joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcdf500
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0xdb0880
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0xdec40c]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
call fcn.00ce5ea0
push 2
xor esi, esi
push esi
push str.VDISKBUS
push 0xdd0784
mov dword [esp + 0x90], esi
call fcn.00ecc1be
mov ebx, 0xff83f88b
push dword [ebp + 0x15]
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0xcdf764
mov edi, dword [esp + 0x30]
jmp 0xcdf74a
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00ce6cd0
mov edx, dword [esp + 0x30]
add esp, 4
push edx
call fcn.00cf7057
add esp, 4
mov eax, dword [esp + 0x20]
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.00cf7057
add esp, 4
xor al, al
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00cf6e12
add esp, 0x70
ret
Function at 0xce9dc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xdb0e86
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], 5
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esp + 0x14], eax
lea eax, [esi + 0x34]
push ecx
push eax
call fcn.00cee4b0
lea edx, [esi + 0x54]
push edx
mov byte [esp + 0x18], 1
call fcn.00cee5a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0xcea060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xdb1b66
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push esi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.00ceea30
mov ecx, dword [esp + 0xb4]
push ecx
lea edx, [esp + 0x30]
xor ebx, ebx
push edx
mov dword [esp + 0xb0], ebx
call fcn.00ce9d30
lea eax, [esp + 0xc]
push eax
mov edx, str.Name
mov byte [esp + 0xac], 1
call fcn.00ced910
mov esi, eax
lea eax, [esp + 0x2c]
call fcn.00ced7a0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], bl
call fcn.00cea1e0
mov ecx, dword [esp + 0xb8]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00ce9d30
lea eax, [esp + 0xc]
push eax
mov edx, str.Version
mov byte [esp + 0xac], 2
call fcn.00ced910
mov esi, eax
lea eax, [esp + 0x2c]
call fcn.00ced7a0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], bl
call fcn.00cea1e0
mov ecx, dword [esp + 0xbc]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00ce9d30
lea eax, [esp + 0xc]
push eax
mov edx, str.Type
mov byte [esp + 0xac], 3
call fcn.00ced910
mov esi, eax
lea eax, [esp + 0x2c]
call fcn.00ced7a0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], bl
call fcn.00cea1e0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x10]
call fcn.00ce9dc0
mov ebx, dword [esp + 0xb0]
lea edx, [esp + 0x2c]
push edx
add ebx, 0x24
mov byte [esp + 0xac], 4
call fcn.00cee880
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 0
call fcn.00cea1e0
lea ecx, [esp + 0xc]
mov dword [esp + 0xa8], 5
call fcn.00cea440
mov eax, dword [esp + 0xc]
push eax
call fcn.00cf7057
add esp, 4
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xa0
ret 0x10
Function at 0xcea1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xdaf24e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], 0
lea ebx, [esi + 0x54]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x1c], 2
call fcn.00cea480
mov ebx, dword [ebx]
push ebx
call fcn.00cf7057
add esp, 4
lea eax, [esi + 0x34]
xor ebx, ebx
push eax
mov byte [esp + 0x20], bl
call fcn.00ce9f00
cmp dword [esi + 0x30], 0x10
jb 0xcea250
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.00cf7057
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x1c], bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0xced580
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xdb0e86
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fldz
xor ebx, ebx
fstp dword [esi + 8]
mov dword [esi], ebx
fldz
mov dword [esi + 4], ebx
fstp qword [esi + 0x10]
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x1c], bl
lea eax, [esi + 0x34]
push eax
mov dword [esp + 0x18], ebx
call fcn.00ceea30
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x18], 1
call fcn.00cee5a0
mov byte [esi + 0x6c], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0xcf0290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0xdb0218
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
movzx eax, byte [0xdf284e]
movzx ecx, byte [0xdf284d]
sub esp, 0x30
mov dword [esp + 0x40], esp
mov esi, esp
push eax
mov eax, dword [esp + 0x78]
push ecx
lea edx, [esp + 0x47]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x68], esp
xor ebx, ebx
push 0xffffffffffffffff
mov byte [esp + 0x6b], bl
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00cd1470
push esi
mov ecx, edi
call fcn.00cf0b70
add esp, 0x2c
lea ecx, [esp + 0x44]
call fcn.00cf0cf0
mov dword [esp + 0x3c], ebx
mov ecx, dword [esp + 0x24]
sub esp, 0x18
mov dword [esp + 0x5c], esp
mov esi, esp
cmp ecx, ebx
jne 0xcf032a
mov dword [esi + 0x10], ebx
jmp 0xcf033f
mov eax, dword [ecx]
lea edx, [esp + 0x2c]
cmp ecx, edx
mov edx, dword [eax]
jne 0xcf0339
push esi
jmp 0xcf033a
push ebx
call edx
mov dword [esi + 0x10], eax
mov esi, dword [edi + 0xe8]
call fcn.00cf1d30
mov dword [esp + 0x3c], 0xffffffff
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
je 0xcf036e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x14]
cmp ecx, edx
setne dl
movzx edx, dl
push edx
call eax
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret 4

Function at 0xcf0f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xdaf4c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 0xf
push eax
mov byte [ecx + 4], al
lea eax, [esp + 0x40]
push eax
call fcn.00cd1470
mov ecx, edi
call fcn.00cf1010
cmp dword [esp + 0x34], 0x10
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x24], ecx
jb 0xcf0fef
mov edx, dword [esp + 0x20]
push edx
call fcn.00cf7057
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x20
Function at 0xcf1a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xdb0ba6
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0xdec40c]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xdec40c]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
lea eax, [esp + 0x38]
push eax
mov esi, ecx
call fcn.00cf14e0
xor eax, eax
mov dword [esp + 0x2b0], eax
xor ecx, ecx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov word [esp + 0x20], cx
mov byte [esp + 0x2b0], 1
mov edi, dword [esi + 0x10]
cmp dword [esi + 0xc], edi
jbe 0xcf1a78
call fcn.00cf8413
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi]
cmp ebx, dword [esi + 0x10]
jbe 0xcf1a87
call fcn.00cf8413
mov eax, dword [esi]
push edi
push ebp
push ebx
push eax
lea edx, [esp + 0x24]
push edx
mov ebx, esi
call fcn.00cf2e80
mov eax, dword [esi + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0xcf1abc
mov ecx, dword [esi + 0x14]
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0xcf1ac8
push 0x96
mov ecx, esi
call fcn.00cf2860
push ebx
push 2
mov dword [esp + 0x7c], 0x22c
call fcn.00d9d1da
mov edi, eax
cmp edi, 0xffffffff
je 0xcf1bd2
lea ecx, [esp + 0x74]
push ecx
push edi
call fcn.00d9d1c8
test eax, eax
je 0xcf1bcb
jmp 0xcf1b00
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], ebx
call fcn.00cdede0
lea ecx, [esp + 0x58]
call fcn.00cdede0
mov edx, dword [esp + 0x7c]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov dword [esp + 0x40], edx
call fcn.00d351c0
lea edx, [esp + 0x44]
push edx
call fcn.00d4bbc0
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, ebx
jbe 0xcf1b50
lea ecx, [esp + 0x3c]
push ecx
push eax
call fcn.00cf25e0
mov edx, dword [esp + 0x7c]
push edx
lea ecx, [esp + 0x20]
call fcn.00cf21a0
add esp, 4
test al, al
je 0xcf1b72
lea ecx, [esp + 0x58]
lea edx, [esp + 0x1c]
call fcn.00cf2310
mov ecx, esi
call fcn.00cf29b0
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov ebx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
jne 0xcf1baa
mov ecx, esi
call fcn.00cf29b0
add eax, 0x32
push eax
mov ecx, esi
call fcn.00cf2860
lea ecx, [esp + 0x38]
push ecx
mov ebx, esi
call fcn.00cf29e0
lea edx, [esp + 0x74]
push edx
push edi
call fcn.00d9d1d4
xor ebx, ebx
test eax, eax
jne 0xcf1b00
push edi
call fcn.00e78cc2
add byte [ebx + 0x834247c], 0x72
or eax, 0x2024448b
cmp dword [esp + 0x34], 8
jb 0xcf1be6
mov eax, dword [esp + 0x20]
push eax
call fcn.00cf7057
add esp, 4
xor ecx, ecx
mov esi, 0x10
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
cmp dword [esp + 0x70], esi
jb 0xcf1c11
mov edx, dword [esp + 0x5c]
push edx
call fcn.00cf7057
add esp, 4
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x54], esi
jb 0xcf1c34
mov eax, dword [esp + 0x40]
push eax
call fcn.00cf7057
add esp, 4
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.00cf6e12
add esp, 0x2a0
ret
Function at 0xd48520
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x58
push 0
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.00cf8e80
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0xd58890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdab5e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp - 0x5c]
call fcn.00d685d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x5c]
add ecx, 4
call fcn.00d624e0
mov eax, dword [ebp - 0x5c]
mov dword [eax], vtable.Poco::ActiveRunnableBase.0
mov ecx, dword [ebp - 0x5c]
mov dword [ecx + 4], vtable.Poco::ActiveRunnableBase.1.0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x5c]
mov dword [edx], vtable.Poco::ActiveRunnable_class_Poco::Void__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____class_Poco::ArchiveCompressor_.1.0
mov eax, dword [ebp - 0x5c]
mov dword [eax + 4], vtable.Poco::ActiveRunnable_class_Poco::Void__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____class_Poco::ArchiveCompressor_.0
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp + 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x5c]
add edx, 0x14
mov dword [ebp - 0x50], edx
push 0
push 0
mov ecx, dword [ebp - 0x50]
call fcn.00cd1550
mov eax, dword [0xdd0e08]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.00cd1470
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x5c]
add edx, 0x30
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
add edx, 4
push edx
push edx
call fcn.00ef7bfa
mov byte [ebp - 4], 3
cmp dword [ebp + 8], 0
jne 0xd5897a
push 0x4d
push str..includePoco_ActiveRunnable.h
push str.pOwner
call fcn.00d50260
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xdf8795
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
call fcn.00e015d1
cmp cl, 0x8a
mov ebx, dword [ebp - 4]
shr si, cl
bswap si
mov esi, dword [ebp - 8]
push ebp
add esp, 8
pushfd
pushfd
pushfd
lea esp, [esp + 0xc]
jmp fcn.00e1f718

Function at 0xe1c57d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x50], edi
movzx di, bl
mov edi, 0xd887d0
call fcn.00eab0d7

Function at 0xe208c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmc
add esp, 0x28
pushfd
pushfd
mov byte [esp + 4], dh
pushal
lea esp, [esp + 0x28]
jmp fcn.00e1f718

Function at 0xe6c852
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x610cfebd
lea esp, [esp + 0x28]
call fcn.00e015d1
jne 0xe68221
shrd bx, bx, 0xc
mov ebx, dword [ebp - 4]
and si, sp
pushal
push ebp
rcl si, cl
mov esi, dword [ebp - 8]
pushfd
mov byte [esp], al
add esp, 0x2c
push 0x15e8a34b
pushfd
pushal
lea esp, [esp + 0x28]
jmp fcn.00e1f718

Function at 0xe70059
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeee0f6
push 0xa3e4a011
pushfd
lea esp, [esp + 8]
jbe 0xe6a36e
pushfd
nop
mov byte [esp], ch
push ebx
pushal
call fcn.00ebd2a5
add ah, byte [ecx + 0x4de07bde]
cli
dec eax
fist dword [eax + 0x4eaf9575]
aam 0xee
test dword [eax], ebp
cmpsd dword [esi], dword es:[edi]
xor ch, byte [edi]
call 0x113846ae
jg 0xe70063
inc ebp
rcr byte [esi - 0x2a13454], 1
nop
add edx, 0xffffffd3
pop esp
mov ch, 0x11
aaa
xor dword [esi + 0x2d], eax
push esi
sub eax, 0xd4fa7e56
je 0xe700a4
jle 0xe700a0
aam 0x74
sti
loop 0xe70100
dec ecx
js 0xe7009d
xchg byte [edi - 0x44e00911], dh
out 0x40, al
mov cs, esi
inc edi
jno 0xe70132
xchg esp, eax
adc eax, 0x3588c7ba
cmp byte [edi - 0x7a81aae], 0xb7
popfd
or al, 0xb7
sbb esp, ebx
test al, 0xe1
je 0xe700a2
lcall 0xf9d6, 0xbfd44f28
mov cl, 0x61
xor al, 0x5e
dec esp
out dx, eax
test al, 0x71
pushal
invalid
outsb dx, byte [esi]
out dx, eax
push ss
cdq
jo 0xe7009d
invalid
punpckhbw mm0, qword [0x1f77c762]
cmp dword [esi - 0x53aa80a5], ecx
xlatb
in eax, 0x63
mov ebp, 0xfd667723
std
sbb eax, 0x3dd34bed
and al, 0x93
push eax
mov edx, 0xfa738825
pop ds
push eax
pop es
loopne 0xe7011f
invalid
nop
pushfd
pushal
push 0x11a153a9
pushfd
xchg dword [esp + 0x28], eax
call fcn.00e9ee8c

Function at 0xe738ff
Capabilities:
Encode data using xor

Disassembly:
not edi
pushal
movsx di, bl
mov di, word [esp]
nop
pop edi
mov edi, dword [esp + 0x1c]
jmp 0xe8ed5a
pushfd
pushfd
mov edi, dword [edi + 0x1d09e8]
mov word [esp], 0x1b0e
lea edi, [edi + 0x631a1d9c]
mov byte [esp], bl
xchg dword [esp + 8], edi
pushfd
push dword [esp + 0xc]
ret 0x10
xchg dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jns 0xecaad1
pushfd
mov byte [esp], bh
mov byte [esp], ah
mov dword [esp], edi
push ebp
mov edi, 0xcda872
jmp 0xe7ddae
pushfd
push 0x9dc875df
mov dword [esp + 4], edi
mov word [esp], 0x5b9d
bswap di
pop edi
mov di, bx
mov edi, 0xcda872
jmp 0xe78e57
Function at 0xe81918
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.00e015d1
ror si, cl
add bx, sp
mov ebx, dword [ebp - 4]
jmp 0xef369f
movzx si, bl
shrd si, si, 8
sub esi, 0x2bd6a7f7
mov esi, dword [ebp - 8]
clc
pushfd
bt edi, ecx
add esp, 8
pushfd
lea esp, [esp + 4]
jmp fcn.00e1f718

Function at 0xe86104
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x3e
lea esp, [esp + 0x54]
jb 0xe6806e
rdtsc
dec dword [esi + 0x28]
xchg bx, dx
mov bx, ax
mov byte [ebp - 1], 1
call fcn.00e6a9c8
jmp 0xe16400

Function at 0xe8dae6
Capabilities:
Encode data using xor

Disassembly:
pushfd
xchg dword [esp + 0x28], ecx
pushfd
mov byte [esp], ch
mov byte [esp + 0x14], 0x6c
push dword [esp + 0x2c]
ret 0x30
push dword [esp]
mov ecx, dword [ecx + 0x171c17]
lea esp, [esp + 0x4c]
jge 0xeaa5e3
lea ecx, [ecx - 0x11ce0a55]
push ebp
pushal
jmp 0xe86cfa

Function at 0xe9ff21
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0xc], ebp
movsx ebp, cl
mov ebp, dword [esp + 0x10]
pushfd
lea ebp, [ebp + 1]
jmp 0xe8f834

Function at 0xea9c16
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, ebx
lea edx, [0xc6bd9fa4]
movzx ax, cl
mov eax, edi
lea edx, [edi - 0x5b00057]
pushfd
movzx dx, dl
mov edx, esi
jmp fcn.00e7d705
sar dx, 2
mov dword [esp + 0x1c], esi
pushal
bswap cx
cmc
mov esi, dword [eax + 1]
neg cx
sub esi, 0x13a5b738
pushfd
neg ch
cmc
xor esi, dword [eax + 0x11]
rdtsc
bswap dx
xchg dword [esp + 0x3c], edi
lea edi, [ebp*2 + 0xfc18f94]
cwde
push 0x4a31557
pop edi
mov edi, dword [ebp + 8]
rdtsc
lea ecx, [ecx*8 + 0x66850e0d]
rdtsc
jmp 0xe8cc7a

Function at 0xeab969
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 8
push ebp
lea esp, [esp + 4]
jmp fcn.00e1f718

Function at 0xeae182
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], ah
nop
pushal
mov word [esp], di
lea esp, [esp + 0x28]
jne 0xea50b6
pushfd
xchg dword [esp + 4], esi
push edi
mov word [esp + 4], 0xff31
pushal
xchg dword [esp + 0x24], esi
movzx si, bl
xchg dword [esp + 0x20], eax
bswap eax
mov eax, 0xcf6186
pop esi
mov si, 0x97e3
mov eax, dword [eax + 0x1bc663]
pop esi
movzx si, dl
lea eax, [eax - 0x183ad53d]
lea esi, [ebp*2 + 0x6f3325cb]
lea esi, [esi - 0x71784fd7]
mov word [esp + 8], cx
movsx si, bl
mov esi, eax
call fcn.00e70f14
call fcn.00e75164
jmp 0xe763bf

Function at 0xeb074f
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bl, 0x7a
add esp, 0x10
push esp
pushfd
push 0xe1eb856c
lea esp, [esp + 0xc]
jmp fcn.00e1f718
Function at 0xeb8072
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x90
lea esp, [esp + 0x38]
jg 0xeb0737
pushfd
lea ecx, [ecx + 0x45ebd82d]
jmp 0xe9032f
jmp 0xec0e8b
push 0x4ac57741
pushfd
pushal
pushfd
lea ecx, [ecx + 0x45ebd82d]
call fcn.00ec6275
lea esp, [esp + 4]
jne 0xee5f48
test ax, dx
clc
cmp ah, cl
cmp word [ebp + 8], bx
pushal
lea esp, [esp + 0x20]
jne 0xe79307
adc al, 0x53
daa
mov eax, dword [ebp + 0x10]
clc
cmc
push 0x5020679f
and eax, 0xfc00
stc
pushfd
stc
cmp eax, 0x800
push esi
call fcn.00e7903d
mov byte [esp], 0x71
mov byte [esp + 4], ch
push 0xd147678
mov dword [esp + 0x38], ecx
lea ecx, [esi + 0x3b8aa6e]
pop ecx
mov ecx, 0xd42739
mov byte [esp], ah
mov word [esp + 0xc], 0x3af5
mov byte [esp + 4], 0x14
pushfd
mov ecx, dword [ecx + 0xd60a1]
jmp 0xe278ad
pushfd
xchg dword [esp + 8], ecx
push ebx
pushfd
push dword [esp + 0x10]
ret 0x14

Function at 0xec69e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0xeb3db9
rcl ah, 3
neg di
rol edi, cl
dec al
mov edi, dword [esi + 0x2c]
not al
mov dword [ebp - 4], 0
add ax, 0xf632
aaa
mov edi, edi
aaa
aam 0x6a
or ax, 0x175
cmp dword [ebp - 4], 0
not ah
pushfd
mov eax, dword [ebp + 0xc]
pushal
push 0xf5966857
pushfd
mov dword [ebp - 8], 0
mov byte [esp + 4], cl
pushfd
push dword [esp + 0xc]
call fcn.00ea5de0
push ebx
push 0xf5b44c38
pushal
bt ax, 2
cmp eax, dword [esi]
pushfd
mov byte [esp + 8], bl
jmp 0xe29097
lea esp, [esp + 0x28]
jns 0xe980d9
clc
cmp eax, dword [esi]
call fcn.00e1f565

Function at 0xee4673
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
stc
add esp, 8
jmp 0xe1ed42

Function at 0xee8b27
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
mov byte [esp], bl
mov byte [esp], bh
pushfd
push 0xbc385ac1
lea esp, [esp + 0x2c]
call fcn.00e015d1
clc
push edi
stc
add esp, 8

Function at 0xef7941
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], ebx
pushal
jmp 0xe78c09
Function at 0xef959f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x20], eax
mov byte [esp + 0xc], dl
movsx ax, dl
mov word [esp], di
mov dword [esp], ebp
mov eax, dword [ebp + 8]
mov word [esp + 8], 0xdd05
push 0x38762dbd
jmp 0xe837a0
mov word [esp + 0x10], 0x4c52
mov dword [ebp - 4], edi
push 0x76d84317
push edi
jmp 0xe8be32
lea esp, [esp + 0x24]
jne 0xeae28d
pushfd
push ebp
mov word [esp], 0x3c30
lea esp, [esp + 8]
js 0xeeb430
push edi
push ecx
call fcn.00e99b4b
xchg dword [esp], ecx
pushfd
pushfd
mov byte [esp + 4], 0x1f
pushfd
push dword [esp + 0xc]
ret 0x10
pushfd
lea esp, [esp + 4]
jne 0xe9f625
movsx ax, al
movsx ax, dl
lea eax, [ebp - 8]
push 0x14e8b45c
mov byte [esp], 0x32
pushal
mov dword [esp + 0x20], eax
bswap ax
setge ah
movsx ax, dl
seto al
mov eax, dword [ebp + 8]
push 0xebd5b555
push dword [esp]
mov dword [ebp - 8], edi
push edi
push edi
jmp 0xe68272
movsx ax, bl
ror al, 3
cmc
xor ebx, ebx
rcl ax, 8
movsx ax, al
rcr eax, 0x12
btr ax, 9
mov eax, dword [ebp - 8]
clc
push 0xddb2876b
test eax, 0xffff0000
push 0xe8331cf4
jmp 0xeccfdd
mov byte [esp + 4], 8
mov dword [ebp - 8], edi
mov byte [esp], bl
jmp 0xe92db6
push dword [esp + 4]
lea esp, [esp + 0x3c]
call fcn.00dfc160
test dh, 0xf7
cmp di, dx
add esp, 4
test ax, 0xad66
stc
cmc
test eax, eax
jmp 0xeb0c09
mov dword [ebp - 4], edi
pushal
push dword [esp + 0x20]
lea esp, [esp + 0x48]
call fcn.00dfc160
cmp eax, ebx
call fcn.00ef0554
lea ecx, [edx*4 + 0x30b68419]
rdtsc
rdtsc
movzx ax, dl
mov ecx, dword [ebp + 0x10]
not al
mov edx, dword [ebp + 0xc]
jmp 0xebd10c
pushfd
mov dword [esp], edi
pushfd
jmp 0xea9b0a
jmp 0xe69e64
lea esp, [esp + 4]
call fcn.00ee45df
btr esi, 0x18
bts esi, 0x14
mov esi, eax
jmp 0xef03d3
clc
clc
stc
cmp esi, dword [ebx]
jmp 0xe6fed4
pushfd
lea esp, [esp + 4]
je 0xe752df
call fcn.00ec74b4
jmp 0xe6c8fc
mov eax, dword [ebp + 8]
jmp fcn.00ef7c1c
inc ax
call fcn.00e6d6b2
pushfd
jmp 0xe168a6
call fcn.00e696f4
lea edx, [edx + 1]
call fcn.00e22a47
cmp byte [ecx], al
mov byte [esp + 4], bl
mov byte [esp], ch
lea esp, [esp + 0x28]
je 0xec8b55
pushal
lea esp, [esp + 0x20]
jmp fcn.00ee8162
jmp 0xea945d
bt bp, di
bt dx, 4
pushal
cmp esi, dword [ebx]
pushal
pushfd
push dword [esp + 4]
mov byte [esp], 0xeb
lea esp, [esp + 0x48]
jne 0xe9f625
pushal
lea eax, [ebp - 8]
jmp 0xecc035
jmp 0xea9702