joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447630
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4846b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0047d2d2
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00446f90
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0047d200
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00479ac1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00479ac1
push 1
push 0
push 0
mov ecx, esi
call fcn.00479a69
push 1
push 0
push 1
mov ecx, esi
call fcn.00479a69
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047d344
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4477b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4846d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0047d2d2
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00446f90
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0047d200
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x447874
cmp dword [esp + 0x40], 1
jne 0x447872
cmp ecx, eax
jge 0x447874
mov eax, ecx
cmp eax, 0xc8
jge 0x447880
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00447630
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047d344
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x448080
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x484783
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00477ee2
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0047d57a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047ea96
test eax, eax
je 0x44819c
mov ecx, dword [esp + 0x3c]
call fcn.0047d5a7
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x448160
push edi
mov ecx, esi
call fcn.0047ac08
mov ecx, esi
call fcn.00448340
cmp dword [esp + 0x38], 1
jne 0x448195
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047ad43
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x44a380
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44a3b3
push esi
call fcn.00458740
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44a3ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44a439
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44a422
mov eax, dword [esi + 8]
test eax, eax
je 0x44a3d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44a41e
cmp eax, 2
je 0x44a422
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44a3ca
cmp eax, 3
je 0x44a3fd
cmp eax, 1
jne 0x44a3ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44a3ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44a3ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044a460
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44a448
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044a460
add esp, 4
pop esi
ret

Function at 0x44ace0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x44ad01
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x44ad01
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44ad01
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x478cd7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x478d0f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00476d8e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00476d66
jmp 0x478d1b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47a3c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47a407
call fcn.0047fe81
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47a407
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47a3fe
xor eax, eax
jmp 0x47a40f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047a415
pop edi
pop esi
pop ebx
ret 4
Function at 0x4803b1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4803df
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4803fd
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00480317
jmp 0x4803fd
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4803fd
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00480317
test edi, edi
mov eax, edi
jne 0x4803e7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x9a4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9a41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9a407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a406a
add dl, dl
jne 0x9a4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a40dc
xor eax, eax
add dl, dl
jne 0x9a4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a417d
add dl, dl
jne 0x9a40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9a40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9a4075
mov eax, 1
add dl, dl
jne 0x9a40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a40e1
sub eax, ebx
mov ebx, 1
jne 0x9a4128
mov ecx, 1
add dl, dl
jne 0x9a410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9a4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9a413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9a414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a4136
cmp eax, 0x7d00
jae 0x9a416d
cmp eax, 0x500
jb 0x9a4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a4075
cmp eax, 0x7f
ja 0x9a4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9a419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9a4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401680
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x40f288]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call fcn.00402ce7
add esp, 0x10
cmp dword [0x40fe08], 0
je 0x4016de
lea eax, [ebp - 0x204]
push eax
call fcn.00402210
add eax, 0x40
push eax
call fcn.00402a9a
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402551
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402551
mov esp, ebp
pop ebp
ret

Function at 0x401700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x40f288]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x404]
push 0x200
push edx
call fcn.00402534
add esp, 0x10
cmp dword [0x40fe08], 0
je 0x40175e
lea eax, [ebp - 0x404]
push eax
call fcn.00402210
add eax, 0x40
push eax
call fcn.00402184
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402551
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402551
mov esp, ebp
pop ebp
ret

Function at 0x402551
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f288]
jne 0x40255b
repz ret
jmp fcn.004057e7
Function at 0x40a224
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40f288]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004077d3
and dword [ebp - 0x14], 0
cmp dword [0x410a60], 0
mov dword [ebp - 0x18], eax
jne 0x40a2d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a37f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a37f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x410a60], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x410a64], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x410a68], eax
call edi
push eax
call esi
mov dword [0x410a70], eax
test eax, eax
je 0x40a2d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x410a6c], eax
mov eax, dword [0x410a6c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a330
cmp dword [0x410a70], ecx
je 0x40a330
push eax
call esi
push dword [0x410a70]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a330
test ebx, ebx
je 0x40a330
call edi
test eax, eax
je 0x40a327
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a327
test byte [ebp - 8], 1
jne 0x40a330
or dword [ebp + 0x10], 0x200000
jmp 0x40a363
mov eax, dword [0x410a64]
cmp eax, dword [ebp - 0x18]
je 0x40a363
push eax
call esi
test eax, eax
je 0x40a363
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a363
mov eax, dword [0x410a68]
cmp eax, dword [ebp - 0x18]
je 0x40a363
push eax
call esi
test eax, eax
je 0x40a363
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x410a60]
call esi
test eax, eax
je 0x40a37f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a381
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402551
leave
ret
Function at 0x629853
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, esi
setp dh
sub esp, 4
jae 0x6297eb
mov cx, 0x92d5
jmp 0x629842
sub esp, 0xbc
mov ebp, esp
cpuid
mov ebx, 0xa4c30bd5
jmp 0x6297c4
mov cx, 0x92d5
jmp 0x6297f6
not dx
btc cx, ax
stc
jmp 0x629827
mov edx, 0x2f4d999c
mov ah, byte [esp]
neg cx
jne 0x62984c
je 0x62984c
jne 0x629808
add dh, cl
cmp al, 0x6a
test dword [ebp + reloc.KERNEL32.dll_TlsSetValue], ecx
mov byte [0x24148b66], al
mov ebx, edi
mov dh, 0xc1
jmp 0x6297da
rol esi, 0
lea ecx, [ecx*4]
bswap ecx
lea eax, [edi*4]
jmp 0x629800
fnstcw word [eax]
sbb esp, dword [esi - 9]
shl byte [esi + 0xf], cl
mov ebx, 0xb2ebf9c1
not dx
btc cx, ax
stc
jmp 0x6297fe
dec esi
call 0x629853
jb 0x62983f
aas
jmp 0x62987e
lea esp, [esp + 4]
not esi
bsf eax, edx
jl 0x6299b0
jge 0x629914
push 0xffffffffffffffed
jge 0x629874
div dword [edi]
jl 0x6298c3
salc
inc ecx
ret
bts edx, esp
jmp 0x629857
xchg al, dh
dec eax
jns 0x6298e2
mov ax, 0xa7d0
jmp 0x6298e6
lea eax, [ecx + edi]
lea esp, [esp + 2]
jmp 0x6299bd
mov ax, 0xa7d0
call 0x6298cc
ror esi, 0
xor eax, 0xc5c50b5c
jmp 0x629959
mov ah, byte [esp]
xchg ecx, eax
add esi, dword [edi]
bswap edx
mov cx, dx
jmp 0x62998b
inc ah
push sp
bswap edx
jmp 0x6298c0
js 0x6298fa
mov ah, byte [esp]
xchg ecx, eax
call fcn.00629932
call 0xa91c85f3
mov ch, ah
mov ecx, 0x7a7b3ca8
invalid
push dword [esp]
xor al, 0x24
ret 4
inc ah
push sp
bswap edx
lea eax, [ecx + edi]
lea esp, [esp + 2]
neg esi
mov ecx, eax
jmp 0x6298aa
pop edi
mov al, 0x8a
rdtsc
mov dx, 0x1d9d
jmp 0x639d3b
pop esi
jmp 0x6297c4

Function at 0x62bc00
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov word [esp + 8], ax
call fcn.0062bb65
Function at 0x62bcab
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, edi
mov edx, esi
stc
jmp 0x62bb8a
mov al, byte [esp]
sets ch
mov eax, 0x98272f39
bsr ecx, ebp
adc ecx, 0xac4f0f1
jmp 0x62bb94
mov eax, 0x98272f39
bsr ecx, ebp
adc ecx, 0xac4f0f1
call fcn.0062bbcf
push ecx
rcl byte [ebx + 0x7d]
mov esi, 0xf24048a
cwde
invalid
jge 0x62bb4a
mov al, byte [esp]
sets ch
jmp 0x62bb74
sete cl
mov ah, cl
lea edx, reloc.KERNEL32.dll_TlsSetValue
xchg dl, ch
bswap ecx
jmp 0x62bcfa
rol eax, 3
lea ecx, [edi*4]
mov ch, ah
jmp 0x62bc2d
rol eax, 3
lea ecx, [edi*4]
mov ch, ah
jmp 0x62bc59
call 0x62bcab
jmp 0x62bc7a
xchg word [esp + 0x1e], dx
bts edx, edi
ror edi, 0
jmp 0x62bc64
mov byte [esp + 0x12], bl
bsr ecx, edx
jle 0x62bc84
rdtsc
jmp 0x62bc86
sub edi, 0x7f8846e8
cmc
jno 0x62bc2f
jo 0x62bc2f
mov dh, byte [esp]
xchg dh, ch
pushal
mov byte [esp + 9], dl
mov word [esp + 0xe], si
jmp 0x62bc43
clc
push dword [esp + 2]
sub esp, 0x1c
jmp 0x62bc36
rdtsc
jmp 0x62bccf
add esp, 0
jne 0x62bce1
mov al, byte [esp]
jmp 0x62bce4
neg edi
setae al
call fcn.0062bd44
add eax, 0xa7540d9d
pop ss
jne 0x62bc92
jl 0x62bcc1
div byte [0x66f1467f]
mov eax, dword [esp + 2]
bsr dx, di
jno 0x62bc34
clc
push dword [esp + 2]
sub esp, 0x1c
xchg word [esp + 0x1e], dx
sbb al, 0x66
xchg dword [esp + 0x1e], edx
bts edx, edi
jmp 0x62bc3e
lea esp, [esp + 0x44]
not edi
mov al, ah
mov ch, ah
mov edx, 0x8b04deaa
pushfd
jmp 0x62bc88
mov al, byte [esp]
lea esp, [esp + 4]
jmp 0x62bc92
add edi, 0x60b35641
mov ecx, dword [esp]
bsr cx, ax
jo 0x62bc21
jno 0x62bc0b
ror byte [edx + eax*8 - 0x5b], cl
push esp
jmp 0x62bd5e
jmp fcn.0062bd75
fisubr word [ecx]
setl al
mov cl, byte [esp]
sub esp, 0x1c
jb 0x62bd4a
jae fcn.0062bd75
dec ebx
retf 0x3f58
xchg byte [esp], cl
jmp 0x639848
add esi, 4
stc
jbe 0x639877
neg dx
mov ah, 0xdb
mov cx, dx
jmp 0x62bb3f
mov ah, 0xdb
mov cx, dx
jmp 0x62bb3f
neg dx
jmp 0x639861

Function at 0x62bd44
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, dword [esi]
jmp 0x62bd60
neg ecx
jp 0x62bd2e
jnp 0x62bd2e
Function at 0x62c619
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xfcd21210
jmp 0x62c658
jmp 0x62abde

Function at 0x62d52d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0062d55c
mov word [esp], bx
mov dword [esp + 0x1c], ecx
call fcn.0062d56c
mov eax, dword [reloc.KERNEL32.dll_TlsSetValue]
xchg dword [ecx + 0x32c7a032], esp
invalid

Function at 0x62d55c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
pushal
lea esp, [esp + 1]
mov dword [esp + 0x1c], eax
pushfd
jmp 0x62d532

Function at 0x62d6b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], bl
pop dword [esp]
pushfd
mov dword [esp + 0x20], edx
call fcn.0062d637
xchg ecx, edx
mov ah, bl
bswap ebx
jmp 0x62d7a0
lea esi, [esp]
mov dx, word [esp]
add dx, bx
jno 0x62d7ae
setb dh
mov ch, byte [esp]
jmp 0x62d802
mov edi, dword [esp + 0x2c]
mov dh, byte [esp]
xchg bx, cx
xchg edx, ebx
jmp 0x62d781
setb dh
jmp 0x62d7b7
mov ch, byte [esp]
jmp 0x62d802
jmp 0x62d8e9
mov edx, esp
push bx
btc ecx, eax
lea esp, [esp + 2]
lea edx, [edi*4]
not dl
jmp 0x62d896
sub esp, 0xc0
mov ebp, esp
sub cx, 0xa6e0
jle 0x62d7dd
mov ebx, dword [esp]
mov dh, 0x7b
jmp 0x62d8ee
btc ecx, eax
lea esp, [esp + 2]
lea edx, [edi*4]
jmp 0x62d7f4
jo 0x62d7e2
mov edx, esp
push bx
jmp 0x62d81b
xor edi, 0x271f863
mov ah, 3
setne dh
xchg al, dh
sbb ecx, esi
jmp 0x62d859
mov dh, 0xea
jmp 0x62d83f
jp 0x62d86f
not ax
neg ch
jmp 0x62d874
not ax
neg ch
jmp 0x62d8bd
clc
jmp 0x62d8a6
clc
lea edx, [edx + edx]
call fcn.0062d959
arpl dx, bp
js 0x62d8a9
ljmp 0x9fa:0x9f0f875f
mov edx, 0x34e9874c
mov dl, 0xbc
add ch, 0x61
jg 0x62d855
mov dh, 0xea
jmp 0x62d83f
lea edx, [edx + edx]
call fcn.0062d91e
mov eax, dword [edx + ebx*4]
std
or al, 0xb9
aas
mov cl, 0x21
inc eax
mov bl, 0xe
xor byte [ebx], dh
sub al, byte [edi - 0x73]
or al, 0x1b
inc edi
lea ecx, [ebx + ebx]
xchg edx, ecx
ror al, 0
jge 0x62d876
jl 0x62d87d
sub edi, 0x56aff9d6
sub esp, 0x1d
jo 0x62ddd6
bswap eax
lea edx, [ebx + edi]
bswap edx
jmp 0x62ddf0
mov ebx, dword [esp]
mov dh, 0x7b
mov ebx, edi
inc dx
jmp 0x62d837
lea edx, [ebx + edi]
bswap edx
pop word [esp + 8]
lea esp, [esp + 3]
jmp 0x62ddda
bswap eax
jmp 0x62ddc0
lea esp, [esp + 0x18]
sub edi, 0x1ad3468c
pushfd
not edx
mov dx, cx
jmp 0x62de41
pop word [esp + 8]
lea esp, [esp + 3]
jmp 0x62ddda
mov cx, 0xc100
jmp 0x62de51
neg edi
rdtsc
rcl cx, 3
jle 0x62de0f
mov cx, 0xc100
rdtsc
jmp 0x62de53
mov dword [esp], ebp
mov dh, byte [esp + 2]
bswap edx
pushfd
lea esp, [esp + 8]
jmp 0x62de25
rdtsc
add edi, dword [esi]
lea edx, [ebp*4]
bsf eax, ebp
jmp 0x62dee6
xchg ah, cl
jmp fcn.0062deaa
jnp 0x62de65
xchg ah, cl
jmp fcn.0062deaa
Function at 0x6379ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
popfd
jmp fcn.0062bd75
mov esi, dword [esp + 3]
mov esi, dword [esp + 4]
call 0x63777b
bsr bp, bp
jmp 0x63789f
mov bl, cl
xchg al, ch
mov edx, dword [esp]
lea edx, [ebx + edi]
xchg dword [esp + 0x3c], edi
sub esp, 7
jmp 0x6378b5
mov ah, dl
mov cx, word [esp]
jmp 0x637905
pushal
sub esp, 7
lea esp, [esp + 1]
mov dword [esp + 0x11], esi
lea esp, [esp + 2]
lea edi, [edi + 0x7d]
jmp 0x63785e
jne 0x637871
mov ah, dl
mov cx, word [esp]
jmp 0x637905
lea ebp, [ebp*4]
xchg dword [esp], ebp
mov ecx, ebp
push dword [esp + 6]
lea esp, [esp + 3]
push dword [esp + 0x44]
ret 0x48
sbb dword [ecx + 0x1f29707], 0xec833ab0
adc ah, byte [esi + 0xf]
mov bl, 0xe5
bswap ebx
sub esp, 6
xchg dword [esp + 0x18], edi
jmp 0x63788a
push esi
inc ecx
jl 0x63792e
mov dl, al
pushfd
mov dx, word [esp + 3]
mov si, word [esp]
jmp 0x637999
push edi
not dx
lea ecx, reloc.KERNEL32.dll_TlsSetValue
rdtsc
mov ch, 0xd4
jmp 0x6378ef
pushfd
mov dx, word [esp + 3]
mov si, word [esp]
jmp 0x637932
mov dl, al
jmp 0x637915
xchg edx, ecx
sub esp, 8
mov ecx, eax
add esp, 0xc
jmp 0x637975
pop edi
neg esi
jl 0x637979
jge 0x637981
loopne 0x6379c8
in eax, dx
je 0x6378d5
cmp edx, edx
dec esi
fdivr qword [ebx - 0x59a06aaa]
rcl dword [eax - 0x2d]
neg esi
jo 0x63782c
mov esi, dword [esp + 3]
mov esi, dword [esp + 4]
stc
stc
lea esp, [esp + 8]
jmp 0x63774c
js 0x637942
jns 0x637942
adc ebx, ebx
jmp 0x6379b3
adc ebx, ebx
cpuid
call 0x6379ba
xor dword [edx + reloc.KERNEL32.dll_TlsSetValue], ebp
mov ecx, 0x3ebb4829
sbb byte [ebx + 0x52], bh
xchg edx, ecx
jmp 0x637934
cpuid
call 0x63799d
setnp al
inc ch
bswap eax
stc
call fcn.00637a93
and ah, byte [edi + 0x1ba15237]
pop eax
fmul dword [esi + 0x29]
fsub dword [esi - 0x4b]
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
aaa
push edx
mov eax, dword [reloc.KERNEL32.dll_TlsSetValue]
sub eax, ebx
mov ch, 0xa4
jmp 0x63795a