joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548a40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf2000]
push edi
jmp 0x548a5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x548a61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x548a50
mov eax, 1
add ebx, ebx
jne 0x548a73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x548a84
jne 0x548aa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x548aa3
dec eax
add ebx, ebx
jne 0x548a90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x548a68
add ebx, ebx
jne 0x548a9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x548af5
xor ecx, ecx
sub eax, 3
jb 0x548abb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x548b2a
sar eax, 1
mov ebp, eax
jmp 0x548ac6
add ebx, ebx
jne 0x548ac6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x548a94
inc ecx
add ebx, ebx
jne 0x548ad4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x548a94
add ebx, ebx
jne 0x548ae1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x548ad6
jne 0x548af2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x548ad6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x548b14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x548b06
jmp 0x548a56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x548b14
add edi, ecx
jmp 0x548a56
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x548b32
cmp byte [edi], 0x11
jne 0x548b32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x548b37
lea edi, [esi + 0x141000]
mov eax, dword [edi]
or eax, eax
je 0x548baf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b86e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b8860]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x548b64
mov ecx, edi
jns 0x548b93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b8864]
or eax, eax
je 0x548ba9
mov dword [ebx], eax
add ebx, 4
jmp 0x548b81
call dword [esi + 0x1b8874]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x548be0
cmp al, 0xef
ja 0x548bd3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x548bb5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x548bc2
mov ebp, dword [esi + 0x1b8868]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x548c14
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x458ba4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x503584]
cmp dword [eax + 0x30], 0
je 0x458c4e
cmp dword [ebx + 0x94], 0
jne 0x458c48
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458b34
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458c48
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x458c0e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458c48
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418e60
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458c1d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x459968
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45999d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404914
jmp 0x4599aa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404878
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45ad0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45ad7a
mov eax, esi
call fcn.0044559c
test al, al
je 0x45ad7a
mov eax, dword [ebx + 0x84]
call fcn.00445240
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45ad7a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45ad6e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445240
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043d5b0
jmp 0x45ad7a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045ab48
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x55d758bf
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6f661de6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x363a7973
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x21940df2
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x10c85491
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1f0657e1
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xdd4518b
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3026cea
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4eef30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x3eb000
lea edi, [esi - 0x9a000]
push edi
jmp 0x4eef4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4eef51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eef40
mov eax, 1
add ebx, ebx
jne 0x4eef63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4eef74
jne 0x4eef93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eef93
dec eax
add ebx, ebx
jne 0x4eef80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4eef58
add ebx, ebx
jne 0x4eef8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4eefe5
xor ecx, ecx
sub eax, 3
jb 0x4eefab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ef01a
sar eax, 1
mov ebp, eax
jmp 0x4eefb6
add ebx, ebx
jne 0x4eefb6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eef84
inc ecx
add ebx, ebx
jne 0x4eefc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eef84
add ebx, ebx
jne 0x4eefd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4eefc6
jne 0x4eefe2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4eefc6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ef004
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4eeff6
jmp 0x4eef46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ef004
add edi, ecx
jmp 0x4eef46
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ef022
cmp byte [edi], 0x11
jne 0x4ef022
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ef027
lea edi, [esi + 0xe7000]
mov eax, dword [edi]
or eax, eax
je 0x4ef09f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x105420]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10559c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ef054
mov ecx, edi
jns 0x4ef083
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1055a0]
or eax, eax
je 0x4ef099
mov dword [ebx], eax
add ebx, 4
jmp 0x4ef071
call dword [esi + 0x1055b0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ef0d0
cmp al, 0xef
ja 0x4ef0c3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ef0a5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ef0b2
mov ebp, dword [esi + 0x1055a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ef104
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1f6234d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp]
call fcn.01f6236c
cmp dh, byte [edi + 0x7cb14227]
sub al, byte [ebp - 0xc]
out 0x89, eax
insb byte es:[edi], dx
and al, 0x34

Function at 0x1f6236c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf1f508b0
jmp 0x1f623de
push word [esp]
jbe 0x1f623a1
mov dword [esp + 0x38], esi
pushal
mov word [esp + 0x17], sp
jmp 0x1f623b9
mov dword [esp + 0x38], esi
pushal
mov word [esp + 0x17], sp
jmp 0x1f623a3
jmp 0x1f6238b
push dword [esp + 0x1e]
push bx
mov byte [esp], ah
mov word [esp + 0x10], di
jmp 0x1f623f4
push dword [esp + 0x1e]
push bx
jmp 0x1f623a9
mov eax, dword [esp]
jmp 0x1f6241c
lea esp, [esp + 2]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
pushfd
jmp 0x1f61488
inc esi
jmp 0x1f62479
add cl, 0xb7
jp 0x1f62406
inc esi
jmp 0x1f62479
lea esi, [esp]
mov eax, dword [esp]
rol edx, 5
jmp 0x1f6244d
stc
sub esp, 0xc0
jmp 0x1f62452
jmp 0x1f62424
jnp 0x1f62433
stc
jmp 0x1f62434
mov ebp, esp
sub esp, 0xb
jmp 0x1f6248d
rdtsc
inc bx
lea esp, [esp + 3]
mov edi, dword [esp + 0x2c]
mov cx, dx
lea ebx, [edx*4]
dec dx
jb 0x1f6244b
jae 0x1f62424
jle 0x1f6245d
rdtsc
inc bx
jmp 0x1f62499
lea esp, [esp + 3]
call fcn.01f62527

Function at 0x1f626a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
rdtsc
jmp 0x1f626ad
add edi, dword [esi]
rol eax, 0x17
jg 0x1f62717
mov edx, 0xa7c6c740
mov cx, sp
call fcn.01f631e7
mov word [edx + eax*4], cs
in eax, 0x14
rcr dword [ecx], 1
js 0x1f62725
mov dl, 0xad
mov esp, 0x424648d
mov cx, sp
jmp 0x1f626de
mov edx, 0xa7c6c740
jmp 0x1f626f4
shr eax, cl
xchg dword [esp], edx
mov eax, esi
bswap eax
call fcn.01f62760
xchg ebp, eax
Function at 0x1f62949
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xcf3809d8
jmp 0x1f62c75
setbe ah
mov dword [esp], edi
jmp 0x1f62955
shl ax, 2
jp 0x1f629b3
mov ax, 0xfdcc
pop ax
lea esp, [esp + 2]
jmp 0x1f6298c
lea esp, [esp + 2]
ror dl, 0
jmp 0x1f62a46
mov eax, esp
ror ah, cl
sete al
sub esp, 0x17
lea esp, [esp + 5]
btr ax, cx
lea esp, [esp + 2]
jmp 0x1f62a6e
mov ax, 0xfdcc
pop ax
jmp 0x1f62988
sete al
sub esp, 0x17
lea esp, [esp + 5]
call fcn.01f629bb
push 0x32b8c80f
mov ch, byte [ecx]
xor eax, 0x2c245c87
rol al, cl
btr eax, esi
btc ax, cx
jmp 0x1f62a29
btc eax, edx
shl eax, 0x1c
push dword [esp + 0x2c]
ret 0x30
jge 0x1f62995
mov eax, esp
ror ah, cl
jmp 0x1f629e2
not dh
bswap edx
mov ax, di
mov ah, bl
call fcn.01f62a9d
div byte [esi - 0x1c]
cmp dword [esi - 0x45], 0xffffffe4
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fimul dword [esi]
cdq
sub bl, dl
jbe 0x1f62a52
not dh
jmp 0x1f62a90
inc edi
mov edx, 0x856ac339
xchg dx, ax
jmp 0x1f62b5c
bswap edx
mov ax, di
mov ah, bl
jmp 0x1f62a76
dec cl
dec ah
jmp 0x1f62b2c
add al, 0x6a
bswap eax
rdtsc
mov dh, 0xf3
mov ah, byte [esp]
jmp 0x1f62b34
ror ax, cl
jmp 0x1f62aef
rdtsc
mov dh, 0xf3
mov ah, byte [esp]
jmp 0x1f62b34
jae 0x1f62af9
add al, 0x6a
bswap eax
jmp 0x1f62b16
not cl
sub esp, 0x16
jmp 0x1f62b95
lea edx, [edx*4]
lea esp, [esp + 2]
jmp 0x1f62b6c
mov eax, 0x7cb7e6c
ror dx, 8
jne 0x1f62b11
ror ax, cl
jmp 0x1f62b14
ror cl, 0
rdtsc
setg al
mov edx, dword [esp]
bswap edx
jmp 0x1f62b7f
mov edx, dword [esp]
btc ax, cx
je 0x1f62ba4
ror edx, 0xf
jmp 0x1f62bb0
ja 0x1f62b3f
lea edx, [edx*4]
lea esp, [esp + 2]
jmp 0x1f62b6c
ror edx, 0xf
setnp dh
jmp 0x1f62d8b
setnp dh
not dl
jmp 0x1f62d8d
dec dl
jmp 0x1f62c05
dec cl
mov ax, word [esp]
rdtsc
neg ah
jo 0x1f62be1
jno 0x1f62c42
pushal
rol di, 0xa
jbe 0x1f62c2c
setbe dl
mov dword [esp + 0x14], ecx
bswap eax
popal
seto ah
jmp 0x1f62c61
bswap edx
mov edx, dword [esp]
neg dx
jmp 0x1f62d51
setbe dl
jmp 0x1f62c8c
dec dl
jmp 0x1f62c05
setl ah
jmp 0x1f62c95
seto ah
bswap eax
cmc
jnp 0x1f62c46
jp 0x1f62c70
mov ah, byte [ebx]
mov bl, 0xd6
and eax, 0xf11e694
pushfd
invalid
setl ah
jmp 0x1f62c95
neg eax
jp 0x1f62ce7
mov eax, dword [esp]
mov eax, edx
jmp 0x1f62ccc
mov dword [esp + 0x14], ecx
bswap eax
popal
jmp 0x1f62c5e
shl edx, 2
lea eax, [edx*4]
bswap eax
jmp 0x1f61504
jo 0x1f62d45
setne dl
clc
jmp 0x1f62c1f
mov eax, dword [esp]
mov eax, edx
mov edx, dword [edx + reloc.KERNEL32.dll_TerminateProcess]
call 0x1f62ce9
clc
popal
int1
nop
arpl sp, dx
cmp ah, byte [edx + 0x66a25730]
arpl word [edx - 0x21141b0b], bx
sub esp, 0xd
lea eax, [edx + esi]
neg ah
mov eax, esi
lea eax, [esp - 0x52]
jmp 0x1f62cfd
jmp 0x1f62cc7
lea esp, [esp + 1]
xchg dword [esp + 0xc], edx
bsr eax, edx
mov eax, 0x57427a6a
jmp 0x1f62d2a
lea eax, [edx*4]
lea eax, [edx*4]
lea edx, [edx + 0x3d]
xchg al, ah
not eax
jmp 0x1f62d6c
setne dl
clc
bswap edx
mov edx, dword [esp]
neg dx
jmp 0x1f62bf7
push dword [esp + 0xc]
ret 0x10
rol eax, 3
lea eax, [eax + ecx]
xchg dword [esp + 0xc], edx
bts ax, di
mov eax, dword [esp]
mov al, bh
jmp 0x1f62d56
not dl
lea esp, [esp + 0x14]
not cl
sbb eax, 0x77fe0481
jmp 0x1f62cb8
Function at 0x1f6477d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], dl
call 0x1f64787
jno 0x1f647e8
xchg dword [esp + 0x20], ebx
pushfd
mov dword [esp], esp
lea ebx, [ebx - 0x1f]
call fcn.01f6489d
jo 0x1f64810
jmp 0x1f6340c
ret
rdtsc
rcl si, cl
jmp 0x1f6481b
cpuid
jmp 0x1f64860
lea eax, [edi*4]
jmp 0x1f6494e
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp]
neg dh
jbe 0x1f6484a
ja 0x1f64875
lea ecx, [eax]
sahf
stc
or ah, cl
and eax, 0xbd048d54
add byte [eax], al
add byte [eax], al
lea eax, [edi*4]
jmp 0x1f6494e

Function at 0x1f64787
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], dl
call 0x1f64787
jno 0x1f647e8
xchg dword [esp + 0x20], ebx
pushfd
mov dword [esp], esp
lea ebx, [ebx - 0x1f]
call fcn.01f6489d
jo 0x1f64810
jmp 0x1f6340c
ret
rdtsc
rcl si, cl
jmp 0x1f6481b
cpuid
jmp 0x1f64860
lea eax, [edi*4]
jmp 0x1f6494e
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp]
neg dh
jbe 0x1f6484a
ja 0x1f64875
lea ecx, [eax]
sahf
stc
or ah, cl
and eax, 0xbd048d54
add byte [eax], al
add byte [eax], al
lea eax, [edi*4]
jmp 0x1f6494e

Function at 0x1f6e837
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1f53be3
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1f53bfd
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1f53bec
pop esi
jmp 0x1f53c08
ret 4
jmp 0x1f53bd6

Function at 0x1f6ebbc
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, dword [esp + 0x10]
lea ebx, [edx*4]
call fcn.01f6eb9a

Function at 0x1fce7b9
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1fce7f7
xchg ah, al
call 0x1fce821
cmpsb byte [esi], byte es:[edi]
sub bh, byte [eax - 0x3b63d521]
dec edi
fistp qword [edx - 0x629d6eb7]
in al, dx
lea esp, [esp + 0x14]
je 0x1f566aa
cmp edi, ebx
jbe 0x1f566aa
ja 0x1fce7e1
out dx, eax
adc dword [ebx], 0x76
test dword [edx - 0x29], eax
inc esp
fidivr dword [ebp - 0xe9c77b4]
popal
add bl, dh
xor al, 0x70
jae 0x1fce80b
invalid
scasb al, byte es:[edi]
call fcn.01fce890
call dword [eax + 0x94]
mov ax, si
mov eax, dword [0x1f5f294]
mov cl, 0xcd
jmp 0x1fce872
add dl, 0xb8
mov ecx, dword [eax]
xchg dh, dl
imul ecx, ecx, 0xc
jmp 0x1fce85c

Function at 0x202a99a
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0202a10d
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x202a108
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x202a87e
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0x202a8ac