joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eea62
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
call edi
mov esi, dword [esi + 8]
jmp 0x5066eb
push esi
mov esi, ecx
xor eax, eax
push edi
sal di, 0xfb
and edi, 0x6d122dbc
xor di, 0x345
mov ecx, dword [esi + 4]
mov edi, dword [0x100e10ec]
test dh, dh
cmp bx, 0x1c30
cmp ecx, dword [esi + 8]
jmp 0x53f3e0
test esi, esi
je 0x6993b7
push dword [esp + 0xc]
jmp 0x61111b
je 0x4eb4ab
push dword [esp + 0xc]
jmp 0x4eb4a8
mov byte [0x9000028c], al
nop
cbw
nop
bt eax, 0x5c
or ah, 0x39
rdtsc
test esi, eax
cmp eax, ecx
jmp 0x61887c
jne 0x61112b
nop
rcr dword [ecx + edx*8], 1
xor eax, 0xb1554b38
outsd dx, dword [esi]
aaa
loopne 0x699403
ret
mov ch, 0x27
adc al, byte [edx + 0x78]
pop ebp
cmpsb byte es:[esi], byte es:[edi]
cmp edi, dword [ebx + 0x44]
arpl word [edi - 0x35], di
sbb eax, 0x53f2073
xor eax, 0xb7373ef2
call [eax]
mov eax, dword [esi]
sti
pop ss
sbb al, 0xa9
cld
sub ecx, dword [edx + ebp*8 + 0x7a4e0150]
scasd eax, dword es:[edi]
push ds
add ch, byte [edi + 0xb4705ae]
loopne 0x6994af
adc al, 0x12
mov ecx, 0x100ec7e1
int 0x78
adc byte [ecx - 0x42], bl
das
mov eax, 0x5eed3a3b
clc
sbb al, 0x51
add dword [ecx], edi
mov esp, dword [edi - 0x16594489]
not dword [edx + ecx*2 - 0x1a4b6765]
mov ah, 0xe5
dec eax
push esi
xor byte [edi + 0x53], bl
sbb dh, ah
adc ch, ch
push ss
pop ds
je 0x699458
out dx, eax
into
into
jmp 0x41927bbd
mov ch, 0xe6
invalid
invalid
pushal
popfd
aas
jecxz 0x699499
mov dl, 0x28
jp 0x699461
sub esi, esp
je 0x69951a
wait
jmp 0x6994fc
jne 0x6994a8
xor ah, byte cs:[ebx + 0x516bba01]
dec edx
daa
push eax
sub esi, esi
jle 0x69949e
inc edi
jnp 0x6994a8
xchg edi, eax
setno byte [ecx - 0x13]
inc eax
out dx, eax
adc byte [bp + di - 0x449c], ah
in al, 0xd1
xor byte [edx + ebx*8], dh
or edx, esi
mov ebx, 0x3430d1e4
fimul dword [ebx]
salc
ljmp 0x4eb4:0x6aea83b4
Function at 0x4f57e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x4f18dc
push 0xfffffffffffffff0
call dword [0x100e14bc]
cmp ax, 0xffff
jmp 0x497f96
jmp 0x5417c5
call dword [0x100e14c8]
mov edi, dword [0x100e15d0]
jmp 0x4fa795
push 2
jmp 0x521611
push ebp
mov ebp, esp
cmp bl, 0xfb
sub esp, 0x10
cbw
movzx eax, cx
push esi
not ah
mov ax, 0x497b
lea eax, [ebp + 0xc]
jmp 0x50a2ae
lodsd eax, dword [esi]
dec edx
add dword [eax], eax
push 5
jmp 0x52ec7b
push dword [ebp + 8]
jmp 0x4e9f66
sub eax, eax
movzx edi, bx
pop edi
jmp 0x51c3d4
push edi
push eax
jmp 0x4fe2d0
ret 0xc
pop esi
leave
jmp 0x51af95
push esi
jmp 0x4e399f
push dword [ebp + 8]
jmp 0x5417c5
call edi
mov esi, eax
test ebx, 0x69b44756
test esi, esi
je 0x5097d2
push esi
jmp 0x4cf1e5

Function at 0x4f89b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, eax
add dword [edx], eax
add byte [eax + 0x14790ee9], al
add byte [edi], cl
xchg bh, ah
add eax, 0xe88b0016
jmp 0x658fa8
xor byte [eax], cl
jmp 0x4bba4a

Function at 0x505370
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x4ebdd0
cmp byte [ebx], 0xa
jmp 0x506703
mov dword [ebp - 8], ecx
jmp 0x4e05ba
jae 0x69a3c6
cmp eax, ecx
jmp 0x4989d5
and al, 0xfb
cmc
mov byte [ecx], al
cmp cl, 0x48
neg ax
shl ch, cl
mov eax, dword [ebp + 0xc]
movzx cx, dl
movzx ecx, bp
mov ecx, dword [ebp - 8]
test sp, 0x1cb3
mov dword [ebp + 0x10], eax
lea ecx, [ecx + eax]
jmp 0x4e72e8
cmc
neg ch
lea ecx, [eax + esi + 4]
test esi, esp
mov al, byte [eax + esi + 4]
test bh, 0x8c
test al, 0x80
jmp 0x5213f9
jne 0x4ebdd0
or al, 4
jmp 0x4ebdd3
invalid
invalid
je 0x69a3d2
test edx, edx
jmp 0x474a46
cmp al, 0x21
xor dword [ebp - 0x68], ecx
fisub word [esi + ebx*4 - 0x7f]
xor eax, 0x8efdbc04
adc ch, byte [edi + 0x41029078]
mov word [ecx - 0xc319a1], cs
js 0x69a364
add al, byte [ecx - 0x74]
mov dword [edi - 0x1a], ebx
cmp al, 0xff
dec esp
cwde
call 0x2be09f4a
Function at 0x515afb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 4]
jmp 0x627b89
add eax, 0xba0f7292
clc
mov edi, 0x310f9090

Function at 0x517400
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
cmc
cmp edi, edi
test dh, 0xf6
sub esp, 0x18
jmp 0x6079ea
and eax, 0x5055ffff
mov ecx, esi
call fcn.005d824c
mov edi, eax
mov cx, bp
mov ecx, 0x53555b5
not cx
mov ecx, dword [esp + 0x18]
push ecx
bswap cx
mov ecx, esi
call fcn.00612210
mov ecx, esi
jmp 0x4976ea

Function at 0x524b6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add al, byte [ebx - 0x397c003d]
add dword [ebx + 0x404f01c5], eax
mov ebx, dword [ebp - 4]
jmp 0x4d45f4
pop esp
add al, byte [eax]
add cl, ch
fdivr st(7)
adc eax, 0x38ae900
add eax, 0x451fe900
adc eax, 0x24a48d00
aam 0xfb
invalid
push 0x101689f8
jmp 0x6121ee
push dword [ebp + 8]
jmp 0x500b41
jne 0x609f0a
push dword [ebp + 0x18]
jmp 0x533168
sub al, 0xe9
out 0x6a, eax
idiv edi
push dword [ecx + 0x1c]
jmp 0x60f5f1
push dword [ebp + 0xc]
jmp 0x4e648a
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x38]
test eax, eax
jmp 0x4f4ee9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
jmp 0x506dcd
je 0x6482ef
mov edx, dword [esp + 0x20]
mov ah, bh
mov eax, edi
cmp edx, 0x170254a3
movsx cx, bl
sub eax, esi
ror ch, 0xb2
sub ch, dh
cmp bp, 0x5dfc
mov ecx, edi
sub ecx, eax
test bx, ax
cmp bp, 0x55dd
push 1
jmp 0x4cb9ed
dec dword [ebx - 0x74dbdbbc]
push esp
and al, 0x1c
ror si, 0xd3
cmc
and esi, 0x14bf4786
mov esi, eax
cmp ebp, 0x6581c51
sub esi, edx
cmp edi, eax
jmp 0x5e35a3
shld ax, dx, 0xc0
cwde
rol eax, cl
lea eax, [esp + 0x10]
shl ecx, 8
clc
test di, 0x3f5a
cmp eax, esi
push eax
add ecx, edx
push edi
push esi
jmp 0x4a7914
and ecx, 3
btr ebx, 0xa9
sar bl, cl
xor eax, eax
rep movsb byte es:[edi], byte [esi]
cmovnp bx, dx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
bswap edi
jmp 0x65a6e8
sub edi, esi
jmp 0x4fc79c
mov esp, ebp
jmp 0x4cd93b
pop edi
cmovo ebx, esi
mov ebx, 0x2da343ea
pop esi
pop ebx
jmp 0x64e340

Function at 0x527ff2
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov byte [ecx - 0x54d3710a], 0x41
jmp 0x666c9d
add al, 0x66
neg edi
cmp sp, 0xf84
mov esi, dword [ebx]
and edi, edi
shl ecx, 2
adc edi, ebx
sbb edi, 0x36731b2
sbb di, bx
mov dword [esp + 0x18], eax
sub edi, ebp
sal di, 0x98
mov edi, eax
mov eax, ecx
stc
shr ecx, 2
jmp 0x4c2599

Function at 0x528574
Capabilities:
Execute anti-debugging instructions

Disassembly:
bound eax, qword [eax - 0xd8a6b8d]
jmp 0x60e8c1
mov dword [esp + 0x10], eax
jmp 0x49fb83
jmp 0x623d8b
inc eax
cmc
cmp eax, ebp
jmp 0x5f43ff
call fcn.0061cdde
mov edi, eax
bswap eax
mov eax, dword [esp + 0x10]
jmp 0x61defd

Function at 0x529cea
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5316bb
push esi
mov esi, ecx
jmp 0x60ac33
out 0xff, eax
add byte [eax], al
add byte [ebp + 0xbd04], cl
add byte [eax], al
jmp 0x642735
push eax
jmp fcn.00650abd
Function at 0x52eb6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x6138f2
push esi
mov esi, ecx
jmp 0x50d672
out dx, al
mov ch, 0
add byte [edi], cl
mov word [ecx + 0xf000201], ds
invalid

Function at 0x5314b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sal dl, cl
lea esp, [esp - 8]
btc eax, 0x6f
mov eax, dword [ebp + 0x10]
setno dl
push ebx
add dl, 0x47
rol dl, cl
push esi
rcl esi, 0x4b
push edi
mov cl, byte [eax + 0x100]
rcr esi, 0xfe
mov dl, byte [eax + 0x101]
sal edi, 0x49
shld esi, edx, 0xa5
dec edi
mov dword [ebp - 8], eax
or di, 0xdad
test di, sp
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
bswap cx
or di, dx
sar cl, 0x90
xor ebx, ebx
mov bl, byte [ebp - 1]
sub edx, edx
bts ecx, edi
mov dl, byte [ebp - 2]
and edi, 0x4b447731
mov esi, dword [ebp - 8]
cmc
mov edi, dword [ebp + 8]
shrd ecx, edx, 0xaf
sal cx, 0xe4
sub eax, eax
and ecx, ebp
shl ch, cl
or ch, bh
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jmp 0x65540a
pop ebx
add ah, byte [esi - 0x57]
aam 0x69
add esi, 0x20
cmp esp, edx
test bp, 0x618f
cmp edi, eax
jmp 0x49caca
Function at 0x549fc7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ebda
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x45aee4
push 0x45aef0
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x40], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov byte [ebp - 0x3c], 0x4b
mov byte [ebp - 0x3b], 0x45
mov byte [ebp - 0x3a], 0x52
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x4c
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x6c
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x75
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x20], eax
push 0x45af00
push 0x45af10
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x24], eax
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
nop
nop
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x54a0d3
mov dword [ebp - 0x48], 0x44
push 0x410070
lea ecx, [ebp - 0x48]
push ecx
call fcn.0054ab27
jmp 0x54a1af
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5cee06
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, dword [0x20c30bce]
salc
cmpsb byte [esi], byte es:[edi]
bound ebp, qword [0x7d4239aa]
in eax, dx
rcl eax, 0x81
aaa
pushal
ret
jmp 0x2124104
adc al, 0
mov byte [esi + 0x162], 1
jmp 0x63fd8c
push esi
mov esi, ecx
mov eax, dword [esi]
shl cx, 5
not cl
movzx ecx, bx
lea ecx, [eax - 0xc]
stc
cmp ecx, dword [0x101813e0]
je 0x43f282
add eax, 0xfffffff4
jmp 0x665766
mov ecx, dword [eax + 0x14]
call dword [ecx + 0x10]
add esp, 8
bts eax, eax
pop edi
xor al, ch
pop esi
xchg bx, bx
pop ebp
btc ax, 0x91
xadd al, bl
neg ebx
mov eax, 1
bsr ebx, esp
btc ebx, 0x99
pop ebx
test esi, 0x6a2c4ea6
add esp, 0x10
jmp 0x4abd29
mov dword [ebx + 4], esi
jle 0x607c2d
mov eax, dword [esp + 0x24]
push ebp
xchg ch, cl
mov cx, sp
push eax
movzx ecx, ax
jmp 0x607c21
test ebp, ebp
mov dword [ebx], edi
jmp 0x608b20
jmp 0x617b8d
and eax, 0x88f8ffe0
test dword [eax], ebp
add dword [eax], eax
add cl, al
in eax, 0x42
mov ebp, dword [esp + 0x18]
test bp, 0x1858
stc
add esp, 8
jmp 0x61fb75
push eax
jmp 0x50062e
Function at 0x5ed62e
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
in al, dx
sbb al, 0
cmp eax, esi
je 0x4e33ca
cmp edi, esi
jmp 0x4e33b2
push dword [ebp + 0xc]
call fcn.005348e5
test eax, eax
jmp 0x60e6ad
je 0x4e33bd
mov esi, dword [edi + 0x1c]
xchg edi, edi
mov dword [ebx + 0x20], esi
mov ebx, 0x5ef17ba3
add byte [edi], cl
test dword [ecx - 0x740000c2], ecx
cmp eax, 0x100e13ac
jmp 0x4e99b7
push ebp
push ebp
jmp 0x539ec2
invalid
sub ebp, ebp
jmp 0x4e6e4c
je 0x536b38
cmp eax, 2
jne 0x60e6b3
push eax
jmp 0x4ddd19
push 0x19f
jmp 0x5468fd
push dword [esi + 0x1c]
jmp 0x699503
push 0xffffffffffffffff
rol ax, cl
btr eax, 4
push 0x100de3a1
test bx, 0x4009
or ah, dl
shl ax, cl
mov eax, dword fs:[0]
cmc
test di, bp
clc
push eax
bts ax, di
or al, dh
shr al, 0x44
mov dword fs:[0], esp
xchg al, al
and ax, 0x2c3e
sub esp, 0x88
sub ax, bp
push ebx
neg al
xchg al, ah
bts eax, ecx
push ebp
push esi
mov esi, ecx
mov ax, si
xor bp, 0x1fc3
mov eax, dword [esi + 0x60]
and bp, bx
mov ebp, dword [esi + 0x74]
stc
cmp eax, 0xc
mov dword [esp + 0xc], ebp
jne 0x62f674
test ebp, ebp
jle 0x4f32e4
mov eax, ebp
cmc
test si, sp
jmp 0x65fed6
mov edi, 0xdf8b66fc
mov ecx, dword [ebp - 0xc]
movsx edi, dx
jmp 0x611fed
dec ebp
hlt
mov dword fs:[0], ecx
pop edi
mov bl, 0x7a
pop esi
jmp 0x4af788
mov eax, dword [esi + 0x7c]
jmp 0x4e440d
test eax, eax
jmp 0x4c1e5f
imul edx, dword [ecx + 0x67], 0x4a

Function at 0x5ee9e1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x60045411
clc
jmp 0x626326
mov ecx, dword [esi + 0x248]
cmp cx, bp
test ecx, ecx
jne 0x645d70
sub edx, edx
jmp 0x63cb18
push ebp
btc cx, 0x9b
sal cl, cl
not al
mov ebp, esp
ror ch, 0x55
push esi
rcr cx, 0xd
sal cl, cl
rol cx, 0xed
mov esi, 0xf
lea ecx, [ebp + 8]
ror ax, 0xa0
xor al, 0xcf
lea ecx, [ecx + esi*8 - 4]
sar eax, cl
xadd eax, eax
setb ah
mov eax, dword [ecx + 4]
clc
test eax, eax
jmp 0x5f2a62
je 0x6480e1
push dword [ecx]
jmp 0x6480e1
stosd dword es:[edi], eax
pop ds
in eax, dx
inc esi
inc esp
and al, 0x10
adc ecx, ebp
inc edx
stosd dword es:[edi], eax
invalid
jne 0x63cb26
mov esi, ecx
cmp esi, 0x700a137d
test ebp, ebp
jmp 0x4fd467
call 0x914e4d99
cmp al, 0xfe
call dword [edi + 0x56]
jmp 0x4b2db7
test dword [ecx], ebp
jge 0x645d59
dec dword [ebx - 0x56dbdbbc]
scasb al, byte es:[edi]
jg 0x645d96
jae 0x54d9e45
ljmp 0x748b:0xf38b66ff
sti
dec dword [ebx - 0x54f0f7a9]
invalid
dec esi
stc
test ch, al
cmp ecx, 0x4c82d45
lea ecx, [ecx - 8]
cmc
test esi, esi
jne 0x5eea15
call dword [ebp + 8]
pop esi
jmp 0x50d273

Function at 0x5ef34c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lds esp, [esi - 0x68]
push esi
mov esi, ecx
rcl ax, 0x1d
bsr ax, si
mov ecx, dword [esp + 8]
rcr eax, cl
rcl ax, cl
bswap eax
mov eax, dword [esi + 0xd0]
lea eax, [eax + ecx]
stc
cmp ebp, 0x21666714
cmp eax, 0xc8
jmp 0x4e6330

Function at 0x5fa8e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
out dx, al
mov edx, dword [esp + 8]
jmp 0x4b48b9
mov eax, dword [esp + 4]
test dword [eax + 0x78], 0x400000
je 0x5eb0a7
mov ecx, dword [esp + 8]
jmp 0x4acadb
Function at 0x5fbc31
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [eax]
leave
jmp 0x4c87da
push ebp
mov ebp, esp
cwde
mov eax, dword [ebp + 8]
jmp 0x5ed230

Function at 0x5fc150
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal dword [ebp - 0x16], 0x90
fld qword [0x101619c8]
jmp 0x4c6ffa

Function at 0x602d13
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and ah, al
push 0xffffffffffffffff
push 0x100df650
btr eax, edx
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
lea esp, [esp - 0x24]
stc
cmp si, bp
cmc
push ebx
not bh
setp bl
bsr bx, si
mov ebx, ecx
movzx cx, bh

Function at 0x60be02
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
bts bp, cx
mov ebp, esp
sub esp, 0x34
jmp 0x62d99f
mov dword [ebp - 4], 0

Function at 0x610f24
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov edx, 0x80
adc esi, ecx
mov eax, dword [esp + 4]
sub esp, 8
test ch, 0xa9
test eax, eax
jbe 0x6180f2
cmp eax, 0xffff
jmp fcn.00464371
add esp, 8
jmp 0x5036c4

Function at 0x61264a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
out 8, eax
test si, 0x5d47
cmp esp, 0x50e73bdf
cmc
add edi, ebp
cmp ah, dh
cmc
add esi, 2
jmp 0x65adb4
mov word [eax + 8], di
mov eax, dword [esp + 0x1c]
jmp 0x4b21ad

Function at 0x616749
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub dword [ecx], edx
sub byte [ecx + 0x51595702], bh
push ebp
mov ebp, esp
push 0xffffffffffffffff
stc
setge al
push 0x100ddc60
clc
mov eax, dword fs:[0]
cmp ah, ch
stc
push eax
bts eax, esi
test edi, 0x57ab633f
sub eax, edi
mov dword fs:[0], esp
and al, 0xb8
lea esp, [esp - 0x4c]
bswap ax
mov eax, dword [ecx + 0xc4]
push ebx
clc
test bh, 0x34
push esi
cmp al, 0xec
cmc
cmp eax, 2
jmp 0x4a3d87

Function at 0x6167bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
push ebp
not bp
mov ebp, esp
mov bp, 0x15c7
add byte [ebx + 0x55c35de5], cl
sub bp, di
mov ebp, esp
test sp, 0x79e9
sub ebp, ebp
cmp esi, edi
jmp 0x4a9bea

Function at 0x61cdde
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword fs:[0]
cmp dx, cx
push 0xffffffffffffffff
stc
push 0x100def58
cmp esi, 0x6de9346d
push eax
mov dword fs:[0], esp
lea esp, [esp - 0x34]
push esi
movzx esi, ax
and esi, 0x58c50352
cmovl esi, ebp
mov esi, ecx
inc cx
mov ecx, dword [0x10191fc8]
cmc
push edi
jmp 0x620c4e
sub edi, edi
stc
cmp sp, bp
cmp ecx, edi
jmp 0x4b84fc

Function at 0x624238
Capabilities:
Execute anti-debugging instructions

Disassembly:
call dword [0x100e1298]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x63da40
mov edx, dword [ebp + 8]
jmp 0x4ac4bf
push ecx
jmp 0x602260
push ebp
mov ebp, esp
push ecx
movzx ax, ch
bswap ecx
mov eax, dword [ebp + 8]
setae ch
xchg ecx, ecx
push eax
setne ch
push 0
movsx ecx, bp
mov ecx, dword [0x10191984]
jmp 0x614440
mov eax, dword [ebp - 4]
jmp 0x513282
Function at 0x62b4e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [edi], cl
test byte [edi], bh
sub eax, 0xe9560001
sub ch, byte [0x45c70001]
aam 0x30
and al, 0x16
adc cl, ch
pop ss
sub esp, 0x2c
push ebx
mov cx, sp
cmova cx, di
push ebp
setno bl
mov ebp, dword [esp + 0x3c]
movzx bx, al
movzx ebx, bx
push esi
push edi
seto bh
movzx ecx, si
push 0
sete ch
mov bl, dh
lea ebx, [ebp + 0x14]
push 0
mov cl, 0xb
mov ecx, ebx
jmp 0x4fd2e9

Function at 0x62bc60
Capabilities:
Execute anti-debugging instructions

Disassembly:
in al, dx
dec eax
mov eax, dword [esp + 4]
sal edx, cl
stc
clc
mov edx, dword [ecx + 4]
cmp sp, 0x4fe7
cmc
jmp 0x641919
cmp eax, edx
jmp 0x4a2eaf

Function at 0x62cc10
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [0x100e13ac]
push dword [esp + 0x10]
movsx esi, bp
not si
mov esi, ecx
push 0x1108
jmp 0x4d0aaa
push dword [esi + 0x1c]
jmp 0x4e17f2
call edi
push eax
call fcn.004d0de0
test eax, eax
je 0x69762d
push 0
push dword [esp + 0x10]
jmp 0x530624
test esi, ebp
or eax, dword [ecx]
add byte [ecx + 0x101813dc], ah
push 0x1109
push dword [esi + 0x1c]
jmp 0x69762b
test ecx, ecx
jbe 0x4b5ee2
mov ebp, ecx
setne bl
mov bl, byte [esi - 1]
jmp 0x62df79
lea eax, [esi + ecx*2]
je 0x5d3815
cmp ecx, 1
jmp 0x652b74
dec esi
jmp 0x507c72
jbe 0x4bf303
lea ebp, [ecx - 1]
jmp 0x499e9c
outsd dx, dword [esi]
mov esi, dword [ebx + 0xd]
jae 0x69763c
ror eax, 1
mov edi, 0x2b3b603d
xor byte [edx - 0x550c62bd], 0x2b
pop ecx
cmp bl, ah
and ch, byte [0x45095f88]

Function at 0x62d91e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, ecx
lahf
push 0
mov eax, dword [esi + 0x9c]
push eax
mov eax, dword [esi + 0xb8]
jmp 0x4b1340
Function at 0x630daf
Capabilities:
Check for software breakpoints
Check http status code
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
add dl, byte [edi + 0x59]
push ecx
and byte [esi - 0x67], ah
lea edx, [ecx + edi]
jmp 0x536bd9
add byte [edi], cl
test bl, bh
mov bl, 0x19
add bh, bh
jne 0x4d9681
jmp 0x53d4ea
push dword [ebp + 0x10]
push dword [ebp + 0xc]
jmp 0x68a5ab
je 0x613b10
mov eax, edx
clc
sub eax, ecx
jmp 0x691f1b
push esi
jmp 0x4de54c
call fcn.00611c15
add esp, 0xc
cmp eax, 0xffffffff
jmp 0x4d9697
lea ecx, [ebp - 0x1c]
call 0x43f2b6
mov edx, dword [esi + 4]
rcr ah, 0x77
mov ecx, esi
mov ecx, dword [esi]
and ax, di
push 0
adc eax, ebx
neg ax
mov dword [ebp - 4], 0
clc
mov edx, dword [edx + 8]
mov eax, dword [ecx]
stc
test edx, 0x4ba90f8f
imul edx, edi
push edx
jmp 0x65a07c
push eax
jmp 0x5eab72
push ebp
bt eax, 0x4c
adc bp, 0x6084
mov ebp, esp
push 0xffffffffffffffff
cmc
bswap eax
btr eax, 0xc4
push 0x100df5e8
sbb al, 0xaa
mov eax, dword fs:[0]
push eax
mov ah, 0x74
shl al, 0x5f
btc ax, si
mov dword fs:[0], esp
rcl ah, cl
sub esp, 0x10
test bl, 0x27
sbb ah, bl
push ebx
btc ax, 0xe
btr eax, eax
push esi
mov esi, ecx
rcr ah, cl
setge ah
clc
push edi
add al, 0xb5
btr di, dx
adc di, sp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], esp
mov eax, dword [esi + 0x1d8]
clc
test eax, eax
jle 0x5edcbd
push edi
jmp 0x642574
push eax
bswap ax
lahf
lea eax, [esi + 0x1dc]
jmp 0x5ffc64
mov byte [ebp - 4], 1
jmp 0x4c378a
int3
sti
mov eax, 0x81cde87f
wait
insd dword es:[edi], dx
ja 0x68a5ce
push esp
js 0x68a546
pop esp
adc al, 0xc1
mov edi, 0xaafd8ccf
xlatb
jo 0x68a60c
mov bl, 0x4d
salc
adc ch, cl
xor edx, eax
mov esp, 0x46810c5b
inc esi
inc edx
loop 0x68a62f
aad 0xec
or ebx, ecx
cmp dword [ecx + ebp*4 + 0x2c4a88e2], ebp
mov esi, 0x8df32c4d
sbb al, 0xbb
or edx, edi
xchg ecx, eax
sub esp, edx
std
push eax
scasd eax, dword es:[edi]
jns 0x68a5ac
ljmp 0x39f8:0x8c58b74e
arpl word [0x9e2110d7], bx
xchg byte [edi - 0x38c8c6c5], ch
add byte [esi], 0xf8
stosd dword es:[edi], eax
dec edx
in eax, 0xae
cwde
sahf

Function at 0x63163d
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 0x58]
jmp 0x52294b
invalid
push 0x1017cc68
push edx
jmp 0x66e35e
mov dword [esi + 0x48], edi
jmp 0x4da02e
push ebp
mov ebp, esp
cmc
stc
test sp, cx
lea esp, [esp - 0x44]
push esi
mov esi, dword [ebp + 8]
push edi
sub edi, edi
cmc
cmp esi, edi
jmp 0x65f8ac
mov dword [ebp - 4], eax
je 0x5d2aa7
cmp dword [esi + 0x48], edi
jbe 0x5d2aa7
cmp eax, esi
jmp 0x4b6eab
cmp eax, edi
jmp 0x64a058
je 0x4a0539
mov eax, dword [esi + 0x44]
jmp 0x64e5c6
xor byte [eax + esi + 0x54], cl
xor byte [eax + 0x30], bl
pop esp
xor byte [eax + 0x30], ah
insb byte es:[edi], dx
xor byte [eax + 0x30], dh
je 0x66e39f
xor byte [eax], 0x84
xor byte [eax - 0x6bcf6fd0], cl
xor byte [eax - 0x57cf63d0], bl
xor byte [eax + esi + 0x30b830b0], ch
mov esp, 0xc430c030
or al, 0x31
Function at 0x632098
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
cmp ebx, esi
cbw
neg eax
mov ecx, dword [ebp + 0x18]
xor al, ch
mov eax, dword [ebp + 0x14]
push ebx
push esi
sub esi, 0x491227ab
clc
xadd esi, esi
and dword [ecx], 0
or si, 0x5b62
sar esi, 0x42
cmp bh, 0xc8
mov esi, dword [ebp + 0x10]
cmp ch, 0x1d
push edi
and di, 0x5bb3
mov edi, 0x700f2cc9
cmova edi, edi
mov edi, dword [ebp + 0xc]
test bl, al
cmp ch, 0x13
mov dword [eax], 1
dec eax
mov eax, dword [ebp + 8]
clc
test edi, edi
je 0x632109
mov dword [edi], esi
cmp si, bx
cmp edi, 0x20f314e5
add edi, 4
mov dword [ebp + 0xc], edi
test esi, 0x6e4a0488
cmp byte [eax], 0x22
jmp 0x656adf
jne 0x4a6261
mov dl, byte [eax + 1]
jmp 0x4a67ca

Function at 0x634c1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 8]
test esi, esi
jmp 0x4c93f0
push esi
jmp 0x60a438

Function at 0x636e42
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xdd
jmp 0x49bac2

Function at 0x638a77
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [ecx - 0x16b7dbbc], cl
mov dh, 0x22
idiv edi
inc ecx
test eax, eax
mov dword [esi + 0x1d4], ecx
jmp 0x503cb8
push ebp
mov ebp, esp
cmove ax, bx
sub esp, 8
lahf
bswap eax
push ebx
movzx eax, sp
inc ax
push esi
mov esi, ecx
push edi
bswap eax
mov ax, 0x613f
dec eax
mov dword [ebp - 4], esi
setae ch
mov ecx, dword [esi + 0x1d4]
mov eax, dword [esi + 0x228]
jmp 0x624108

Function at 0x63b264
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec esi
xor byte [ebx], bh
retf
nop
nop
nop
nop
jmp 0x63156f
push edi
xchg di, di
push eax
push ecx
cbw
not ecx
mov eax, dword [ebp + 0x10]
movzx ecx, si
mov ecx, dword [ebp + 0xc]
push ecx
movsx edi, bp
mov edi, dword [ebp + 8]
jmp 0x499d0e
jle 0x65f895
mov eax, dword [ebp + 8]
cmovl cx, si
mov ecx, dword [eax]
or ah, 0x92
mov eax, dword [ebp + 0x10]
test esi, 0x2d4c7a63
cmp bx, 0x58d4
cmc
cmp ecx, eax
jne 0x5f8e23
sub eax, eax
pop edi
jmp 0x656098
mov dword [ebp - 4], 0xffffffff
jmp 0x5f906d
dec dword [eax - 0x17]
test eax, 0xf5ffe935
sub edx, edx
jmp 0x4c0b9a
push ebp
mov ebp, esp
bts ax, si
sal al, cl
push ecx
rcl ah, cl
sub ax, si
rol ax, cl
mov eax, dword [ebp + 0xc]
clc
push edi
cmp ebp, ebx
test bp, 0x2fe6
stc
test eax, eax
jmp 0x60c993
mov esp, ebp
mov ebp, ebx
pop ebp
jmp 0x50525b
mov eax, dword [ebp - 4]
jmp 0x50c9a7

Function at 0x63c198
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
push eax
jmp 0x4bce82
push 0xffffffffffffffff
push 0x100dddd8
mov eax, dword fs:[0]
jmp 0x63aa96