x8ff08c
xchg bp, si
cpuid
mov bh, byte [esp + 0x12]
mov ah, byte [esp + 0x19]
not eax
add esp, 0xa
jmp 0x8ff101
mov byte [esp + 0x18], bh
call fcn.008ff14f

Function at 0x8ff208
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bp, ax
push word [esp + 3]
xchg ebp, ecx
jmp 0x8ff243
lea edx, [ebx*4]
not bl
xchg dh, ch
setg cl
push word [esp + 3]
pop word [esp + 1]
jmp 0x8ff22c

Function at 0x8ff452
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8ff495
cld
rol ch, cl
push word [esp + 5]
bsr bp, cx
btc bx, bp
clc
jmp 0x8ff47f
xchg edi, edx
lea esp, [esp + 6]
rdtsc
neg edx
cmp cx, sp
neg bx
jmp 0x8ff620
rdtsc
lea esi, [edx*4]
mov edx, dword [esp]
mov dword [esp], ebx
ror bl, 1
lea ecx, [eax*4]
jmp 0x8ff454
rcr si, 0xb
lea eax, [ebx + esi]
xchg ebp, ebx
ror bx, cl
add esp, 0
sub esp, 0x10
jmp 0x8ff4c9
xchg bp, cx
btr ecx, ebx
mov dx, 0x8c62
bsf si, si
neg ch
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x8ff4df
bswap esi
mov ebx, 0x328e4c4e
pop bp
cpuid
mov eax, esi
rdtsc
jmp 0x8ff533
lea eax, reloc.IPHLPAPI.DLL_GetInterfaceInfo
lea esp, [esp]
not cx
lea esi, [eax + edx]
xchg al, ah
xchg dl, dh
jmp 0x8ff5a8

Function at 0x8ff652
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec cl
inc dh
mov bh, 0x92
lea ebx, [esp + ecx]
dec bp
sbb bp, 0x88e6
jmp 0x8ff699
neg ebx
push di
mov dx, bx
jmp 0x8ff638
xchg cx, ax
neg bx
rdtsc
mov byte [esp + 0x1c], dh
pop dword [esp + 0x12]
jmp 0x8ff6ee
mov dl, byte [esp + 2]
push word [esp + 0x16]
mov si, bp
lea edi, reloc.IPHLPAPI.DLL_GetInterfaceInfo
push word [esp + 0x21]
inc edi
jmp 0x8ff65b
pop cx
rdtsc
add esp, 4
cpuid
neg bh
push esi
jmp 0x8ff671
rcl edx, cl
sete cl
lea ecx, [ebp*4]
adc dh, 0x79
xchg dx, si
bswap ebp
call fcn.008ff6a7
mov edi, 0x72ad2b88
lea eax, [ecx + edx]
add esp, 0x14
push dword [esp + 0xd]
sub esp, 0xd
cpuid
jmp 0x8ff6bd

Function at 0x8ff79e
Capabilities:
Execute anti-debugging instructions

Disassembly:
setnp bl
xchg byte [esp + 3], al
mov bl, al
mov ecx, edx
shl cx, cl
jmp 0x8ff7bc
Function at 0x8ffae1
Capabilities:
Check for peb beingdebugged flag
Execute anti-debugging instructions

Disassembly:
call fcn.008ff056
lea esp, [esp + 2]
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
mov eax, dword fs:[0x30]
jmp 0x8ffaf9
jmp 0x8ffabf
mov eax, dword [eax + 8]
jmp 0x8ffb03
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x8ffae3
push eax
jmp 0x8ff051