joyce8/EMBER2024-capa huggingface dataset:
Function at 0x373416d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ch, bl
mov eax, dword [ebp - 0x64]
jmp 0x373c4e5
bsf cx, si
push eax
pushal
btc ecx, ebp
mov ecx, dword [ebp - 0x38]
stc
bt cx, 7
test cl, cl
jmp 0x37365e3
pushfd
cmp dword [ebp - 0x12c], 0
pushal
mov byte [esp + 4], 0xb6
lea esp, [esp + 0x28]
je 0x37379ef
xchg cx, ax
push ecx
mov dword [ebp - 0x12c], 0
movsx ecx, dl
mov ecx, dword [ebp - 0x7c]
movzx ax, cl
bswap ax
mov eax, dword [ebp - 0xdc]
push dword [esp]
mov dword [ecx], eax
pushfd
bswap ax
lahf
seta al
lea eax, [ebp - 0x128]
mov dword [esp], 0xe92ea943
mov dword [esp + 8], eax
call fcn.03738545
add ecx, 1
pushal
call fcn.0373c90b
mov dword [esp], 0x4d2a820a
pushal
lea esp, [esp + 0x24]
jmp 0x373c3cc
shrd ax, cx, cl
mov dword [ebp - 8], 0
clc
not cl
mov eax, dword [ebp - 8]
shr ch, cl
mov ecx, dword [ebp - 0x64]
bt cx, dx
pushal
stc
cmp dword [ecx + eax*4], 0
push ebp
push 0x73dc1b1
push 0x863f3483
lea esp, [esp + 0x2c]
je 0x3732f24
test dh, 0x57
mov edx, dword [ebp - 8]
jmp 0x37326a0

Function at 0x37342e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x34]
je 0x373333f
push edi
inc esi
cmp ebx, 0x538ef7d7
cmp cl, 0xd5
add ecx, 4
pushfd
pushfd
lea esp, [esp + 0xc]
jmp 0x3732e37

Function at 0x373430f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x3c
call fcn.0373aa25
pushal
test eax, eax
jmp 0x3735d66
movzx dx, cl
clc
lea edx, [eax*2 - 0x310d7cec]
mov dword [ebp - 0x108], ecx
rcl dx, cl
inc edx
adc dh, 0x11
push 0xf2750e3
mov edx, dword [ebp - 0x104]
jmp 0x3734307

Function at 0x373433f
Capabilities:
Check for software breakpoints

Disassembly:
cmp ax, 0x83a4
mov eax, dword [ebp - 0x100]
btr cx, 0xb
bswap cx
mov ecx, dword [eax + 0x30]
pushal
sub edx, edx
add dx, si
sub dh, 0xd0
mov dx, word [ecx + 4]
test di, ax
cmp edx, 0x44
mov byte [esp], dl
call fcn.0373b80a
pushfd
push edi
lea esp, [esp + 8]
jne 0x3737b07
cmp cl, 0x7c
mov bl, byte [eax + 2]
call fcn.0373205b

Function at 0x3734843
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], dl
cmc
clc
mov dword [ebp - 0x1c], edx
shr dx, cl
inc edx
bts dx, 1
mov edx, dword [ebp - 0x5c]
bt ebp, 3
and edx, 0xffff
test dl, 0x3a
cmp al, dl
cmp si, 0xe7d0
test edx, edx
call fcn.0373acbd

Function at 0x3734879
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x6c
push dword [esp + 4]
pushfd
mov byte [esp + 8], 0xbc
mov byte [esp], 0x92
lea esp, [esp + 0x30]
je 0x3734d56
stc
bt cx, 9
test bh, bl
cmp bl, 0x4c
pushfd
call fcn.03734d48

Function at 0x373490f
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
cmp ecx, 0x2e
call fcn.03737f7e
Function at 0x3734919
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 8], ch
pushfd
lea esp, [esp + 0x10]
je 0x3734e1c
aad 0x98
rcl al, cl
inc al
and ax, 0xe12f
mov eax, dword [ebp - 0x44]
bt ebp, ebp
test si, 0x2502
jmp 0x373835a
lea esp, [esp + 8]
jne 0x37341da
push 0x9b158820
mov ecx, dword [ebp - 0x44]
push esp
stc
pushfd
xor edx, edx
adc dl, 0x85
ror dl, 6
cmp bx, 0xc7ce
mov dl, byte [ecx + 4]
cmp cl, 3
cmp edx, 0x33
jmp 0x3733395
pushal
xor ecx, ecx
xor cl, 0x41
sal cl, 7
adc cl, 0x8b
mov cl, byte [eax + 4]
call fcn.03739351
cmp dword [ebp - 0x7c], 0
mov word [esp], bp
jmp 0x373ac97
call fcn.0373bcad

Function at 0x37349f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
sar ax, cl
cwde
mov byte [esp], 0x48
mov eax, dword [ebp - 0x100]
stc
sar ch, cl
mov ecx, dword [eax + 0x30]
stc
xor edx, edx
mov byte [esp], 0xee
lea esp, [esp + 4]
jmp 0x3737266

Function at 0x3734a15
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
sar dl, cl
shl dl, 7
ror dl, cl
and dl, 0x46
mov dl, byte [ecx + 1]
cmc
pushfd
call fcn.0373a782
test bl, ah
jmp 0x3732ea6

Function at 0x3734c67
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ecx, 0x6c
call fcn.03731e7e
pushal
cmc
test eax, eax
call fcn.037327ef

Function at 0x3734d48
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xa6
lea esp, [esp + 8]
jne 0x3737b07

Function at 0x3734e12
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0x37341da

Function at 0x3734f84
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
mov dword [esp + 0x24], 0
call fcn.03735d2b
push dword [ebp - 0x30]
pop dword [esp + 0x24]
push dword [esp]
jmp 0x3732b03

Function at 0x373505e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0x44]
bt edi, edx
cmc
xor ecx, ecx
and cl, 0xf9
stc
add cl, dl
xor cl, 0xfe
mov cl, byte [eax + 4]
pushfd
clc
test bl, 0x74
cmp ecx, 0x33
mov byte [esp + 4], 0xb7
push dword [esp]
lea esp, [esp + 0x10]
jne 0x37341da
add dx, cx
setbe dl
dec dl
mov edx, dword [ebp - 0x44]
pushfd
jmp 0x3739717

Function at 0x373568b
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [esp], 0xc1
push dword [esp]
lea esp, [esp + 0x30]
je 0x3737946
cmc
pushal
call fcn.037375d5

Function at 0x3735762
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 8], 0x2d
lea esp, [esp + 0x10]
je 0x37357a5
jb 0x373bca2
mov eax, dword [ebp - 0x104]

Function at 0x3735acb
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x3738233
pushal
pushfd
lea esp, [esp + 0x28]
jne 0x3737b07

Function at 0x3735c37
Capabilities:
Check for software breakpoints

Disassembly:
lea eax, [ebp - 0x128]
push ecx
pushal
call fcn.0373bf63

Function at 0x3735d2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], esi
jmp 0x373414d

Function at 0x3735ef6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
call fcn.03739961
lea esp, [esp + 4]
je 0x37398bd
clc
pushal
cmp bl, 0x4c
call fcn.03732a43
Function at 0x3735fda
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xe5
lea esp, [esp + 8]
jne 0x3736760
xadd ch, al
test bx, bx
mov eax, dword [ebp - 0x104]
jmp 0x373bb7f
xor cl, dl
movsx cx, al
shld cx, dx, 7
mov ecx, dword [eax + 0x30]
push edx
xor edx, edx
bsr dx, di
ror dx, 1
mov dx, word [ecx + 0x18]
pushal
bt ax, 0xc
mov byte [esp], 0xf5
test edx, edx
call fcn.03731e65

Function at 0x3736080
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push ebx
mov byte [esp + 4], bl
lea esp, [esp + 0x2c]
je 0x3735b9f
not ch
movsx cx, cl
mov cx, 0x81c5
rdtsc
mov eax, dword [ebp - 0xfc]
call fcn.037324a9

Function at 0x3736450
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [edx + 1], eax
mov byte [esp + 4], bh
jmp 0x3737689
push dword [esp + 8]
lea esp, [esp + 0x28]
je 0x373c1c1
pushal
mov dword [ebp - 0x6c], 1
mov dh, ch
not ecx
mov cx, word [esp]
xchg ecx, edx
mov ecx, dword [ebp - 0x7c]
lea edx, [ebp + 0xb77ef36]
mov edx, dword [ebp - 0xdc]
pushfd
pushfd
mov dword [ecx], edx
pushfd
push 0xbd804b69
lea esp, [esp + 0x30]
jmp 0x373c1ca
jmp 0x373494f
mov dword [edx + 1], eax
rcl al, 2
bts eax, 1
cwde
rol eax, 5
mov eax, dword [ebp - 0xc]
sub esp, 0xffffffd0
js 0x3732b82
stc
test si, 0x7b60
mov dword [edx + 6], eax
jmp 0x3739496
call fcn.03737d55
call fcn.037328a3
clc
mov dword [edx + 6], eax
rcl eax, cl
bsr dx, dx
shr dx, cl
mov edx, dword [ebp - 0xac]
das
das
aas
add edx, 0x10001f1a
shld ax, si, cl
mov eax, dword [ebp - 0xb8]
cmc
push 0x2aa11e26
mov word [esp], cx
sub eax, edx
jmp 0x373c1a9
sub eax, 5
push ebx
mov dword [esp + 4], esi
jmp 0x3731a52
mov eax, dword [ebp - 0xb8]
push ecx
sub eax, edx
stc
jmp 0x37356a3
add edx, 0x10001f04
aaa
pop eax
or ax, 0xc4d4
bts eax, esi
mov eax, dword [ebp - 0x9c]
jmp 0x37336d7
call fcn.03733ad5
pushal
pushfd
pop dword [esp + 0x1c]
pushfd
jmp 0x373c081
mov edx, dword [ebp - 0xac]
sets al
or al, 0x47
and ah, 0xc5
add edx, 0x10001f1a
or ah, bh
jmp 0x3735fab
pushal
pushfd
pushfd
push 0x52920f88
mov dword [esp + 0x28], ebx
push ebp
push 0x321c812a
mov dword [esp + 0x2c], 0x28a11a6
neg bl
mov eax, dword [esp + 0x2c]
rcl bl, cl
cmc
sub eax, 0x100010ab
not bx
mov ebx, eax
btc eax, 0x1e
dec ax
bsr eax, esp
add ebx, 0x10001036
pushfd
lea eax, [ebp + 0x7fc049ac]
bt cx, dx
inc ah
cmp dword [ebx], 0
pop eax
call 0x373c0bc
test si, 0x5273
cmc
pushal
test eax, eax
push dword [esp]
jmp 0x37320b1
mov dword [esp + 0x1c], eax
lea esp, [esp + 0x1c]
jo 0x373c01d
pushfd
mov dword [esp], ebx
call fcn.0373228a
clc
clc
test dl, dh
mov dword [edx + 1], eax
lahf
ror al, 6
xadd dh, ah
rol dl, cl
mov edx, dword [ebp - 0xac]
btr eax, 0x1e
call fcn.0373959b
call fcn.037326b8
not bh
lahf
mov ebx, dword [esp + 0x34]
pushfd
lea esp, [esp + 0x3c]
jb 0x3734403
pop eax
call fcn.0373ac83
setne cl
shr cx, cl
mov ecx, dword [eax + 0x30]
bt sp, 9
xor edx, edx
shl dx, cl
btr dx, 2
mov dx, word [ecx + 2]
call fcn.03738a42
sub eax, 5
pushal
mov dword [edx + 1], eax
mov byte [esp], cl
mov dword [esp + 0x10], ecx
jmp 0x3733895
Function at 0x373664a
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
rcl dl, 3
sar dx, cl
mov dx, word [ecx + 4]
mov byte [esp], 0x76
cmp ah, ch
bt ecx, 2
cmp ch, dl
cmp edx, 0x44
mov byte [esp], 0x28
push ecx
push dword [esp]
jmp 0x373309b

Function at 0x3736672
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
lea esp, [esp + 0x38]
jne 0x3736760

Function at 0x3736815
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub dl, 0x50
mov edx, dword [ecx + eax + 0xc]
or ch, ch
cwde
shr al, 6
test di, bx
add edx, dword [ebp - 0xbc]
lea eax, [esi*8 - 0x67f6e1f8]
rcl ch, 5
rcl ch, 5
movsx cx, al
mov dword [ebp - 0x44], edx
lahf
xchg dl, cl
bswap eax
setb cl
mov eax, dword [ebp - 0x38]
pop ecx
clc
cmc
imul eax, eax, 0x14
xadd dx, cx
mov ecx, dword [ebp - 0x40]
setnp dl
xor edx, ebx
adc dh, 0x8c
pushal
mov edx, dword [ebp - 0xbc]
push 0x6a744c6f
cmp dl, 0xe7
jmp 0x3732907

Function at 0x3736960
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], al
lea esp, [esp + 0x2c]
je 0x37374db
adc cl, al
aam 0x79
pushfd
bts eax, 2
mov eax, dword [ebp - 0x104]
mov cx, 0x2e9e
ror ch, 7
adc ecx, 0x55525a0b
shld cx, di, 1
mov ecx, dword [eax + 0x30]
bt di, sp
test ch, bh
pushal
pushfd
xor edx, edx
cmc
mov byte [esp + 0x14], ch
shrd dx, cx, 5
clc
mov dx, word [ecx + 6]
cmc
mov byte [esp], cl
cmc
clc
cmp edx, 0x4e
push esp
call fcn.037374d1

Function at 0x3736a06
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
mov word [esp + 4], cx
pushfd
lea esp, [esp + 0xc]
je 0x3739ec8
bsf ax, cx
das
mov eax, dword [ebp - 0x100]
bsr ecx, esp
mov ecx, dword [eax + 0x30]
push edi
xor edx, edx
dec dh
mov dx, word [ecx]
stc
clc
mov word [esp], di
push 0xf04768a7
cmp edx, 0x6e
pushfd
lea esp, [esp + 0xc]
je 0x37341f3
bsr ax, di
mov eax, dword [ebp - 0x100]
bt bp, 6
stc
ror cl, 1
mov ecx, dword [eax + 0x30]
cmp esi, edi
stc
sub edx, edx
pushal
pushfd
pushal
pushfd
lea esp, [esp + 0x48]
jmp 0x3737266

Function at 0x3736a70
Capabilities:
Check for software breakpoints

Disassembly:
pushal
cmp ch, ah
cmp bl, 0x64
mov byte [esp + 4], 0x60
pushfd
jmp 0x3738b0e
push esi
lea esp, [esp + 0x30]
je 0x3737946
pushal
cmp bl, 0x44
pushfd
call fcn.03731ad0
Function at 0x3736a81
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push 0xbc573df3
push dword [esp]
mov dword [ebp - 0xfc], edx
push 0x6a790fe8
mov word [esp], si
mov byte [esp], ah
mov byte [esp + 4], bl
lea esp, [esp + 0x30]
jmp 0x373bdbb
push edi
cmp si, si
add edx, 0xc
clc
cmp dword [ebp - 0xfc], edx
call fcn.03736080
lea esp, [esp + 0x10]
je 0x37341f3
or ch, 0x38
not cl
mov eax, dword [ebp - 0x100]
lea ecx, [eax - 0x7bac818]
pushal
sar cl, cl
and ch, dl
mov ecx, dword [eax + 0x30]
bt esp, edx
mov byte [esp + 0xc], dl
xor edx, edx
sub esp, 0xffffffe0
mov byte [esp + 4], 0x2d
push eax
pushfd
lea esp, [esp + 0x48]
je 0x3739ec8
aas
lahf
push 0xafebeae
pushfd
mov eax, dword [ebp - 0x100]
test cl, cl
mov ecx, dword [eax + 0x30]
clc
jmp 0x373bd23
cmc
xor edx, edx
adc dh, 0x3b
seto dh
rcl dl, 5
mov dx, word [ecx]
mov byte [esp], dh
push edx
mov word [esp], di
cmp edx, 0x6e
pushfd
jmp 0x3737237
test cl, cl
inc dh
movsx dx, bl
mov edx, dword [ebp - 0xf4]
stc
push ebx
bt sp, ax
add esp, 4
jg 0x3736aa9
add edx, 0xc
stc
cmp bh, 0xd8
pushfd
cmp dword [ebp - 0xfc], edx
pushfd
lea esp, [esp + 8]
je 0x3735b9f
shl ch, cl
neg ah
rdtsc
cmc
mov eax, dword [ebp - 0xfc]
sub cl, ah
clc
mov dword [ebp - 0x100], eax
rol ecx, 0x11
rcl dh, cl
stc
bts cx, 5
mov ecx, dword [ebp - 0x100]
cmc
cmc
bswap dx
mov edx, dword [ecx + 0x34]
bt edi, esi
and edx, 4
pushal
cmp dx, 0x6132
pushal
test edx, edx
jmp 0x373bb49

Function at 0x3736ba1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], sp
lea esp, [esp + 8]
je 0x3732445
btc cx, si
test dl, ah
lea eax, [ebp + 0x65a5863d]
not ecx
mov eax, dword [ebp - 0x100]
setp cl
mov ecx, dword [eax + 0x30]
cmp dl, 0xec
cmp cl, al
pushfd
pushal
xor edx, edx
sub dh, 0xb7
mov dx, word [ecx + 8]
bt di, cx
test ch, bh
cmp edx, 0x4c
call fcn.0373a83a

Function at 0x3736e5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0x3736760

Function at 0x373728e
Capabilities:
Check for software breakpoints

Disassembly:
stc
mov dx, word [ecx + 6]
pushfd
cmp edx, 0x6c
lea esp, [esp + 4]
stc
cmp edx, 0x64
pushfd
pushal
lea esp, [esp + 0x2c]
je 0x37328d1
rcl al, 1
rcr ax, 6
call fcn.0373433f
stc
mov eax, dword [ebp - 0x100]
bts cx, bp
bt bx, 6
mov ecx, dword [eax + 0x30]
clc
test si, 0xe7ae
xor edx, edx
mov dh, bl
sar dx, cl
jmp 0x3731abd
push dword [esp]
sub edx, edx
adc dx, ax
mov dx, word [ecx + 4]
jmp 0x3732083

Function at 0x37373b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dh, ch
bt ax, cx
ror dx, cl
mov dx, word [ecx + 0xa]
pushfd
stc
stc
cmp edx, 0x6c
pushfd
pushfd
jmp 0x3735be0

Function at 0x37374d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jne 0x3736760

Function at 0x37377d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 8]
je 0x3732f99
shr dh, 7
mov edx, dword [ebp - 0x130]
call fcn.0373b63f

Function at 0x373793c
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0x3737b07
Function at 0x373795e
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x373ac54
rol bl, 6
mov bl, byte [eax + 3]
cmc
stc
cmp bl, 0x6c
pushfd
mov byte [esp], ah
pushfd
lea esp, [esp + 8]
je 0x3733aeb
stc
pushfd
cmp dl, 0xd2
cmp bl, 0x4c
push 0x65f3e3f8
pushfd
lea esp, [esp + 0xc]
jne 0x3737b07
bt di, dx
pushfd
and bl, dl
shl bl, 1
mov bl, byte [eax + 4]
test edi, esi
bt dx, si
cmp bl, 0x6c
push ecx
lea esp, [esp + 8]
je 0x3734d56
cmp sp, 0x8f55
test bl, 0xd
cmp dh, 0xcc
clc
cmp bl, 0x4c
pushfd
lea esp, [esp + 4]
jne 0x3737b07
shl bl, cl
clc
mov bl, byte [eax + 5]
call fcn.03737274
lea esp, [esp + 0xc]
je 0x373aa57
clc
stc
cmc
cmp bl, 0x44
jmp 0x37358cb
pushal
pushfd
lea esp, [esp + 0x24]
jne 0x3737b07
jmp 0x37368d8

Function at 0x3737a2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x88ce41ec
call fcn.037325be

Function at 0x3737a54
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x37350f3
bt ecx, 1
cmp ebx, 0x4464616f
push esp
pushfd
jmp 0x3737050
pushfd
lea esp, [esp + 0x2c]
jne 0x3735574
and bl, bh
stc
movzx bx, bl
bts bx, 6
mov ebx, dword [eax + 0xa]
clc
and ebx, 0xffffff
cmp bx, dx
cmp al, 0x15
pushal
call fcn.0373977e
pushfd
pushfd
push ebp
lea esp, [esp + 0xc]
jne 0x3735574
jmp 0x3738f07
test ebx, ebx
lea esp, [esp + 8]
jae 0x37375c3
push 0x341ce8ab
pushfd
mov dword [esp + 4], esi
lea esp, [esp + 8]
jne 0x3735574
sal bx, cl
push 0x687ecef
pop ebx
call fcn.0373b633
btr bx, 2
pushfd
add eax, edx
shl bl, 5
shrd bx, bx, 5
neg bx
mov ebx, dword [eax + 2]
clc
cmp ebx, 0x4c72644c
push esp
lea esp, [esp + 8]
jne 0x3735574
test dl, cl
rcr bh, cl
cmc
mov ebx, dword [eax + 6]
pushal
jmp 0x37325e1

Function at 0x3737afd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0x3732e8b

Function at 0x3737b6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [ebp - 0x108], eax
pushfd
lea esp, [esp + 0x34]
jmp 0x3738c4d
jmp 0x3737851

Function at 0x3737bd2
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
stc
cmp eax, 0x2e
push dword [esp + 4]
lea esp, [esp + 0x10]
jne 0x37341da
dec cl
mov ecx, dword [ebp - 0x44]
bt ebp, esp
test bh, bl
pushal
xor edx, edx
pushal
mov dl, byte [ecx + 7]
call fcn.0373c674

Function at 0x3737cbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
cmp dword [ebp - 0x11c], 0
pushfd
pushfd
jmp 0x3736408

Function at 0x3737f1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x5d
lea esp, [esp + 0x28]
je 0x373c238
bsr eax, edx
push ebp
add ax, 0xa580
aaa
mov eax, dword [ebp - 0x44]
test ebp, 0xb74539ce
stc
stc
mov byte [esp], cl
xor ecx, ecx
push dword [esp]
mov cl, byte [eax + 0xa]
stc
test ecx, ecx
mov byte [esp], dl
pushal
pushfd
jmp 0x373c22e

Function at 0x3737f72
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
lahf
cwde
mov dword [esp + 0x18], ecx
jmp 0x3739475
pop edx
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1d35dae9]
mov dword [esp + 0x10], edx
cwde
movzx eax, bl
mov eax, dword [ebp - 0x90]
mov byte [esp + 0xc], ch
jmp 0x373c220
Function at 0x3737f7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub eax, eax
dec al
jmp 0x37333f3
cmc
call fcn.03733fa6
mov byte [esp], al
push dword [esp + 0xc]
lea esp, [esp + 0x30]
je 0x3733413
bsr dx, si
mov edx, dword [ebp - 0x44]
push ecx
sub esp, 0xfffffffc
jne 0x3736300
bt edi, 0x1e
jmp 0x3733055

Function at 0x373808c
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x4e
push dword [esp]
jmp 0x37341e9
push 0xaa9c4292
lea esp, [esp + 4]
je 0x37341f3
rcl ax, 7
mov eax, dword [ebp - 0x100]
pushal
setg ch
mov ecx, dword [eax + 0x30]
stc
sub edx, edx
push edx
mov byte [esp], bh
lea esp, [esp + 0x24]
jmp 0x3737266
dec dh
adc dl, dl
mov dx, word [ecx]
pushfd
clc
jmp 0x37336cc
lea esp, [esp + 0x28]
je 0x3735b9f
sar ah, cl
mov eax, dword [ebp - 0xfc]
shl ch, 4
rcr cl, 5
bsf cx, bx
mov dword [ebp - 0x100], eax
xadd cl, dh
cmp ch, ch
ror dx, 1
rcl dl, 1
mov ecx, dword [ebp - 0x100]
clc
lea edx, [edi*8 - 0x6baeb91a]
and dl, 0x7e
mov edx, dword [ecx + 0x34]
cmc
and edx, 4
bt si, 9
cmc
test edx, edx
pushfd
lea esp, [esp + 4]
je 0x3739ec8
jmp 0x373a257
sub cl, ah
test ch, 0x7c
mov eax, dword [ebp - 0x100]
push ecx
clc
dec cx
mov ecx, dword [eax + 0x30]
cmp cl, ah
xor edx, edx
bsf dx, cx
ror dx, 1
bts dx, 0xa
mov dx, word [ecx]
cmp ah, 0x88
test ah, 0x1d
cmp edx, 0x6e
pushal
lea esp, [esp + 0x24]
jg 0x37367c2
push 0x20bd0f74
lea esp, [esp + 4]
je 0x37341f3
call fcn.037349f1

Function at 0x37380e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
je 0x3739ec8
dec ax
cmp bp, ax
mov eax, dword [ebp - 0x100]
not cl
mov ecx, dword [eax + 0x30]
push esp
pushfd
xor edx, edx
shrd dx, bp, cl
clc
rol dl, cl
mov dx, word [ecx]
cmp dl, 0x94
cmp edx, 0x6e
pushfd
pushal
pushfd
lea esp, [esp + 0x30]
je 0x37341f3
aam 0xaf
neg cl
pushal
mov eax, dword [ebp - 0x100]
dec ecx
push 0x218e3c0a
rcr ch, cl
mov ecx, dword [eax + 0x30]
cmc
call fcn.037323b4

Function at 0x373865b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
call fcn.0373bd02
call fcn.03732d80
pushal
pushal
lea esp, [esp + 0x44]
je 0x37321c0
cmc
mov eax, dword [ebp - 0x104]
clc
shrd ecx, ebp, 0xe
test bx, bx
movzx ecx, bl
mov ecx, dword [eax + 0x30]
jmp 0x37377b5

Function at 0x37386bf
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
lea esp, [esp + 0x24]
jne 0x37341da
adc cx, sp
bswap cx
inc cl
bsf cx, ax
mov ecx, dword [ebp - 0x44]
pushfd
bt bp, bp
bt cx, 9
sub edx, edx
neg dl
ror dl, cl
call fcn.03734afd
push eax
invalid
lea esp, [esp + 0x2c]
jne 0x3739ec8
bswap cx
xchg al, cl
mov eax, dword [ebp - 0x100]
btc ecx, 0x1f
sub cx, 0x75ea
ror cx, cl
mov ecx, dword [eax + 0x30]
cmc
stc
call fcn.0373728e
bt bp, 3
cmp eax, 0x55
jmp 0x3732be7

Function at 0x373871f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jne 0x3736760
mov ax, 0x2085
mov eax, dword [ebp - 0x104]
push edi
mov ecx, dword [eax + 0x30]
clc
test dh, bl
bt dx, bp
bt di, 0xc
sub edx, edx
and dh, bl
btr dx, 0xb
btr dx, 0xe
mov dx, word [ecx + 0x12]
cmc
mov word [esp], 0xecba
cmp edx, 0x64
jmp 0x3738660
Function at 0x373879b
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dx, di
mov edx, dword [ebp - 0xac]
jmp 0x373acde
stc
mov eax, dword [ebp - 0x44]
bt ax, sp
xor ecx, ecx
rcr cl, cl
setge cl
stc
add cl, bh
mov cl, byte [eax + 6]
cmc
call fcn.0373490f
pushfd
lea esp, [esp + 0x38]
jne 0x3734148
call fcn.0373252c
dec eax
mov eax, dword [ebp - 0x104]
sub cx, bp
movsx cx, bl
bts ecx, ecx
mov ecx, dword [eax + 0x30]
clc
pushal
push 0x4fa2c594
bt di, 4
sub edx, edx
not dl
not dl
mov dx, word [ecx + 0x14]
stc
cmp ah, bh
cmp bl, dl
cmp edx, 0x4c
pushfd
call fcn.0373990e
sub eax, eax
xor al, bl
mov al, byte [edx + 5]
pushal
push dword [esp + 0x20]
cmp eax, 0x32
push 0xb0a13bcf
pushfd
lea esp, [esp + 0x34]
je 0x37363ed
bsr ecx, edx
clc
sub cx, 0x8a53
mov cl, al
mov ecx, dword [ebp - 0x44]
stc
cmp ch, bh
pushfd
call fcn.03738d63
sub si, 0x8229
mov dword [ebp - 0x3c], eax
mov dl, 0xf8
inc dx
mov edx, dword [ebp - 0xac]
pushal
stc
sar si, cl
add si, di
add edx, 0x1000103e
xor si, 0xddb6
rol si, 1
or esi, edi
mov dword [edx], eax
btc si, di
cmp cl, 0x16
stc
sar si, cl
mov eax, dword [ebp - 0xac]
neg si
shl esi, 0x17
bsr esi, ebp
test cl, 0xe
add eax, 0x10001012
mov word [esp], 0x854
movsx si, dl
movsx si, al
mov word [esp + 4], di
mov esi, dword [ebp - 0x3c]
pushal
lea esp, [esp + 0x40]
call fcn.028a2480
shld dx, dx, 0xd
lea edx, [ebp + 0x34c3bdf9]
test bh, 0x31
mov dword [ebp - 0x14], eax
test cl, dl
jmp 0x373440a
add edx, 0x1000103a
jmp 0x3735c29

Function at 0x37389ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
xor ecx, ecx
not cl
mov cl, byte [eax + 0xa]
push 0x70466666
cmc
pushal
cmp dl, ch
test ecx, ecx
pushfd
lea esp, [esp + 0x2c]
jne 0x37341da
bt esp, eax
call fcn.037368b2
mov byte [esp + 4], 0xc9
mov word [esp + 8], 0xb118
mov byte [esp], bl
lea esp, [esp + 0x44]
je 0x373c238
lea eax, [edx - 0x119d27bd]
dec ax
mov eax, dword [ebp - 0x44]
cmp dh, cl
jmp 0x3737fe5

Function at 0x3738a42
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.03733afc
cmp edx, 0x74
lea esp, [esp + 4]
jle 0x37321a7
je 0x3736dbc
and eax, ebp
mov eax, dword [ebp - 0x100]
cmp bx, 0xd5df
not ecx
not cl
mov ecx, dword [eax + 0x30]
pushal
clc
sub edx, edx
bsr dx, bx
movsx dx, al
mov dx, word [ecx + 2]
mov word [esp + 8], 0x783a
cmp edx, 0x54
push dword [esp + 4]
pushal
push ebp
lea esp, [esp + 0x48]
jne 0x3739ec8
rcl ax, 5
rcr ch, 6
xadd ax, cx
mov eax, dword [ebp - 0x100]
dec ch
pushal
mov ecx, dword [eax + 0x30]
push 0x8a8b1166
test di, 0x27ec
stc
sub edx, edx
clc
bts dx, si
mov dx, word [ecx + 4]
cmp dl, ah
pushfd
mov byte [esp + 8], ch
clc
cmp edx, 0x64
pushfd
lea esp, [esp + 0x2c]
je 0x37328d1
movzx cx, cl
ror ah, 3
mov eax, dword [ebp - 0x100]
not cx
not ch
and ch, bl
shl cx, cl
mov ecx, dword [eax + 0x30]
cmc
cmp bh, 0x6c
push 0xe3667b44
call fcn.0373664a
Function at 0x3738b23
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xc
mov word [esp + 4], 0xba19
cmp dword [ebp - 0xfc], edx
mov byte [esp + 4], al
lea esp, [esp + 8]
je 0x3734c93
sub eax, esp
aaa
jmp 0x3739e41
mov eax, dword [ebp - 0xfc]
mov ch, dl
sal cx, cl
and dl, 0x2a
xadd dh, ch
mov dword [ebp - 0x104], eax
sal dh, cl
btr ecx, ebp
push esp
pop edx
mov ecx, dword [ebp - 0x104]
mov dh, 0xf1
bswap dx
bsr dx, di
test dh, cl
mov edx, dword [ecx + 0x34]
pushfd
cmp ch, 0x86
and edx, 4
jmp 0x373a6fb
clc
test edx, edx
call fcn.0373558a

Function at 0x3738d63
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x37341da
xor edx, edx
clc
not dl
cmc
mov dl, byte [ecx + 5]
pushal
cmp edx, 0x32
jmp 0x37363e3