joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53a5d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x53a638
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0053ab80
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
jmp 0x53a725
cmp edi, esi
jne 0x53a646
mov eax, 0x1001
jmp 0x53a725
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
push edi
mov edx, dword [ebp - 0xc]
add edx, ebx
add edx, 0x28
push edx
call fcn.0053ab80
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add edi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.00537382
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jbe 0x53a6fd
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.00537382
add esp, 8
mov ecx, dword [edi]
xor ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [edi + 4]
xor eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [edi + 8]
xor edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [edi + 0xc]
xor ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x53a6b8
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.0053ab80
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53a72c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x53a790
push dword [ebp + 0x10]
push esi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0053ab80
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
jmp 0x53a8ad
cmp esi, edi
jne 0x53a79e
mov eax, 0x1001
jmp 0x53a8ad
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
push esi
mov edx, dword [ebp - 0xc]
add edx, ebx
add edx, 0x28
push edx
call fcn.0053ab80
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.00537382
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jbe 0x53a884
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.00537382
add esp, 8
mov eax, dword [ebx + 0x18]
xor eax, dword [esi]
mov dword [edi], eax
mov edx, dword [ebx + 0x1c]
xor edx, dword [esi + 4]
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0x20]
xor ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [ebx + 0x24]
xor eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov edx, dword [esi]
mov dword [ebx + 0x18], edx
mov ecx, dword [esi + 4]
mov dword [ebx + 0x1c], ecx
mov eax, dword [esi + 8]
mov dword [ebx + 0x20], eax
mov edx, dword [esi + 0xc]
mov dword [ebx + 0x24], edx
add esi, dword [ebp - 8]
add edi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub dword [ebp + 0x10], ecx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
ja 0x53a828
push dword [ebp + 0x10]
push esi
lea edx, [ebx + 0x28]
push edx
call fcn.0053ab80
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp + 0x10]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53aa84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
lea ecx, [ebx + 0x18]
push ecx
push eax
call fcn.00537382
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x53aabe
mov dl, byte [ebx + eax + 0x28]
xor dl, byte [ebx + eax + 0x18]
mov byte [edi + eax], dl
inc eax
cmp esi, eax
ja 0x53aaae
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x53bf74
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push ebp
push 0x53c0c2
push dword fs:[ecx]
mov dword fs:[ecx], esp
test al, al
jbe 0x53bfda
mov dword [ebx + 0x34], 7
mov dword [ebx + 0x39], edx
mov dword [ebx + 0x3d], edi
mov ecx, dword [ebp + 0x28]
mov dword [ebx + 0x41], ecx
mov cx, word [ebp + 0x18]
mov word [ebx + 0x45], cx
mov cx, word [ebp + 0x14]
mov word [ebx + 0x47], cx
mov dword [ebx + 0x49], esi
mov ecx, esi
mov byte [ebx + 0x4d], cl
mov cl, byte [ebp + 0x24]
mov byte [ebx + 0x4e], cl
mov byte [ebx + 0x4f], al
mov ecx, dword [ebp + 0x20]
mov dword [ebx + 0x50], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebx + 0x54], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edi
mov dx, word [ebp + 0x28]
mov word [ebx + 0x2e], dx
mov dx, word [ebp + 0x24]
mov word [ebx + 0xc], dx
mov edx, dword [ebp + 0x20]
mov dword [ebx + 0x88], edx
mov edx, dword [ebp + 0x1c]
mov dword [ebx + 0x8c], edx
mov edx, dword [ebp + 0x18]
mov dword [ebx + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x60], esi
mov byte [ebx + 0x38], al
mov dword [ebx + 0x24], 0x1e
mov ax, word [ebx + 0x2e]
call fcn.00500f30
mov word [ebx + 0x30], ax
mov ecx, dword [0x54e5a8]
mov ecx, dword [ecx]
xor edx, edx
mov eax, ebx
call fcn.0053c0f8
xor eax, eax
mov dword [ebx + 0x6c], eax
push 0x53c0dc
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x60]
call fcn.00488c28
push dword [ebp - 8]
push 0x53c0e8
lea eax, [ebp - 4]
mov edx, 3
call fcn.00484b04
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x5c]
call fcn.0050213c
mov dword [ebx + 0x70], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov eax, dword [ebx + 0x88]
shl eax, 5
add eax, 0x10
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x8c]
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0xc
mov dword [ebx + 0x68], eax
mov byte [ebx + 0x58], 1
xor eax, eax
mov dword [ebx + 0x78], eax
mov byte [ebx + 0x7c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c0c9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004847a0
ret
Function at 0x53cd78
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00484c2c
xor eax, eax
push ebp
push 0x53ce82
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [edi + 0x30]
mov edx, dword [ebp - 4]
call fcn.004847d0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 8]
call fcn.005020e4
mov esi, eax
mov eax, dword [edi + 0x2c]
call fcn.00483a10
push 0x8c
push 0
push 0
mov ecx, 0x8c
mov dl, 1
mov eax, dword [0x4ea7e4]
call fcn.004eb240
mov dword [edi + 0x2c], eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [edi + 0x10]
call fcn.0053bed8
test esi, esi
je 0x53ce4a
mov eax, dword [esi + 0x24]
sar eax, 1
jns 0x53ce15
adc eax, 0
mov edx, 0x46
sub edx, eax
push edx
mov ax, word [ebp - 8]
push eax
mov ax, word [ebp - 0xc]
push eax
mov eax, dword [esi + 0x20]
sar eax, 1
jns 0x53ce31
adc eax, 0
mov ecx, 0x46
sub ecx, eax
mov edx, esi
mov eax, dword [edi + 0x2c]
call fcn.004eb4e8
mov eax, dword [edi + 0x2c]
call fcn.004ec2c0
mov eax, dword [edi + 0x24]
shl eax, 5
add eax, 0x10
mov dword [edi + 0x14], eax
mov eax, dword [edi + 0x28]
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0xc
mov dword [edi + 0x18], eax
mov byte [edi + 0x1c], bl
mov byte [edi + 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ce89
lea eax, [ebp - 4]
call fcn.0048477c
ret
Function at 0x47fb70
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0047fbef
jae 0x47fb7c
xor ecx, ecx
call fcn.0047fbef
jae 0x47fba6
xor eax, eax
call fcn.0047fbef
jae 0x47fbb7
mov al, 0x10
call fcn.0047fbef
adc al, al
jae 0x47fb98
jne 0x47fbe4
stosb byte es:[edi], al
jmp 0x47fb7d
call fcn.0047fbfb
dec ecx
loop 0x47fbc3
mov eax, ebp
call fcn.0047fbf9
jmp 0x47fbe5
lodsb al, byte [esi]
shr eax, 1
je 0x47fc0b
adc ecx, 2
mov ebp, eax
jmp 0x47fbe5
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0047fbf9
cmp eax, 0x7d00
jae 0x47fbe3
cmp eax, 0x500
jae 0x47fbe4
cmp eax, 0x7f
ja 0x47fbe5
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x47fb7d
pop ebp
ret 8
Function at 0x57e893
Capabilities:
Encode data using xor

Disassembly:
push 0
jmp 0x57dd26
call 0x57dcfb
jmp 0x57e833
call 0x57dd2b
jmp 0x57e864
mov dword [esp + 0x24], eax
jmp 0x57e7e5
jmp 0x57e913
popal
inc dword [esp + 8]
jmp 0x57e8ef
push 0
pushfd
jmp 0x57e826
cmp dword [esp + 4], 0
jne 0x57e7e0
pushal
jmp 0x57dcf6
pop eax
sub eax, 0x9dce33b5
jmp 0x57e881
pop eax
sub eax, 0xde9d0a31
call dword [eax - 0x2164a8a1]
jmp 0x57e899
call 0x57e893
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
adc eax, dword [ecx - reloc.KERNEL32.dll_FreeEnvironmentStringsA]
test eax, eax
jmp 0x57e8d1
call 0x57e8c9
push edx
push ebx
je 0x57e917
popal
insb byte es:[edi], dx
jne 0x57e92a
inc ebp
js 0x57e909
add bl, ch
sal byte [edx], cl
sub eax, 0x1960f3c
je 0x57db86
jne 0x57e8b5
cmp ebx, 0x5e27a8a5
jmp 0x57e8f1
popfd
ret
je 0x57e93d
jne 0x57dd85
sub edi, dword [ebx + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
push ds
imul ecx, dword [eax + reloc.KERNEL32.dll_FreeEnvironmentStringsA], 0xc39d08
add byte [eax], al
add dl, cl
loop 0x57e97f
inc dword [esp + 8]
popfd
ret
rcl byte [esi + 0x31], 0xc0
add eax, 0x74ed7de3
xchg dword [esi], esi
int3
int3
adc byte [edi], cl
mov dh, 0x18
add ebx, 0x5e27a7d9
jmp 0x57e8d9

Function at 0x59706a
Capabilities:
Encrypt data using aes

Disassembly:
xchg bl, bh
lea esp, [esp + 2]
jmp 0x59706c
jmp 0x597052
lea esp, [esp + 0x10]
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
jmp 0x5970d2
lea ebx, reloc.KERNEL32.dll_FreeEnvironmentStringsA
lea edi, [ecx + edx]
mov edi, eax
xor edx, esi
pushal
jmp 0x59709a
movzx edx, byte [eax + 8]
bts ebp, ebx
mov ebp, 0x32bc920c
shl edx, 8
jmp 0x5970b0

Function at 0x597f0f
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
lea esp, [esp + 1]
jmp 0x597fca
cmc
shr edi, 0x18
call fcn.00597f71
invalid
bsr di, cx
sub esp, 0xa
push edx
lea esp, [esp + 2]
mov edi, edx
jmp 0x597f67
mov dword [esi + 4], edi
bsr di, cx
mov di, 0x9c53
inc di
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x597f92

Function at 0x597f71
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push dword [esp]
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x597fa2
pushal
push edx
add esp, 0x19
lea esp, [esp + 3]
and edi, ecx
jmp 0x597fb3
clc
clc
jmp 0x597ff6
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
cmc
call fcn.00597fe0
and ebx, ecx
cmc
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x598033
mov bl, 0x9a
setb bl
lea ebx, [edx + edi]
jmp 0x5992a2
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x59805f
and ebx, ecx
cmc
clc
lea esp, [esp + 0x20]
jmp 0x598075
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
sub esp, 0xa
cmc
add esp, 7
mov word [esp], di
lea esp, [esp + 3]
jmp 0x59808c
movzx ebx, byte [esi + 0xa]
pushal
push word [esp + 0x19]
pop word [esp + 0xf]
jmp 0x598196

Function at 0x597fe0
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x598003
Function at 0x598096
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp + 0x11], ebp
and edx, ecx
jmp 0x59811c
sub esp, 0x1a
stc
lea esp, [esp + 2]
jmp 0x598102
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
sub esp, 0xa
mov edi, dword [esp + 1]
mov dword [esi + 8], edi
sub esp, 0x1c
dec di
jmp 0x5980ea
lea esp, [esp + 0x44]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
mov edx, 0xeb84c022
mov dh, bh
mov edx, dword [esi + 0xc]
jmp 0x59809e

Function at 0x5981ee
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
push edx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.005981b1
jg 0x5981dc
invalid
insd dword es:[edi], dx
hlt
add esp, 3
sub esp, 8
add esp, 4
lea esp, [esp + 1]
jmp 0x5981ce

Function at 0x598296
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jne 0x56a5be
je 0x56a5d5
inc esi
iretd
push edx
pop dword [esp]
pop word [esp]
lea esp, [esp + 2]
jmp 0x59827b
Function at 0x67a9c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
rdtsc
mov dword [esp + 5], ecx
add al, dh
pushal
push dword [esp + 0xa]
jmp 0x67a9cd
xchg word [esp + 9], si
jmp 0x67a9ad
mov dword [esp + 0x11], ebp
xchg byte [esp + 2], dl
push word [esp + 8]
cld
jmp 0x67aa27
xchg byte [esp + 0xc], al
mov al, 0x1e
cpuid
mov byte [esp + 0x19], ah
mov edi, esi
xchg word [esp + 7], dx
jmp 0x67aa78
clc
xchg edi, ebp
mov bx, word [esp + 5]
neg bh
mov ecx, 0x217101c4
lea esp, [esp]
jmp 0x67aac3
mov esi, ecx
mov word [esp + 0x34], dx
pop dword [esp + 0xf]
mov eax, 0x371a3662
mov dh, byte [esp + 0x30]
push dword [esp + 0x28]
jmp 0x67aa5c
mov esi, dword [esp]
lea esp, [esp]
rcl di, cl
mov dx, word [esp]
xchg byte [esp], cl
jmp 0x67ab0e
not ebp
stc
bsf dx, si
lea esp, [esp + 0x34]
mov edi, ecx
xchg ch, dl
jmp 0x67aa92
neg bh
cpuid
mov bl, bh
mov bx, sp
lea ebx, [edi*4]
mov cl, 0x9a
jmp 0x67aaa8
push word [esp]
xchg dword [esp], ebp
bsf cx, ax
mov edx, dword [esp + 1]
mov dword [esp], ebp
push edx
jmp 0x67ae84
bswap ebp
add si, 0x6c36
bswap ebp
btr edx, edx
bsr dx, cx
btc edi, ebx
jmp 0x67aaf5
xchg word [esp], bx
mov word [esp + 0xe], di
sete ah
add esp, 2
jmp 0x67ab6f
mov edx, 0x332d8558
clc
sub bl, ah
lea edi, [esp + ecx]
sub esp, 0x10
jmp 0x67ab2e
pop dword [esp + 2]
mov ax, sp
xchg byte [esp + 4], cl
btc ebp, ebx
cld
xchg dword [esp], esi
jmp 0x67ab44
lea esp, [esp + 7]
mov edx, esi
pop word [esp + 5]
pop word [esp + 1]
cpuid
xchg ah, bl
jmp 0x67abb0
xchg word [esp + 6], ax
setae bh
push edx
lea ebx, [ecx*4]
mov di, word [esp + 7]
mov word [esp + 3], dx
jmp 0x67ab5b
xchg byte [esp], cl
btc ebp, edi
push dword [esp + 4]
xchg dh, al
mov eax, dword [esp + 3]
push dword [esp + 4]
jmp 0x67ac31
lea edx, [eax*4]
bsf dx, si
push dword [esp]
ror ah, 1
mov word [esp + 4], di
inc ecx
jmp 0x67ab94
setae ch
lea ebp, [edi*4]
mov dword [esp + 8], esi
mov si, 0xd601
sub esp, 0x1a
mov edi, 0x74e0bd84
jmp 0x67ae31
mov bh, byte [esp + 0x13]
add esp, 3
sub esi, eax
push dword [esp + 9]
mov si, word [esp + 6]
mov edi, ecx
jmp 0x67abee
mov bx, word [esp + 0xe]
mov cx, word [esp + 6]
neg edx
lea ecx, [edi + ebp]
xchg ecx, ebp
jmp 0x67ac13
stc
pop ax
mov edx, esi
rdtsc
not ah
xchg word [esp + 1], cx
jmp 0x67abd6
mov eax, dword [esp + 3]
setne ah
not ecx
push dword [esp + 2]
rcr eax, 0xf
and cl, bh
jmp 0x67acb5
inc dl
add esp, 0x2b
bsr di, bp
cpuid
xchg word [esp + 1], ax
bsr dx, bp
jmp 0x67ac5c
mov si, 0xee13
popal
sub esp, 0
inc ebx
pushal
lea ecx, [edx + edi]
jmp 0x67ac75
lea edx, [esi + 0xd5]
xchg dx, bx
xchg ah, bl
bsf ax, si
call int.0067accc
cdq
clc
invalid
inc si
lea esp, [esp + 1]
mov dx, word [esp]
mov dx, word [esp + 4]
lea esp, [esp]
xchg byte [esp], al
jmp 0x67ac9e
mov edx, 0x179ca938
cld
bsr si, bp
xchg byte [esp + 0x12], bl
xchg word [esp + 0x28], cx
pop word [esp + 1]
jmp 0x67ac8f
inc cx
cmc
mov eax, dword [esp + 0x28]
mov dx, word [esp + 0x13]
push word [esp + 0x2e]
neg ebx
jmp 0x67ace4
mov al, ah
not di
mov bp, bx
xchg byte [esp + 0x2a], bl
mov dword [esp + 2], esi
mov ah, byte [esp + 0x25]
jmp 0x67ad8c
pop word [esp + 1]
lea edx, [ebx*4]
lea ecx, [eax - 0x61]
neg bx
rcr ah, 1
add bp, 0xc686
jmp 0x67ac49
Function at 0x67b46b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0xf6
bswap eax
mov word [esp + 0x1e], bx
pushal
lea esp, [esp + 0x48]
mov dl, byte [esp]
jmp 0x67b48b
jmp 0x67b453
xchg ah, bl
bswap ecx
sub esp, 2
inc dl
lea ebp, [ecx*4]
cmc
jmp 0x67b5be
mov si, 0xf2ad
stc
cmc
inc si
mov cx, word [esp]
rdtsc
jmp 0x67b46d
mov ax, word [esp]
pop dx
mov ebp, dword [esp]
mov cl, byte [esp]
mov al, 0x4e
and bx, 0x2b72
jmp 0x67b4d2
inc edx
mov ax, 0x11d1
mov di, 0xfc39
rdtsc
cld
xchg word [esp], di
jmp 0x67b4ea
mov bl, bh
xchg word [esp], di
xchg byte [esp], bl
lea eax, [edi*4]
sub esp, 0
inc di
jmp 0x67b506
push word [esp + 5]
mov byte [esp + 1], bh
lea esp, [esp + 0xd]
mov ax, 0xe9e3
mov bp, word [esp + 4]
pop eax
jmp 0x67b555
inc ecx
mov dl, 0xfc
lea ecx, [eax + ebx]
pushal
xchg ch, dl
lea esp, [esp + 0x11]
jmp 0x67b57c

Function at 0x67e94c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 1]
cmc
pop ax
mov cl, 0x12
not dh
bswap ebp
jmp 0x67e98d
setae ch
bswap ebx
mov ax, word [esp]
mov bx, word [esp]
mov cl, ch
pop bx
jmp 0x67e917
btc edx, ebx
rdtsc
mov bx, 0xe89
bswap esi
jmp 0x67e934
lea eax, [ebp*4]
xchg ch, dl
mov bp, 0xbbcb
xchg ebp, ecx
lea ebx, [eax*4]
jmp 0x67ea23
xchg byte [esp + 2], cl
pop cx
mov word [esp], di
inc ebx
xchg word [esp + 1], bp
jmp 0x67e959
push esp
push esp
pop word [esp + 1]
xchg byte [esp + 2], dl
mov ebx, 0xf812d5f8
btc eax, ebx
jmp 0x67e976
push dword [esp + 0xc]
sub esp, 2
push edx
lea esp, [esp + 0x42]
cld
mov edi, ebp
jmp 0x67ea4d
mov word [esp + 0x18], di
cpuid
sub esp, 0x12
bswap ebx
mov di, bx
xchg byte [esp + 0xa], bl
jmp 0x67e9e6
bswap ebp
lea edi, [ecx + ebx]
mov si, word [esp]
xchg byte [esp + 2], cl
sub esp, 0x1e
push edx
jmp 0x67ea03
cpuid
mov cl, 0xd2
mov cl, ch
not ah
mov cl, 0xe2
mov ebx, dword [esp]
jmp 0x67ef32
bswap edi
mov ebx, ecx
neg edi
xchg ecx, edi
lea edi, [ecx*4]
rdtsc
jmp 0x67ea36
bsr cx, cx
bswap edi
mov esi, dword [esp + 8]
xchg word [esp + 4], bx
call fcn.0067ea71
push 0x60b6cfe
mov bl, 0x5a
rol dword [ebx + 0x26], cl
aad 0x7a
rcl byte [edx + ecx*8 - 0x53], 0x5c
ljmp 0x6606
mov ch, byte [esp + 6]
mov word [esp + 0xd], di
push edx
not ch
mov dword [esp + 0xf], ebp
jmp 0x67ea87
pop word [esp + 4]
setl bh
push dword [esp + 1]
mov edx, 0xb5594862
push word [esp]
bsf bp, ax
jmp 0x67eaae
pop word [esp + 0xb]
bsr ax, cx
push word [esp + 0x11]
lea esp, [esp + 0x15]
xchg dword [esp + 3], eax
btc ebp, ebx
jmp 0x67eac5
inc cx
xchg ebp, eax
rdtsc
push word [esp + 0xf]
mov ah, byte [esp + 0x17]
mov di, word [esp + 8]
jmp 0x67eaeb
not edx
xchg bh, cl
cpuid
pushal
lea esi, reloc.KERNEL32.dll_FreeEnvironmentStringsA
xchg byte [esp + 3], dl
jmp 0x67eb67
btr eax, edx
mov edx, dword [esp]
neg ebp
lea ecx, [esi + 0xbd]
cpuid
mov si, dx
jmp 0x67ec0e
Function at 0x67ecbd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
bsr di, cx
bswap esi
mov byte [esp + 1], bh
mov dl, dh
mov bl, 0xe0
jmp 0x67ecc5
btc ebp, ebx
stc
xchg ah, bl
jmp 0x67ec9a
neg ch
bsf cx, si
mov eax, 0x34609a34
neg ah
xchg word [esp + 1], bp
lea ecx, [ebx + ebx]
jmp 0x67ed2d
mov byte [esp + 2], dh
add esp, 0x23
xchg bp, dx
lea esi, [eax - 0xe9]
pop ebx
jmp 0x67ed57
stc
xchg cx, dx
not ebp
pushal
push dword [esp + 0x16]
lea ebp, [edi + edi]
jmp 0x67ecf4
sub esp, 0x1a
xchg dword [esp + 0xa], ecx
bswap ebp
mov dword [esp + 5], ecx
pop esi
mov word [esp], bx
jmp 0x67ed0b
pop dword [esp + 0xa]
mov dx, sp
mov word [esp + 3], di
jmp 0x67ee34
bsr ax, bp
mov dx, bx
mov esi, dword [esp + 3]
mov dword [esp], eax
xchg dx, si
jmp 0x67ed41
btr ebx, edx
setbe bh
mov cl, 0x2a
mov word [esp + 5], sp
xchg word [esp + 5], bp
mov dx, 0x1e2d
jmp 0x67ed7a
lea esi, [eax + edx]
lea esp, [esp + 0xa]
mov al, ah
stc
rdtsc
not ecx
jmp 0x67ed9c
mov si, word [esp + 0xa]
cpuid
setnp ah
cpuid
setge ch
cpuid
jmp 0x67edcf

Function at 0x67f10f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, bh
lea esi, reloc.KERNEL32.dll_FreeEnvironmentStringsA
mov word [esp + 3], sp
rdtsc
jmp 0x67f184
pop bx
mov di, dx
mov word [esp + 0xf], dx
xchg word [esp + 6], ax
mov al, ah
inc cx
jmp 0x67f13c
push word [esp + 9]
push dword [esp]
cld
bsf ax, ax
push word [esp + 0xd]
xchg byte [esp + 0x10], dl
jmp 0x67f165

Function at 0x67f2e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr ah, 1
neg ah
mov bp, word [esp + 5]
popal
inc al
jmp 0x67f233

Function at 0x67f597
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, ecx
xchg ah, bl
mov edi, esi
mov ax, word [esp + 6]
lea edi, [ebx*4]
xchg esi, ecx
jmp 0x67f5a7
rdtsc
lea ebp, [ecx*4]
mov si, word [esp + 4]
jmp 0x67f56c
neg ah
lea esi, reloc.KERNEL32.dll_FreeEnvironmentStringsA
xchg bx, cx
pushal
lea edi, [ecx + edx]
jmp 0x67f5e2
mov dl, 0x2c
mov dword [esp + 0x1b], esi
inc di
mov bx, word [esp + 4]
lea esi, [ecx*4]
pop cx
jmp 0x67f5cc

Function at 0x67f737
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + 0x8b]
mov edi, dword [esp + 7]
pop dword [esp + 2]
xchg ebx, eax
jmp 0x67f77c
push dword [esp + 6]
mov edi, dword [esp + 0xb]
mov word [esp], bx
xchg word [esp + 0xd], ax
pop edi
jmp 0x67f6e8
cpuid
bsf dx, ax
xchg edx, eax
mov word [esp + 4], di
pop di
bswap ecx
jmp 0x67f700
push dword [esp + 6]
jmp 0x67f719
bsf bx, si
mov bh, byte [esp + 3]
mov bx, 0xefd1
lea esi, [esi + edi]
mov ax, bx
jmp 0x67f764