joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d66750e
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [0x6d67158c]
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
push dword [0x6d671598]
mov ebx, eax
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x17c]
or dword [ebp - 0x2c], 0xffffffff
or dword [ebp - 0x28], 0xffffffff
mov edi, eax
call sym.net.dll__ipv6_available_0
mov dword [ebp - 0x30], eax
test ebx, ebx
jne 0x6d66757e
test edi, edi
jne 0x6d667595
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x6d667665
push dword [0x6d671204]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x190]
mov dword [ebp - 0x2c], eax
test edi, edi
je 0x6d6675a8
push dword [0x6d671204]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x190]
mov dword [ebp - 0x28], eax
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
jne 0x6d6675bf
push str.address
push esi
call sub.java.dll__JNU_ThrowNullPointerException_8
jmp 0x6d667665
push dword [0x6d67163c]
mov eax, dword [esi]
push dword [ebp - 0x24]
push esi
call dword [eax + 0x190]
push dword [0x6d671640]
mov eax, dword [esi]
push dword [ebp - 0x24]
push esi
call dword [eax + 0x190]
xor ecx, ecx
inc ecx
cmp eax, 2
jne 0x6d6675fa
cmp dword [ebp - 0x30], ebx
jne 0x6d667601
push str.Protocol_family_not_supported
jmp 0x6d66756e
mov edi, dword [ebp - 0x2c]
cmp eax, ecx
je 0x6d667604
mov edi, dword [ebp - 0x28]
cmp dword [0x6d671220], ebx
je 0x6d66762d
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 0x9800000c
push edi
mov dword [ebp - 0x30], ecx
call dword [sym.imp.ws2_32.dll_WSAIoctl]
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push esi
call fcn.6d66946d
test eax, eax
jne 0x6d667665
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d667665
push str.connect
push esi
call fcn.6d663a00
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
leave
ret 0x10
Function at 0x6d6690b7
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
lea ebp, [esp - 0xbc]
sub esp, 0x13c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0xb8], eax
or dword [ebp - 0x6c], 0xffffffff
push ebx
mov ebx, dword [ebp + 0xcc]
push esi
mov esi, dword [ebp + 0xc4]
push edi
mov edi, dword [ebp + 0xc8]
call sym.net.dll__ipv6_available_0
push edi
mov dword [ebp - 0x70], eax
call fcn.6d666d4c
cmp dword [ebp - 0x70], 0
pop ecx
mov dword [ebp - 0x68], eax
je 0x6d66910d
push edi
call fcn.6d666d78
pop ecx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x68], 0
jge 0x6d669130
cmp dword [ebp - 0x6c], 0
jge 0x6d669130
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
xor eax, eax
jmp 0x6d669282
push 0x10
pop eax
cmp ebx, eax
je 0x6d669271
cmp ebx, 0x1f
je 0x6d669271
cmp ebx, 0xf
jne 0x6d66919d
cmp dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x70], eax
jne 0x6d66915f
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x70], 0x1c
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d66918a
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.6d66946d
add esp, 0xc
jmp 0x6d669129
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.6d66946d
jmp 0x6d669282
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x6d6691b9
push str.Invalid_option
jmp 0x6d66911e
cmp dword [ebp - 0x68], 0xffffffff
jne 0x6d6691d7
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.6d66946d
test eax, eax
jne 0x6d6691af
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
push 4
pop edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], edi
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call fcn.6d66946d
test eax, eax
jns 0x6d669221
call dword [sym.imp.msvcr100.dll__errno]
push dword [eax]
call dword [sym.imp.msvcr100.dll_strerror]
push eax
lea eax, [ebp - 0x48]
push str.error_getting_socket_option:__s_n
push eax
call dword [sym.imp.msvcr100.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
jmp 0x6d66911e
cmp ebx, 3
je 0x6d669266
cmp ebx, edi
je 0x6d669259
cmp ebx, 0x12
je 0x6d66924e
cmp ebx, 0x20
je 0x6d669259
cmp ebx, 0x1000
jle 0x6d669244
cmp ebx, 0x1002
jle 0x6d669266
push str.Socket_option_not_supported_by_TwoStacksPlainDatagramSocketImpl
jmp 0x6d66911e
xor eax, eax
cmp dword [ebp - 0x74], eax
sete al
push eax
jmp 0x6d66925c
push dword [ebp - 0x74]
push esi
call fcn.6d666cde
pop ecx
pop ecx
jmp 0x6d669282
push dword [ebp - 0x74]
push esi
call fcn.6d666c76
jmp 0x6d669262
push ebx
push dword [ebp - 0x6c]
push dword [ebp - 0x68]
push edi
push esi
call fcn.6d668c27
add esp, 0x14
mov ecx, dword [ebp + 0xb8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d66b1da
add ebp, 0xbc
leave
ret 0xc
Function at 0x6d669708
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x128
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push esi
mov esi, dword [sym.imp.ws2_32.dll_select]
xor ecx, ecx
lea edx, [ebp - 0x7c]
push edx
push ecx
push ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0x6c]
lea eax, [edi + 1]
push ecx
push eax
mov byte [ebp - 0x6d], 0
mov dword [ebp - 0x74], 0x10
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], 1
call esi
test eax, eax
jle 0x6d6697bb
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_recvfrom]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
push 2
push 1
lea eax, [ebp - 0x6e]
push eax
push edi
call ebx
cmp eax, 0xffffffff
jne 0x6d6697ba
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x6d6697ba
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
push 0
push 1
lea eax, [ebp - 0x6e]
push eax
push edi
call ebx
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [edi + 1]
push eax
mov byte [ebp - 0x6d], 1
call esi
test eax, eax
jg 0x6d669762
pop ebx
mov ecx, dword [ebp + 0xa8]
mov al, byte [ebp - 0x6d]
xor ecx, ebp
pop esi
call fcn.6d66b1da
add ebp, 0xac
leave
ret

Function at 0x6d6697d4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
push edi
push 2
push 0x17
mov dword [ebp - 8], edi
mov dword [ebp - 4], 1
call dword [sym.imp.ws2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x6d669813
push str.Socket_creation_failed
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push dword [ebp + 8]
call fcn.6d66946d
or eax, 0xffffffff
jmp 0x6d669869
push 4
lea eax, [ebp - 8]
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6d6697fa
push edi
push 1
push esi
call dword [sym.imp.kernel32.dll_SetHandleInformation]
push 4
lea eax, [ebp - 4]
push eax
push 0x20
push 0xffff
push esi
call fcn.6d66946d
push edi
push edi
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x9800000c
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov eax, esi
pop edi
pop esi
leave
ret 0xc
Function at 0x6d6698f3
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call fcn.6d66946d
test eax, eax
jne 0x6d669979
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d669957
push str.connect
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.6d66946d
jmp 0x6d669979
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x28]
push eax
push 0x9800000c
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0x14

Function at 0x6d669988
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push 0x1c
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push 0x9800000c
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.6d66b1da
leave
ret 0xc

Function at 0x6d6699eb
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d669a33
push str.JVM_GetSockName
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.6d66946d
or eax, 0xffffffff
jmp 0x6d669a41
movzx eax, word [ebp - 0x1e]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0xc

Function at 0x6d669a50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d669a97
push str.Error_getting_socket_name
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.6d66946d
xor eax, eax
jmp 0x6d669aa5
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.6d66946d
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d66b1da
leave
ret 0xc
Function at 0x6d669db9
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x7ac]
sub esp, 0x82c
mov eax, dword [0x6d671098]
xor eax, ebp
mov dword [ebp + 0x7a8], eax
cmp byte [ebp + 0x7d4], 0
mov eax, dword [ebp + 0x7c0]
push esi
mov esi, dword [ebp + 0x7b4]
lea ecx, [ebp - 0x74]
push edi
mov edi, dword [ebp + 0x7c8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7cc]
mov dword [ebp - 0x78], 0x1c
mov dword [ebp - 0x7c], ecx
je 0x6d669e11
and dword [ebp - 0x7c], 0
and dword [ebp - 0x78], 0
jmp 0x6d669e30
push 1
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x7d0]
push eax
push esi
call fcn.6d66946d
test eax, eax
jne 0x6d669eb4
push ebx
cmp edi, 0x800
jle 0x6d669e5f
mov eax, 0x10000
cmp edi, eax
jle 0x6d669e44
mov edi, eax
push edi
call dword [sym.imp.msvcr100.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x6d669e62
push str.heap_allocation_failed
push esi
call sub.java.dll__JNU_ThrowOutOfMemoryError_8
jmp 0x6d669eb3
lea ebx, [ebp - 0x58]
mov eax, dword [esi]
push ebx
push edi
push dword [ebp + 0x7c4]
push dword [ebp - 0x80]
push esi
call dword [eax + 0x320]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push 0
push edi
push ebx
push dword [ebp + 0x7bc]
call dword [sym.imp.ws2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x6d669ea3
push str.Datagram_send_failed
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call fcn.6d66946d
cmp edi, 0x800
jle 0x6d669eb3
push ebx
call dword [sym.imp.msvcr100.dll_free]
pop ecx
pop ebx
mov ecx, dword [ebp + 0x7a8]
pop edi
xor ecx, ebp
pop esi
call fcn.6d66b1da
add ebp, 0x7ac
leave
ret 0x24
Function at 0x107a3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.107a31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x107a307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107a306a
add dl, dl
jne 0x107a3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107a30dc
xor eax, eax
add dl, dl
jne 0x107a3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107a317d
add dl, dl
jne 0x107a30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107a30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107a30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107a30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x107a30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x107a3075
mov eax, 1
add dl, dl
jne 0x107a30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107a30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107a30e1
sub eax, ebx
mov ebx, 1
jne 0x107a3128
mov ecx, 1
add dl, dl
jne 0x107a310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x107a3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107a3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x107a3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x107a313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x107a314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107a3136
cmp eax, 0x7d00
jae 0x107a316d
cmp eax, 0x500
jb 0x107a3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x107a3075
cmp eax, 0x7f
ja 0x107a3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x107a3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x107a319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x107a3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x53b709
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
call 0x53b688
lea ecx, [ebp + 0x81]
inc ch
mov edx, 0x8efee63f
jmp 0x53b736
pop word [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x53b748
neg esi
mov ecx, ebp
setne ch
shr dh, 1
ja 0x53b789
jbe 0x53b773
mov bh, 0x27
inc edx
mov cl, 0x7c
cmp al, 0xa8
pop ecx
test al, 0x6c
inc ebp
inc ch
mov edx, 0x8efee63f
pop word [esp]
lea esp, [esp + 2]
jmp 0x53b73e
push esi
mov cl, byte [esp + 3]
jmp 0x53b78e
insd dword es:[edi], dx
fimul dword [esi]
cdq
clc
push esi
mov cl, byte [esp + 3]
ror esi, 0
jmp 0x53bb2f
mov edx, dword [esp]
pushfd
or cx, ax
jmp 0x53b7e2
or cx, ax
sub esp, 0x10
xchg ecx, edx
jmp 0x53b7e7
lea esp, [esp + 0x1c]
inc esi
bswap eax
not edx
setl al
jmp 0x53b807
sub esp, 0x10
xchg ecx, edx
pushfd
xchg word [esp + 4], ax
jmp 0x53b7bf
mov cx, 0x3a13
call fcn.0053b918
loopne 0x53b877
in eax, dx
je 0x53b784
cmp edx, edx
dec esi
fdivr qword [ebx - 0x59a06faa]
rol dword [ebx], 1
jne 0x53b80a
add esi, dword [ebp]
and dl, ah
je 0x53b7ef
mov cx, 0x3a13
jmp 0x53b837
mov ah, 0xac
jmp 0x53b8dc
jns 0x53b797
mov edx, dword [esp]
pushfd
jmp 0x53b7a4

Function at 0x53b7ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
not edx
sub esp, 4
jno 0x53b711
lea ecx, [ebp + 0x81]
jmp 0x53b762
jmp 0x53b727
Function at 0x53dbcc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x34], esi
call 0x53dbb6
Function at 0x5409c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x16
lea eax, [edi + 0x50]
xchg byte [esp + 5], al

Function at 0x540b9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
call 0x540b9c
push 0xffffffffffffff8d
and al, 8
jmp 0x540be7
pop edx
mov word [esp + 6], bp
cmc
jmp 0x540c0b
pop word [esp + 0x12]
pop edx
mov word [esp + 6], bp
cmc
sub esp, 0x16
jmp 0x540bf5
dec bl
sub esp, 0x1c
jbe 0x540bd0
pop word [esp + 0x12]
jmp 0x540bba
lea esp, [esp + 0x2c]
xor bl, 0xd3
mov al, byte [esp]
sub esp, 0x15
jmp 0x540c10
sub esp, 0x16
jmp 0x540bf5
jns 0x540c26
xchg dword [esp + 0x10], edx
mov byte [esp + 8], dl
jmp 0x540c38
xchg dword [esp + 0x10], edx
mov byte [esp + 8], dl
lea esp, [esp + 1]
jmp 0x540c6b
lea esp, [esp + 1]
jmp 0x540c6b
lea edx, [ebx*4]
jmp 0x540d58
mov eax, ebx
stc
jb 0x540c55
lea edx, [ebx*4]
bswap edx
xchg dh, dl
jmp 0x540d5c
bswap edx
xor edx, 0x4b1ebc16
jmp 0x53f587
btr dx, ax
jg 0x540c80
bswap edx
xor edx, 0x4b1ebc16
jmp 0x53f587
bswap edx
xchg dh, dl
shl eax, 2
jmp 0x540c96
jmp 0x5423e7

Function at 0x540cf9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
mov edx, dword [esp + 2]
pop edx
bsr edx, esi
xchg dword [esp], edx
call fcn.00540d41
mov ecx, 0x32c7a032
invalid
Function at 0x541625
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
setae dl
mov dh, 0xb
bswap edx
xchg dword [esp], esi
jmp 0x54160f

Function at 0x5454e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ax, dx
bsr edx, ebp
xor al, ah
mov ax, bp
xchg edx, eax
jmp 0x545528
xchg dword [esp], ecx
xchg dl, ah
setnp al
mov al, cl
push sp
lea esp, [esp + 2]
jmp 0x545575
lea ecx, [ecx - 0x29]
call 0x54553a
mov eax, 0xa4aa7ea3
mov ax, word [esp]
jmp 0x5455bc
jmp 0x54566f
mov eax, dword [edi]
mov dl, bh
setne dh
btr edx, edx
ja 0x5455a6
jbe 0x54566f
add eax, 0x39fc0a35
jmp 0x545bfc
jle 0x54560e
jg 0x54560e
shr ch, cl
jmp 0x54563d
shr ch, cl
push sp
rdtsc
lea esp, [esp + 2]
jmp 0x545619
add edi, 4
bsr dx, sp
jns 0x5455ea
js 0x5455f2
push sp
rdtsc
lea esp, [esp + 2]
jmp 0x545619
mov dword [ecx + esi], eax
mov cx, word [esp]
mov dx, si
xchg dx, cx
sbb ecx, 0x9e550e31
jmp 0x5455e6
jmp 0x545c4f
not dx
mov dh, 0x14
jmp 0x545c34
mov esp, esi
mov dh, ah
mov dl, byte [esp]
dec dl
js 0x545c8a
btr dx, cx
jmp 0x545c73
stc
jbe 0x545c28
not dx
mov dh, 0x14
jmp 0x545c34
btr dx, cx
push eax
ret
jmp 0x545c6f

Function at 0x5460d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dx
jns 0x5456e7
js 0x545707
lea esp, [esp + 4]
dec al
mov edx, dword [esp]
mov dl, 0x3c
bsf edx, eax
jmp 0x545775
jbe 0x5457a4
mov edx, 0xfda58095
cmc
jmp 0x54575a
mov edx, 0xfda58095
cmc
lea edx, reloc.KERNEL32.dll_RaiseException
xor al, 0x4d
lea edx, [ebp - 0x7e]
lea edx, [ebp*4]
jmp 0x545814
lea edx, [ecx - 0x9f]
ror dx, cl
add al, 0x1d
mov edx, dword [esp]
mov dl, 0x72
mov dh, byte [esp]
call fcn.00545867
call 0x54580e
jmp 0x5460aa
not edx
inc dx
jp 0x5457f1
lea edx, [ecx - 0x9f]
jmp 0x545826
ror dx, cl
jmp 0x5457fa
cmp dword [esp + 4], 0
jmp 0x5460c0
jmp 0x546136
pop eax
sub eax, 0x65c73767
jmp 0x5460c8
jne 0x546094
pushal
jmp 0x545809
call 0x5460d8
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
sub edx, dword [ebp - 0x2c]
dec edx
sub eax, 0x41c568dc
sal dword [eax + reloc.KERNEL32.dll_RaiseException], 1
add byte [eax], al
add byte [eax], al
pushfd
jmp 0x54607b
inc dword [esp + 8]
jmp 0x54617b
popfd
ret 4

Function at 0x54b7f6
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x5305b6
pushfd
or dword [esp], reloc.KERNEL32.dll_RaiseException
popfd
cpuid
nop
jmp 0x5305cd
pop ebx
ret
jmp 0x5305aa
Function at 0x553b89
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x554312
xchg bl, dh
jmp 0x553c03
xchg bl, dh
cmc
jmp 0x553c04
add esp, 0
jge 0x553b66
jl 0x554312
popal
lea eax, [eax + edx]
add al, 0x10
lea edx, [ebx*4]
bsr dx, di
jbe 0x553be1
ja 0x553be1
clc
jle 0x553b96
mov eax, dword [esi - reloc.KERNEL32.dll_RaiseException]
cmpsb byte [esi], byte es:[edi]
push ebp
xchg edi, eax
push eax
aam 0x4a
sub eax, 0x80c163dc
inc ebx
not dx
mov edx, esi
mov eax, dword [esp]
pushal
mov dword [esp + 0x10], edi
jmp 0x553b94
lea edx, [edi + 0x40]
mov eax, dword [esp]
pushfd
xchg dword [esp], eax
jmp 0x553be3
jmp 0x553bcb
sub edx, ebx
lea eax, [esp + edx]
mov ah, byte [esp]
lea eax, [esi - 0x80]
jmp 0x554258
push es
add byte [eax], al
and dword [ecx + reloc.KERNEL32.dll_RaiseException], ebp
inc ecx
retf 0x3f58
cmc
cmp esi, eax
ja fcn.00541e5a
jbe 0x553bbc
mov byte [esp], ah
jmp 0x553c4a
lea edi, [eax + edx - 0x40]
jmp 0x553c53
lea esp, [esp + 1]
mov esp, eax
pushfd
jmp 0x553c34
push esi
push edi
push ecx
jmp 0x553c5c
pushal
call 0x553c63
jbe 0x553bef
test dword [ecx - reloc.KERNEL32.dll_RaiseException], 0x61042464
jmp 0x553c98
rep movsb byte es:[edi], byte [esi]
pop ecx
jmp 0x553c9f
mov edi, eax
mov ecx, edx
cld
jmp 0x553c80
mov edi, dword [esp]
lea esp, [esp + 4]
pop esi
jmp 0x554057
popfd
jmp 0x541519
and al, 0xfc
call fcn.00553cc9
sub esi, 2
clc
jge 0x554277
lea eax, [ecx + ebx]
mov ax, sp
mov ax, si
jmp 0x554286
lea eax, [ecx + ebx]
jmp 0x554280
mov ax, sp
mov ax, si
xchg edx, ecx
jmp 0x5542dc
mov dword [esi + 4], ebx
mov bx, dx
lea ebx, [edx*4]
jmp 0x5542ed
not eax
xchg edx, ecx
mov ax, word [esp]
sete ah
not ah
jmp 0x5542aa
mov eax, 0x9bca6bc1
mov al, dl
mov ah, byte [esp]
shl ebx, cl
mov al, byte [esp]
jmp 0x5542c0
pushfd
pop dword [esi]
push si
mov bh, 0xc0
jmp 0x5542fb
xchg dx, ax
call fcn.0055500c
xchg byte [0xa417e49d], cl
adc byte [esi + 0x14a66b0c], bl
outsd dx, dword [esi]
jbe 0x554372
mov al, byte [0x5150478d]
lea eax, [edi + 0x50]
push ecx
push dword [esp + 3]
jae 0x553b6b
jb 0x553b73
call fcn.005544c2
push edi
xchg edi, edx
lea eax, [edx + edx]
mov dh, ch
push ecx
jmp 0x55445b
jns 0x554348
cmc
jge 0x5543aa
setae dl
mov al, byte [esp]
bts si, di
jmp 0x5543c8
neg ah
jmp 0x5543ef
bts si, di
jmp 0x5543c8
setae dl
mov al, byte [esp]
jmp 0x554394
mov ecx, eax
and ax, cx
mov edi, dword [esp]
stc
xchg dx, cx
lea esp, [esp + 4]
jmp 0x55446a
btr eax, esp
je 0x5543b2
mov ecx, eax
jmp 0x55441b
xchg dx, cx
call fcn.00554401
int 0x5f
iretd
cmp ax, ax
neg ah
push esi
lea eax, reloc.KERNEL32.dll_RaiseException
sete bh
cpuid
jmp 0x554374
and ax, cx
mov edi, dword [esp]
stc
jmp 0x5543d1
bswap edx
sub esp, 0xc
jns 0x5543ea
cmp ax, ax
jmp 0x554390
mov cx, word [esp]
mov si, word [esp]
rdtsc
jmp 0x5544a3
pop ebx
mov dl, 0x76
jmp 0x5544aa
add esp, 0xc
jg 0x55448d
jle 0x55448d
pushal
mov dword [esp + 0xd], ecx
mov si, cx
jmp 0x554630
pop esi
jmp 0x543540
add esp, 0x20
jp 0x5545db
jnp 0x5545db

Function at 0x57586a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x24]
popal
jmp 0x5758a0
add ecx, 0xfffffffe
movzx ebx, byte [ecx]
pop ecx
cmc
jmp 0x57588a
Function at 0x61b994
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0061b0fa
jmp 0x61b9c6
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x61bbf9
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x61b0f5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x61ba3b