joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42be60
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
test edx, edx
je 0x42bfab
mov cl, byte [edx]
mov eax, ecx
and eax, 0xff
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 1
inc edx
test cl, cl
je 0x42bea4
push ebx
mov edi, eax
mov ebx, eax
shl edi, 5
shr ebx, 3
movsx ecx, cl
add edi, ebx
add edi, ecx
mov cl, byte [edx]
xor eax, edi
inc edx
test cl, cl
jne 0x42be89
pop ebx
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x42bed9
mov cl, byte [esi]
inc esi
test cl, cl
je 0x42bed9
mov edx, eax
mov edi, eax
shl edx, 5
shr edi, 3
movsx ecx, cl
add edx, edi
add edx, ecx
mov cl, byte [esi]
xor eax, edx
inc esi
test cl, cl
jne 0x42bebf
mov edx, dword [esp + 0x18]
test edx, edx
je 0x42bf12
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42bf02
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42bee8
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x42bf3b
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42bf3b
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42bf21
mov edx, dword [esp + 0x20]
test edx, edx
je 0x42bf74
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42bf64
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42bf4a
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x42bf9d
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42bf9d
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42bf83
mov ecx, dword [esp + 0xc]
xor edx, edx
pop edi
pop esi
div dword [ecx + 4]
mov eax, edx
ret
xor eax, eax
mov al, byte [esi]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 1
jmp 0x42beb4
Function at 0x42d5d0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x42d5de
or eax, 0xffffffff
pop ebx
ret
push esi
push edi
mov edi, dword [ebx]
mov al, byte [edi]
cmp al, 0x61
jl 0x42d5f0
cmp al, 0x7a
jle 0x42d6de
cmp al, 0x41
jl 0x42d5fc
cmp al, 0x5a
jle 0x42d6de
cmp al, 0x30
jl 0x42d608
cmp al, 0x39
jle 0x42d6de
cmp al, 0x2d
je 0x42d6de
cmp al, 0x5f
je 0x42d6de
cmp al, 0x2e
je 0x42d6de
cmp al, 0x21
je 0x42d6de
cmp al, 0x7e
je 0x42d6de
cmp al, 0x2a
je 0x42d6de
cmp al, 0x27
je 0x42d6de
cmp al, 0x28
je 0x42d6de
cmp al, 0x29
je 0x42d6de
cmp al, 0x25
jne 0x42d696
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x42d661
cmp cl, 0x39
jle 0x42d675
cmp cl, 0x61
jl 0x42d66b
cmp cl, 0x66
jle 0x42d675
cmp cl, 0x41
jl 0x42d696
cmp cl, 0x46
jg 0x42d696
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x42d682
cmp cl, 0x39
jle 0x42d6de
cmp cl, 0x61
jl 0x42d68c
cmp cl, 0x66
jle 0x42d6de
cmp cl, 0x41
jl 0x42d696
cmp cl, 0x46
jle 0x42d6de
cmp al, 0x3b
je 0x42d6de
cmp al, 0x2f
je 0x42d6de
cmp al, 0x3f
je 0x42d6de
cmp al, 0x3a
je 0x42d6de
cmp al, 0x40
je 0x42d6de
cmp al, 0x26
je 0x42d6de
cmp al, 0x3d
je 0x42d6de
cmp al, 0x2b
je 0x42d6de
cmp al, 0x24
je 0x42d6de
cmp al, 0x2c
je 0x42d6de
cmp al, 0x5b
je 0x42d6de
cmp al, 0x5d
je 0x42d6de
cmp al, 0x7b
je 0x42d6de
cmp al, 0x7d
je 0x42d6de
cmp al, 0x7c
je 0x42d6de
cmp al, 0x5c
je 0x42d6de
cmp al, 0x5e
je 0x42d6de
cmp al, 0x60
jne 0x42d6f0
cmp al, 0x25
jne 0x42d6ea
add edi, 3
jmp 0x42d5e2
inc edi
jmp 0x42d5e2
mov esi, dword [esp + 0x10]
test esi, esi
je 0x42d73d
mov eax, dword [esi + 0x20]
test eax, eax
je 0x42d709
push eax
call dword [0x447940]
add esp, 4
test byte [esi + 0x24], 2
mov eax, dword [ebx]
je 0x42d72a
mov ecx, edi
sub ecx, eax
push ecx
push eax
call fcn.004105f0
add esp, 8
mov dword [esi + 0x20], eax
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov edx, edi
push 0
sub edx, eax
push edx
push eax
call fcn.0042d150
add esp, 0xc
mov dword [esi + 0x20], eax
mov dword [ebx], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x42dba0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x42dbae
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [ebx]
mov dl, 1
mov al, byte [edi]
cmp al, 0x61
jl 0x42dbc6
cmp al, 0x7a
jle 0x42dcbd
cmp al, 0x41
jl 0x42dbd2
cmp al, 0x5a
jle 0x42dcbd
cmp al, 0x30
jl 0x42dbde
cmp al, 0x39
jle 0x42dcbd
cmp al, 0x2d
je 0x42dcbd
cmp al, 0x5f
je 0x42dcbd
cmp al, 0x2e
je 0x42dcbd
cmp al, 0x21
je 0x42dcbd
cmp al, 0x7e
je 0x42dcbd
cmp al, 0x2a
je 0x42dcbd
cmp al, 0x27
je 0x42dcbd
cmp al, 0x28
je 0x42dcbd
cmp al, 0x29
je 0x42dcbd
cmp al, 0x25
jne 0x42dc6c
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x42dc37
cmp cl, 0x39
jle 0x42dc4b
cmp cl, 0x61
jl 0x42dc41
cmp cl, 0x66
jle 0x42dc4b
cmp cl, 0x41
jl 0x42dc6c
cmp cl, 0x46
jg 0x42dc6c
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x42dc58
cmp cl, 0x39
jle 0x42dcbd
cmp cl, 0x61
jl 0x42dc62
cmp cl, 0x66
jle 0x42dcbd
cmp cl, 0x41
jl 0x42dc6c
cmp cl, 0x46
jle 0x42dcbd
cmp al, 0x3b
je 0x42dcbd
cmp al, 0x2f
je 0x42dcbd
cmp al, 0x3f
je 0x42dcbd
cmp al, 0x3a
je 0x42dcbd
cmp al, 0x40
je 0x42dcbd
cmp al, 0x26
je 0x42dcbd
cmp al, 0x3d
je 0x42dcbd
cmp al, 0x2b
je 0x42dcbd
cmp al, 0x24
je 0x42dcbd
cmp al, 0x2c
je 0x42dcbd
cmp al, 0x5b
je 0x42dcbd
cmp al, 0x5d
je 0x42dcbd
test esi, esi
je 0x42dd18
test byte [esi + 0x24], dl
je 0x42dccf
cmp al, 0x7b
je 0x42dcbd
cmp al, 0x7d
je 0x42dcbd
cmp al, 0x7c
je 0x42dcbd
cmp al, 0x5c
je 0x42dcbd
cmp al, 0x5e
je 0x42dcbd
cmp al, 0x60
jne 0x42dccf
cmp al, 0x25
jne 0x42dcc9
add edi, 3
jmp 0x42dbb8
inc edi
jmp 0x42dbb8
test esi, esi
je 0x42dd18
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x42dce4
push eax
call dword [0x447940]
add esp, 4
test byte [esi + 0x24], 2
mov eax, dword [ebx]
je 0x42dd05
mov ecx, edi
sub ecx, eax
push ecx
push eax
call fcn.004105f0
add esp, 8
mov dword [esi + 0x1c], eax
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov edx, edi
push 0
sub edx, eax
push edx
push eax
call fcn.0042d150
add esp, 0xc
mov dword [esi + 0x1c], eax
mov dword [ebx], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x432d30
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x44e514]
sub esp, 0x100
test eax, eax
jne 0x432ee3
push ebp
push esi
push edi
call fcn.00432ef0
mov eax, dword [0x44e510]
push eax
call fcn.00437ac0
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push str.XML_DEBUG_CATALOG
call esi
add esp, 8
test eax, eax
je 0x432d74
mov dword [0x44e504], 1
mov eax, dword [0x44e50c]
test eax, eax
jne 0x432ed1
push str.XML_CATALOG_FILES
call esi
mov esi, eax
add esp, 4
test esi, esi
jne 0x432e2e
push str.libxml2.dll
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
jne 0x432dad
push eax
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x432e29
lea ecx, [esp + 0xc]
push 0xff
push ecx
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
je 0x432e29
mov cl, byte [esp + eax + 0xc]
lea eax, [esp + eax + 0xc]
cmp cl, 0x5c
je 0x432ddf
lea edx, [esp + 0xc]
cmp eax, edx
jbe 0x432ddf
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x5c
jne 0x432dce
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x432e29
mov edi, dword [sym.imp.MSVCRT.dll_strncpy]
lea edx, [esp + 0x10b]
sub edx, eax
push edx
push str...etccatalog
push eax
call edi
lea eax, [esp + 0x18]
push eax
call fcn.0042eec0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x432e29
push 0xff
push esi
push str.file:___etc_xml_catalog
call edi
push esi
call dword [0x447940]
add esp, 0x10
mov esi, str.file:___etc_xml_catalog
mov ecx, dword [0x449e0c]
push ecx
push 1
call fcn.00431440
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x432ed1
mov al, byte [esi]
push ebx
test al, al
lea ebx, [ebp + 0x3c]
je 0x432eca
mov al, byte [esi]
cmp al, 0x20
je 0x432e65
cmp al, 9
jl 0x432e61
cmp al, 0xa
jle 0x432e65
cmp al, 0xd
jne 0x432e68
inc esi
jmp 0x432e53
mov al, byte [esi]
test al, al
je 0x432ec5
mov ecx, esi
cmp al, 0x20
je 0x432e88
cmp al, 9
jl 0x432e7c
cmp al, 0xa
jle 0x432e88
cmp al, 0xd
je 0x432e88
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x432e70
mov edx, esi
sub edx, ecx
push edx
push ecx
call fcn.004105f0
mov edi, eax
add esp, 8
test edi, edi
je 0x432ec5
mov eax, dword [0x449e0c]
push 0
push eax
push edi
push 0
push 0
push 1
call fcn.004314e0
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x432ebb
mov ebx, eax
push edi
call dword [0x447940]
add esp, 4
cmp byte [esi], 0
jne 0x432e53
mov dword [0x44e50c], ebp
pop ebx
mov ecx, dword [0x44e510]
push ecx
call fcn.00437ac0
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x100
ret

Function at 0x432ef0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x44e514]
test eax, eax
jne 0x432f29
push str.XML_DEBUG_CATALOG
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x432f15
mov dword [0x44e504], 1
call fcn.00437a80
mov dword [0x44e510], eax
mov dword [0x44e514], 1
ret
Function at 0x437a10
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x44e744]
test eax, eax
je 0x437a1d
or eax, 0xffffffff
ret
push esi
push edi
mov dword [0x44e744], 1
call fcn.00437a80
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push str.XML_MEM_BREAKPOINT
mov dword [0x44e754], eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 4
test eax, eax
je 0x437a5d
push 0x44e75c
push 0x44b1e8
push eax
call edi
add esp, 0xc
push str.XML_MEM_TRACE
call esi
add esp, 4
test eax, eax
je 0x437a7b
push 0x44e760
push 0x44b1d4
push eax
call edi
add esp, 0xc
pop edi
xor eax, eax
pop esi
ret

Function at 0xb0205d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00b0205d
ret
Function at 0x13d818b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf13c4890
jmp 0x13d8279
call 0x13d813f
lea esp, [esp + 1]
push bx
call 0x13d819c
xor al, 0x8d
and al, 3
mov dword [esp + 0x18], ebp
pushfd
push dword [esp + 1]
jmp 0x13d81d4
mov byte [esp + 4], al
mov dword [esp + 0x20], esi
jmp 0x13d8201
jnp 0x13d81f3
mov word [esp + 5], sp
pushfd
jmp 0x13d81be
mov word [esp + 5], sp
pushfd
mov byte [esp + 4], al
mov dword [esp + 0x20], esi
call fcn.013d821d
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x13d8240
pushfd
jmp 0x13d73f6
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp]
rdtsc
cmp edx, 0x81f70e9c
jmp 0x13d868c
sete bh
mov ch, al
push ax
lea esp, [esp + 2]
jmp 0x13d8263
lea esi, [esp]
mov ecx, 0xf67741dc
mov dl, 0xc5
mov ebx, 0xef947e2e
jmp 0x13d854f
mov eax, edi
sub esp, 0xc0
mov ebp, esp
xchg bl, dh
mov edx, 0x8f4dfdd4
jmp 0x13d82d6
jg 0x13d8286
jle 0x13d8286
rcr dx, 4
mov edx, dword [esp]
neg edx
jmp 0x13d878a

Function at 0x13d819c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf13c4890
jmp 0x13d8279
call 0x13d813f
lea esp, [esp + 1]
push bx
call 0x13d819c
xor al, 0x8d
and al, 3
mov dword [esp + 0x18], ebp
pushfd
push dword [esp + 1]
jmp 0x13d81d4
mov byte [esp + 4], al
mov dword [esp + 0x20], esi
jmp 0x13d8201
jnp 0x13d81f3
mov word [esp + 5], sp
pushfd
jmp 0x13d81be
mov word [esp + 5], sp
pushfd
mov byte [esp + 4], al
mov dword [esp + 0x20], esi
call fcn.013d821d
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x13d8240
pushfd
jmp 0x13d73f6
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp]
rdtsc
cmp edx, 0x81f70e9c
jmp 0x13d868c
sete bh
mov ch, al
push ax
lea esp, [esp + 2]
jmp 0x13d8263
lea esi, [esp]
mov ecx, 0xf67741dc
mov dl, 0xc5
mov ebx, 0xef947e2e
jmp 0x13d854f
mov eax, edi
sub esp, 0xc0
mov ebp, esp
xchg bl, dh
mov edx, 0x8f4dfdd4
jmp 0x13d82d6
jg 0x13d8286
jle 0x13d8286
rcr dx, 4
mov edx, dword [esp]
neg edx
jmp 0x13d878a

Function at 0x13d81b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
mov dword [esp + 0x18], esp
push sp
jmp 0x13d8190

Function at 0x13d821d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jg 0x13d8206
jle 0x13d822e
xchg ebx, eax
add byte [esi + 0x3dc300f1], dl
or al, 0x8d
and al, 2
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x13d8240
Function at 0x13e2fa2
Capabilities:
Encode data using xor

Disassembly:
push bx
lea edx, [ecx + ebx]
lea esp, [esp + 2]
jmp 0x13e3317
bswap ebx
pop ebx
jmp 0x13c7bb6
mov edx, dword [esp + 0xc]
lea esp, [esp + 0x10]
push ebx
mov bx, 0xcd18
mov bx, word [esp]
mov bh, 0xe7
jmp 0x13e31b7
Function at 0x140494c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [ebp + 0xc]
xchg ecx, eax
neg dl
jmp 0x1404a74
mov edx, dword [ebp - 0xc]
jmp 0x1404c7f
push bx
jmp 0x1404be2
mov ecx, dword [ebp - 4]
jmp 0x1404c06
lea esp, [esp + 0x20]
push dword [ebp + 0xc]
mov dx, di
jmp 0x1404954
mov dword [esp], esp
sub esp, 0x1c
jmp 0x1404936
mov edx, eax
mov ax, word [esp]
mov eax, edx
jmp 0x1404b56
lea esp, [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 4]
popal
call int.0140498f
dec eax
pushal
mov ax, 0xc4a4
mov dword [esp + 0x1c], edi
call fcn.01404a66
popal
jmp 0x1404a50
sub ebx, eax
xchg cx, ax
mov al, 0xbb
jmp 0x1404a6c
mov dword [ebp - 4], edx
jmp 0x13c5366
mov ecx, dword [ebp - 8]
rdtsc
jmp 0x1404ad7
seto al
mov ax, word [esp]
mov eax, edi
call 0x1404a9c
call fcn.013e21fb
bt ecx, esp
dec ecx
xchg ch, cl
jmp 0x1404afb
push dword [ebx + edi]
rdtsc
mov edx, edi
mov eax, ecx
jmp 0x1404ab2
ror cx, cl
add edi, 4
pushal
jmp 0x1404b2a
add dword [esi], eax
pop ecx
inc ch
mov cx, 0xa34d
jmp 0x1404ae2
dec dword [ebp - 4]
pushal
mov ch, bh
mov ecx, 0xf4dc613
bswap ecx
jmp 0x1404b39
lea esp, [esp + 0x20]
add esi, 4
setp ch
lea ecx, [edi + ebp]
jmp 0x1404b06
lea esp, [esp + 0x20]
pop ecx
jne 0x13c5366
je 0x13c537c
aaa
mov cl, 0x21
inc eax
mov bl, 0x72
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
out 0x60, eax
pushal
pushfd
mov bl, byte [esp + 3]
mov dword [esp + 0x20], esi
push cx
jmp 0x1404a0c
xchg bx, si
mov eax, dword [esp]
jmp 0x1404ba7
lea esp, [esp + 8]
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
call 0x13e227a
setb ah
jmp 0x1404b67
mov ecx, ebp
jmp 0x1404bc2
pop edi
pop esi
push ecx
jmp 0x1404b91
mov dword [ecx], ebx
pop ebx
pop ecx
jmp 0x1404bd3
lea ecx, [ecx - 4]
push ebx
mov ebx, 0x5f5879cb
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x1404bac
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
lea ebx, [eax + edi]
pop ebx
jmp 0x13c53c6
lea esp, [esp + 2]
jmp 0x1404c20
popal
lea edx, [edx + 8]
mov eax, dword [edx]
pop edx
mov ecx, ebx
jmp 0x1404b7d
dec dword [ebp - 4]
test ecx, ecx
jmp 0x1404c29
mov byte [eax], 0
inc eax
jmp 0x13c53c6
jne 0x13c53b0
leave
ret
pushal
mov si, cx
mov dword [esp + 0x14], ebp
push eax
mov word [esp + 1], di
lea esp, [esp + 4]
jmp 0x1404bf8
lea ecx, [esp + edx]
push esp
push ebp
push edx
jmp 0x1404c4d

Function at 0x1404979
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 3], ch
mov word [esp + 2], di
jmp 0x14049b5
lea esp, [esp + 8]
call 0x13e21e0
lea ecx, [edx*4]
pop ecx
jmp 0x1404994

Function at 0x140498f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
outsb dx, byte [esi]
add edx, dword [ebx + reloc.iphlpapi.dll_GetAdaptersInfo]
int1
ljmp 0x74b8
call fcn.01404979
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
pop ecx
mov dword [ebp - 8], eax
push edx
call fcn.014049de
loope 0x1404a16
out 0x81, al
jo 0x140495f
stc
insd dword es:[edi], dx
std
test byte [edi - 0x4c], dh
cld
iretd
and al, 4
Function at 0x14049f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
test edx, edx
push eax
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x14049e0
jmp 0x14049c8
jbe 0x13c537c
clc
mov si, bp
call 0x14049f0
fiadd word [ebx - 0x6d16ff3c]
add byte [eax], al
add byte [ecx + ebp*4], bh
cmp dword [eax - 0x55], ebx
push 0x5e
retf 0x3f58

Function at 0x1404a43
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x1404a1e

Function at 0x14ba336
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
ror ebp, 0x11
mov si, 0x7738
mov ecx, dword [esp]
xchg di, bx
jmp 0x14ba03c
mov bl, al
xchg word [esp], ax
cpuid
pop bx
bsr ebx, ebp
xchg bx, cx
jmp 0x14b9ffe
dec si
sub esp, 0xa
mov dl, byte [esp + 6]
xchg bp, ax
add esp, 2
rdtsc
jmp 0x14ba04c
xchg di, bx
mov cx, word [esp]
mov dl, 0x3a
xchg edx, eax
mov ebx, edi
bswap ebx
jmp 0x14ba026
mov bh, byte [esp + 7]
add esp, 4
not bx
mov ch, byte [esp + 3]
pop edx
xchg dx, si
jmp 0x14ba165
mov al, 0x12
dec di
not di
mov dl, byte [esp + 1]
mov bp, word [esp + 1]
setp bh
jmp 0x14ba014
mov word [esp], bx
lea ebx, [eax + eax]
lea esp, [esp + 1]
mov byte [esp], ch
bts si, bx
add esp, 0
jmp 0x14ba0ba
xchg ebx, edi
mov edi, 0xf62ee259
rdtsc
xchg cx, di
rdtsc
adc eax, ebx
jmp 0x14ba08b
mov bl, dh
neg dx
bsf cx, sp
mov bx, word [esp]
bswap eax
mov ebp, eax
jmp 0x14ba11b
push ax
cmp esi, esi
lea edx, [ebx + esi]
std
xchg bl, dh
mov cl, 0xa1
jmp 0x14ba0a8
lea esp, [esp]
lea ebx, [ebp - 0xf9]
std
btc esi, esp
jmp 0x14ba13f
or ax, si
cpuid
cpuid
xchg bl, ch
xchg byte [esp], ch
setp dl
jmp 0x14ba0ed
pushal
mov bh, 0x45
mov word [esp + 0x19], bx
inc si
popal
cmc
jmp 0x14ba103
xchg esi, ebx
neg cl
std
bt si, bp
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x14ba18e
lea eax, [eax*4]
cmc
mov bh, 0x42
not bx
std
mov ax, word [esp]
jmp 0x14ba129
mov di, word [esp]
rcr ebx, cl
rdtsc
bswap ebx
std
mov dl, byte [esp]
jmp 0x14ba0df
lea esp, [esp]
neg cl
mov bh, 0xb3
mov ah, 0x67
bsf ebp, ecx
call fcn.014ba1d7
or byte [ebx - 0x75b3823e], ch
stc
mov bh, cl
lea esi, [esp + ebp]
mov ax, word [esp]
xchg bx, dx
mov ebx, edx
dec cl
jmp 0x14ba178
pop dword [esp]
mov cx, word [esp + 3]
mov dx, cx
xchg dword [esp], edx
pop di
shr ebx, cl
jmp 0x14ba076
neg di
mov edi, 0xfb562324
pop ax
xchg ecx, edi
bsf bx, di
sub ah, 0x10
jmp 0x14ba1a9
cpuid
xchg word [esp + 3], di
jmp 0x14ba27a

Function at 0x14bac3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14bac9a
mov cx, bp
mov eax, 0x54c6f62b
mov si, di
mov cx, 0x9826
jmp 0x14bad13
sub esp, 0xf
sub esp, 0xa
lea esp, [esp + 0x42]
btc edx, ebx
rdtsc
jmp 0x14bac84
sbb cl, 0xff
add esp, 2
lea eax, [ecx + 0x53]
add esp, 0
not si
setp bl
jmp 0x14bacc7
mov ch, byte [esp]
sub esp, 3
rdtsc
neg edx
cpuid
neg esi
jmp 0x14bacdd
Function at 0x14be7b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
mov si, 0x587e
not bp
clc
pop word [esp]
jmp 0x14be7de
neg bh
push dword [esp + 0x1c]
mov byte [esp + 0x14], ah
and ebp, esi
xchg word [esp + 6], bp
jmp 0x14be79f
sete ah
rdtsc
sets dl
mov ch, byte [esp + 1]
bt ebp, ebx
jmp 0x14be828
bts bx, sp
xchg edx, edi
mov cl, dh
lea edi, [edx*4]
bsf ecx, esp
mov eax, 0x26f31776
jmp 0x14be7c8
neg ecx
lea edx, [ebp*4]
neg dh
rdtsc
add esp, 2
lea esp, [esp]
jmp 0x14be812

Function at 0x14be8e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 1], esi
pop edx
xchg si, dx
push dword [esp + 1]
cpuid
push edi
jmp 0x14be989
mov edx, dword [esp + 3]
xchg dword [esp + 4], esi
add bp, 0x614b
cld
jmp 0x14be8cb
lea ebx, [edx*4]
bt di, cx
xchg bl, dl
jmp 0x14be95b
xchg esi, eax
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
bsf si, ax
mov cx, sp
xchg edx, ecx
mov edx, ebx
jmp 0x14be90f
add esp, 0
rdtsc
xchg dword [esp], edx
bswap edx
bswap ebp
mov bx, 0xc96
jmp 0x14be971
push dword [esp + 4]
xchg ebx, eax
pop dword [esp]
pop bp
mov esi, 0x76fce894
mov bh, byte [esp + 3]
jmp 0x14be939
inc bl
pop edx
bts esi, esi
clc
stc
rdtsc
jmp 0x14be9b4
rdtsc
sub esp, 0
xchg cl, ch
lea esp, [esp + 7]
btr dx, dx
bsr di, bx
jmp 0x14be925
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
mov dh, byte [esp]
call fcn.014beb2a
mov cl, 0x37
cmpsd dword [esi], dword es:[edi]
ret 0xde31
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
xchg edi, ecx
mov ah, 0x75
bswap ebx
mov ecx, dword [esp]
xchg di, bx
jmp 0x14be99e

Function at 0x14beb2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
not al
lea edi, [esp + 0x7a]
clc
cmc
mov ax, sp
jmp 0x14bea21
xchg bp, bx
xchg edx, eax
mov dword [esp + 0x15], edi
pop ebp
rdtsc
xchg dword [esp + 0xe], esi
jmp 0x14be9dd
add esp, 4
mov bl, dl
push dx
xchg word [esp + 0x11], cx
and ah, ch
mov byte [esp + 0xa], cl
jmp 0x14be9f3
neg bx
push dword [esp + 0x12]
xchg word [esp], cx
xchg byte [esp + 0x13], cl
rdtsc
mov di, 0xdb67
jmp 0x14bea69
pop bp
xchg cx, ax
pop ebp
xchg ebx, edi
pop bx
rdtsc
jmp 0x14bea0d
pop di
xchg byte [esp + 0x15], al
btc eax, esi
xchg word [esp + 3], ax
mov dh, dl
mov cx, word [esp + 0x10]
jmp 0x14beab0
xchg word [esp + 0xb], dx
xchg ch, bh
pop ebp
mov dword [esp + 0x12], eax
mov byte [esp + 6], dh
btr ecx, ebp
jmp 0x14bea4d
or al, dl
mov word [esp], bp
xchg di, cx
xchg byte [esp], dh
jmp 0x14beac2
inc di
std
xchg cx, di
xchg ebx, eax
stc
lea ebp, [edi*4]
jmp 0x14bea7e
mov al, bh
not ah
add esp, 5
lea esi, [ebx + ebx]
rdtsc
lea esp, [esp + 0x13]
jmp 0x14bea94
push word [esp + 1]
push dword [esp + 2]
bts bp, sp
call fcn.014beb13
xlatb
arpl bx, si
xchg esi, eax
sub dword gs:[edi], reloc.iphlpapi.dll_GetAdaptersInfo
or edx, dword [ecx - 0x30]
push ebx
retf 0x8f65
pop dword [esp + 0x18]
push edx
mov bh, ch
mov edi, dword [esp + 0x1d]
not cl
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x14bea3f
pushal
rdtsc
sub esp, 6
rdtsc
jmp 0x14beae5
Function at 0x14bed43
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, eax
mov dx, si
not cx
mov cx, 0xa5ea
mov bx, 0xfc5e
std
jmp 0x14bed5b
jmp 0x14bed1d
mov byte [esp + 4], bh
mov edx, ebp
sub esp, 0x13
add esp, 0x15
jmp 0x14bed8c
mov cl, bl
lea esp, [esp]
mov di, 0x74da
cmc
rdtsc
lea edx, [esp + 0xc0]
jmp 0x14bed45
pop word [esp + 2]
lea esp, [esp]
mov ax, 0x8bd2
pop word [esp]
mov esi, dword [esp]
dec dx
jmp 0x14bedc1
mov dl, 0x64
xchg bh, ch
sub esp, 6
pop word [esp + 2]
pop bx
bsr ebx, ebx
jmp 0x14bf4e9
mov bh, 0x46
bsr ax, si
mov al, 0x95
lea esp, [esp + 0xb]
not di
mov ebx, dword [esp + 0x1f]
jmp 0x14bee2a
mov ch, 0xf8
xchg word [esp + 0x1f], bx
lea esp, [esp + 7]
xchg dword [esp + 0x12], edx
pop word [esp + 0xd]
pop dword [esp + 0x24]
jmp 0x14bee4a
mov dword [esp + 0x1c], ebp
push word [esp + 6]
sub esp, 0x14
mov word [esp + 4], sp
mov bx, word [esp + 0x24]
neg bh
jmp 0x14beee9
push word [esp + 6]
bswap eax
mov dl, ah
btr si, cx
std
mov dword [esp + 0x14], edi
jmp 0x14bf085
xchg si, ax
sub esp, 0x1e
not bl
mov ah, byte [esp + 1]
mov word [esp + 0xb], dx
setl dh
jmp 0x14bf128
xchg ah, bl
mov al, 0xfa
lea eax, [edi*4]
bswap eax
rdtsc
xchg cl, dl
jmp 0x14bf2dc
pop ax
mov cx, di
rdtsc
mov al, byte [esp + 1]
mov ch, ah
std
jmp 0x14bf3e1