joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b7dc
Capabilities:
Encode data using xor

Disassembly:
jne 0x49b84c
arpl word [eax + 0x65], bp
jb 0x49b811
js 0x49b84b
add byte [edx + 0x69], bl
outsb dx, byte [esi]
imul esi, dword [edi + 0x33], 0x32
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx], al
add byte [eax], al
add dl, al
inc esp
add eax, dword [eax]
dec ebp
pop edx
nop
add byte [ebx], al
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0xe49b83d
pop ds
mov edx, 0x9b4000e
int 0x21
mov eax, 0x21cd4c01
push esp
push 0x70207369
jb 0x49b8c1
imul esi, dword [ebx + 0x20], 0x676f7270
jb 0x49b8b6
jb 0x49b8b6
insd dword es:[edi], dx
and byte [ebx + 0x61], ah
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x49b87e
bound esp, qword [ebp + 0x20]
jb 0x49b8d8
outsb dx, byte [esi]
and byte [ecx + 0x6e], ch
and byte [edi + ecx*2 + 0x53], al
and byte [ebp + 0x6f], ch
or eax, 0x240a0d
add byte [eax], al
add byte [eax], al
add byte [eax], al
ret
pmulhw mm0, qword [edi - 0x78499e76]
mov ah, byte [ecx - 0x4a]
xchg dword [edx - 0x2766499f], ecx
in eax, 0xb6
test byte [edx - 0xd71499f], cl
mov dh, 0x8c
mov ah, byte [ecx - 0x4a]
xchg dword [edx - 0x75fe49a0], ecx
popal
mov dh, 0x8e
loop 0x49b85e
xchg byte [edx - 0xd71499f], cl
call 0x61d46869
mov dh, 0x8e
mov dh, 0x86
mov dh, 0x86
mov ah, byte [ecx - 0x4a]
cdq
fdiv st(5)
mov dh, 0x86
mov ah, byte [ecx - 0x4a]
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
inc ebp
add byte [eax], al
dec esp
add dword [edx], edx
add byte [edx + 0x4d9d3d], ch
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ah
add byte [edx], al
and dword [ebx], ecx
add dword [ecx], ecx
add byte [eax], al
and al, byte [edx]
add byte [eax], al
sbb al, 1
add byte [eax], al
mov word [eax], es
add byte [eax + 0x22], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax + 2], al
add byte [eax], dl
add byte [eax], dl
add byte [eax], al
add byte [edx], al
add byte [eax], al
add eax, 0
add byte [eax], al
add byte [0], al
add byte [eax], al
add byte [eax], al
add byte [eax + eax], 0
push es
add byte [eax], al
xchg edi, eax
and byte [eax + eax], al
add al, byte [eax]
add byte [0x100000], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
invalid
Function at 0x49cb5c
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x10033004], 0
je 0x49cbfb
mov dword [0x10033004], 0
rdtsc
rol eax, 3
xor dword [0x10033000], eax
rol edx, 0x11
xor dword [0x10033000], edx
lea eax, [ebp - 8]
push eax
call fcn.0049d070
mov eax, dword [ebp - 8]
rol eax, 5
xor dword [0x10033000], eax
mov eax, dword [ebp - 4]
rol eax, 0xf
xor dword [0x10033000], eax
mov eax, dword fs:[0x20]
rol eax, 9
xor dword [0x10033000], eax
mov eax, dword fs:[0x24]
rol eax, 0xb
xor dword [0x10033000], eax
call fcn.0049d076
xor dword [0x10033000], eax
jmp 0x49cbdc
rdtsc
rol eax, 9
xor dword [0x10033000], eax
rol eax, 0x17
xor dword [0x10033000], edx
movzx ecx, word [0x10033000]
test ecx, ecx
je 0x49cbdc
mov esp, ebp
pop ebp
ret
Function at 0x4b639c
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 0xc], 0
test edx, edx
jle 0x4b64e9
mov edi, dword [ebp + edx*4 - 0x12c]
lea esi, [edi + ecx]
lea ebx, [ecx*4]
add ecx, ecx
add ecx, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edi
lea esi, [edi*4]
jmp 0x4b63dc
movss xmm3, dword [esi + eax]
movss xmm1, dword [esi + eax + 4]
mov ecx, dword [ebp + ecx*4 - 0x12c]
mov edi, dword [ebp - 4]
add edx, edx
add ecx, edx
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [esi + eax]
add edi, edi
xorps xmm2, xmm0
movss dword [esi + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
add edi, edi
add ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
mov edi, dword [ebp - 4]
lea edx, [ebx + esi]
movss xmm3, dword [edx + eax]
fstp dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm3, dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
add edi, edi
sub ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [edx + eax]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
add edi, edi
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm1, dword [edx + eax + 4]
movss xmm3, dword [edx + eax]
add ecx, edi
fld dword [eax + ecx*4]
movss xmm2, dword [eax + ecx*4 + 4]
lea edi, [edx + eax + 4]
fstp dword [edx + eax]
mov dword [ebp - 0x14], edi
mov edx, edi
lea edi, [eax + ecx*4 + 4]
xorps xmm2, xmm0
movss dword [edx], xmm2
mov edx, 2
add dword [ebp - 0x1c], edx
add dword [ebp - 8], edx
add dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x20]
movss dword [eax + ecx*4], xmm3
mov ecx, dword [ebp - 0xc]
inc ecx
add esi, 8
cmp ecx, edx
xorps xmm1, xmm0
movss dword [edi], xmm1
mov dword [ebp - 0xc], ecx
jl 0x4b63dc
mov edi, dword [ebp - 4]
mov ecx, dword [ebp + edx*4 - 0x12c]
lea esi, [ecx + edx*2]
movss xmm1, dword [eax + esi*4 + 4]
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
lea ecx, [edi + edi]
lea ebx, [esi + ecx]
movss xmm3, dword [eax + ebx*4]
cwde
movss xmm1, dword [eax + ebx*4 + 4]
lea esi, [ebx + ecx]
movss xmm2, dword [eax + esi*4 + 4]
fld dword [eax + esi*4]
mov dword [ebp - 0x14], ebx
lea ebx, [eax + ebx*4 + 4]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x14]
fstp dword [eax + ebx*4]
mov ebx, dword [ebp - 0x18]
xorps xmm1, xmm0
xorps xmm2, xmm0
movss dword [ebx], xmm2
movss dword [eax + esi*4 + 4], xmm1
movss dword [eax + esi*4], xmm3
add esi, ecx
movss xmm1, dword [eax + esi*4 + 4]
inc edx
cmp edx, edi
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
mov dword [ebp - 0x20], edx
jl fcn.004b639c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cd87c
Capabilities:
Encode data using xor

Disassembly:
add esi, dword [eax]
xor byte [edi], dh
aaa
aaa
sti
sti
sti
sti
sti
aaa
push edx
jae 0x4cd839
cmpsd dword [esi], dword es:[edi]
cld
cld
cld
cld
cld
cld
cld
cld
cld
mov eax, dword [0xa07ec66]
or cl, byte [edx]
or cl, byte [edx]
or dl, byte [ebx - 0x60606db]
and byte [eax], ah
and byte [eax], ah
and eax, 0x242445e9
sub al, byte [ebx]
xor byte [eax], dh
aaa
aaa
aaa
aaa
sti
sti
sti
aaa
aaa
invalid
push ecx

Function at 0x4d13cc
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x10033004], 0
je 0x4d146b
mov dword [0x10033004], 0
rdtsc
rol eax, 3
xor dword [0x10033000], eax
rol edx, 0x11
xor dword [0x10033000], edx
lea eax, [ebp - 8]
push eax
call fcn.004d18e0
mov eax, dword [ebp - 8]
rol eax, 5
xor dword [0x10033000], eax
mov eax, dword [ebp - 4]
rol eax, 0xf
xor dword [0x10033000], eax
mov eax, dword fs:[0x20]
rol eax, 9
xor dword [0x10033000], eax
mov eax, dword fs:[0x24]
rol eax, 0xb
xor dword [0x10033000], eax
call fcn.004d18e6
xor dword [0x10033000], eax
jmp 0x4d144c
rdtsc
rol eax, 9
xor dword [0x10033000], eax
rol eax, 0x17
xor dword [0x10033000], edx
movzx ecx, word [0x10033000]
test ecx, ecx
je 0x4d144c
mov esp, ebp
pop ebp
ret
Function at 0x4eac0c
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 0xc], 0
test edx, edx
jle 0x4ead59
mov edi, dword [ebp + edx*4 - 0x12c]
lea esi, [edi + ecx]
lea ebx, [ecx*4]
add ecx, ecx
add ecx, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edi
lea esi, [edi*4]
jmp 0x4eac4c
movss xmm3, dword [esi + eax]
movss xmm1, dword [esi + eax + 4]
mov ecx, dword [ebp + ecx*4 - 0x12c]
mov edi, dword [ebp - 4]
add edx, edx
add ecx, edx
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [esi + eax]
add edi, edi
xorps xmm2, xmm0
movss dword [esi + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
add edi, edi
add ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
mov edi, dword [ebp - 4]
lea edx, [ebx + esi]
movss xmm3, dword [edx + eax]
fstp dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm3, dword [edx + eax]
movss xmm1, dword [edx + eax + 4]
add edi, edi
sub ecx, edi
movss xmm2, dword [eax + ecx*4 + 4]
fld dword [eax + ecx*4]
fstp dword [edx + eax]
xorps xmm2, xmm0
movss dword [edx + eax + 4], xmm2
movss dword [eax + ecx*4], xmm3
add edx, ebx
add edi, edi
xorps xmm1, xmm0
movss dword [eax + ecx*4 + 4], xmm1
movss xmm1, dword [edx + eax + 4]
movss xmm3, dword [edx + eax]
add ecx, edi
fld dword [eax + ecx*4]
movss xmm2, dword [eax + ecx*4 + 4]
lea edi, [edx + eax + 4]
fstp dword [edx + eax]
mov dword [ebp - 0x14], edi
mov edx, edi
lea edi, [eax + ecx*4 + 4]
xorps xmm2, xmm0
movss dword [edx], xmm2
mov edx, 2
add dword [ebp - 0x1c], edx
add dword [ebp - 8], edx
add dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x20]
movss dword [eax + ecx*4], xmm3
mov ecx, dword [ebp - 0xc]
inc ecx
add esi, 8
cmp ecx, edx
xorps xmm1, xmm0
movss dword [edi], xmm1
mov dword [ebp - 0xc], ecx
jl 0x4eac4c
mov edi, dword [ebp - 4]
mov ecx, dword [ebp + edx*4 - 0x12c]
lea esi, [ecx + edx*2]
movss xmm1, dword [eax + esi*4 + 4]
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
lea ecx, [edi + edi]
lea ebx, [esi + ecx]
movss xmm3, dword [eax + ebx*4]
cwde
movss xmm1, dword [eax + ebx*4 + 4]
lea esi, [ebx + ecx]
movss xmm2, dword [eax + esi*4 + 4]
fld dword [eax + esi*4]
mov dword [ebp - 0x14], ebx
lea ebx, [eax + ebx*4 + 4]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x14]
fstp dword [eax + ebx*4]
mov ebx, dword [ebp - 0x18]
xorps xmm1, xmm0
xorps xmm2, xmm0
movss dword [ebx], xmm2
movss dword [eax + esi*4 + 4], xmm1
movss dword [eax + esi*4], xmm3
add esi, ecx
movss xmm1, dword [eax + esi*4 + 4]
inc edx
cmp edx, edi
xorps xmm1, xmm0
movss dword [eax + esi*4 + 4], xmm1
mov dword [ebp - 0x20], edx
jl fcn.004eac0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6d3435
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
jmp 0x6d3479
and ebx, ecx
push esp
pop word [esp]
push esp
add esp, 3
jmp 0x6d3404
lea esp, [esp + 1]
jmp 0x6d341a
movzx ebx, byte [esi + 5]
call 0x6d343b
dec edx
fisttp word [edi + 0x2a]
fst dword [edi - 0x60]
xor byte [esi - 0x520bcf3f], ah
mov esp, 0x424648d
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x6b00f8]
jmp 0x6d3462

Function at 0x6d359c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
shr edi, 0x18
push esp
mov edi, dword [edi*4 + 0x6af8f8]
jmp 0x6d35ea
push word [esp + 1]
push esp
lea esp, [esp + 2]
jmp 0x6d3581
and edi, ecx
mov edi, dword [edi*4 + 0x6afcf8]
sub esp, 0x1a
push word [esp + 0x19]
jmp 0x6d35bf

Function at 0x6d36ed
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
clc
sub esp, 0x12
lea esp, [esp + 2]
mov edx, dword [edx*4 + 0x6af8f8]
clc
jmp 0x6d3616
movzx ebx, byte [esi + 9]
cmc
sub esp, 8
and edx, ecx
jmp 0x6d3639
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + 0x6b00f8]
mov ebx, dword [esp]
jmp 0x6d3696
and ebx, ecx
cmc
sub esp, 0xc
jmp 0x6d36ca

Function at 0x6d3802
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 1], bh
pop word [esp]
add esp, 1
lea esp, [esp + 1]
jmp fcn.006d38e8

Function at 0x6d39f7
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0xa
jmp 0x6d3a6b
xor edi, dword [ebx*4 + 0x6b00f8]
call fcn.006d3a4b
xor edi, dword [ebp + 0x7ac7342d]
add ecx, dword [esi + 0x53967b1c]
invalid
mov edx, dword [edx*4 + 0x6af8f8]
and ebx, ecx
push edx
lea esp, [esp + 0x34]
jmp 0x6d39fc

Function at 0x6d3a4b
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
add esp, 0
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x6d3a7b
and edx, ecx
call 0x6d3a83
out dx, eax
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x6b08f8]
pushal
jmp 0x6d3b00
lea esp, [esp + 0xc]
jne 0x6a5673
je 0x6a5692
mov dword [esi + 0xc], edi
push edx
mov byte [esp + 1], ch
mov dword [esp], ecx
push esp
jmp 0x6d3aad
lea esp, [esp + 0x20]
dec dword [ebp - 4]
push esp
mov dword [esp], esi
jmp 0x6d3ad7

Function at 0x6d3a83
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
add esp, 0
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x6d3a7b
and edx, ecx
call 0x6d3a83
out dx, eax
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x6b08f8]
pushal
jmp 0x6d3b00
lea esp, [esp + 0xc]
jne 0x6a5673
je 0x6a5692
mov dword [esi + 0xc], edi
push edx
mov byte [esp + 1], ch
mov dword [esp], ecx
push esp
jmp 0x6d3aad
lea esp, [esp + 0x20]
dec dword [ebp - 4]
push esp
mov dword [esp], esi
jmp 0x6d3ad7
Function at 0x780fed
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x78121b
jmp 0x781234
lea esp, [esp + 2]
mov dword [esp + 0x13], eax
mov al, 0x8e
mov eax, dword [esp]
rdtsc
rdtsc
jmp 0x7810b7
pushal
xchg dword [esp + 6], esi
xchg si, dx
pop dx
mov byte [esp + 0xe], dh
xchg dword [esp], edx
jmp 0x781060
mov dword [esp + 0x2b], esi
mov edx, esp
push esp
lea esp, [esp + 0x44]
mov al, ah
lea esi, [esi + 0xed]
jmp 0x7810c6
xchg dx, ax
lea eax, [ecx + 0x53]
pushal
rdtsc
not dx
pushal
jmp 0x78108e
mov eax, dword [esp + 0x13]
mov dx, 0x66eb
mov dh, 0xee
not dh
push edx
lea edx, [esi*4]
jmp 0x7810fb
lea edx, [edx*4]
mov dx, 0xbfcd
mov dh, bh
mov dx, word [esp]
push esi
xchg si, dx
jmp 0x78107b
pop word [esp]
mov dl, 0xac
bswap esi
lea esp, [esp + 2]
mov esi, dword [esp + 0x1c]
mov dl, 0x3c
jmp 0x78112d
push word [esp + 1]
pop dword [esp]
mov byte [esp], dh
lea esp, [esp + 2]
mov dword [esp], edx
lea edx, [eax - 0x31]
jmp 0x7810e4
not dx
mov edx, dword [esp]
lea edx, [edx + ebx]
mov dx, word [esp]
jmp 0x7811aa
push 0
pushfd
push edx
push esp
mov dword [esp + 3], eax
jmp 0x781116
jne 0x780ff2
je 0x7811f0
pop es
pushfd
xor dl, byte [ebp - 0x5c]
or eax, 0x1879e973
jmp 0x7811c9
cmp dword [esp + 4], 0
jmp 0x781153
push dword [esp + 2]
lea esp, [esp + 3]
lea esp, [esp + 1]
mov edx, dword [esp + 0x24]
lea esp, [esp + 0x28]
jmp 0x78116c
mov edx, 0xfa0ec9e0
mov edx, dword [esp]
lea edx, [edx + esi]
push edx
mov dh, byte [esp + 1]
xchg dword [esp], edx
jmp 0x781183
sub al, 0xac
and al, byte [ebp - 0x4c]
push ebp
cmp bh, byte [ecx + 0x5bbb4829]
sbb al, ch
or eax, dword [eax]
add byte [eax], al
call 0x7811e6
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
xlatb
jg 0x7811e9
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
out dx, al
push edx
int 0x60
pushal
jmp 0x7811d6
pushal
pop word [esp + 5]
push edx
mov word [esp + 8], bx
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x781145
add dword [esp + 8], 1
push edx
mov byte [esp + 2], ah
push word [esp + 1]
jmp 0x78126b
mov byte [esp + 3], dh
lea esp, [esp + 2]
lea esp, [esp + 4]
popfd
lea esp, [esp + 4]
jmp 0x781468
push dword [esp]
lea esp, [esp + 8]
jmp 0x781209
Function at 0x7c65e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, cl
mov dx, di
btr esi, esp
bsf cx, si
mov ah, byte [esp]
sub esp, 0xc
jmp 0x7c65a5
sub bl, ah
xchg esi, eax
mov cl, ch
pop cx
pop cx
jmp 0x7c65cb

Function at 0x7c66fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xe
lea edx, [esp + ebp]
lea ebp, [ecx*4]
btr ecx, edx
pop word [esp + 0x1f]
bsf ax, ax
jmp 0x7c6700
mov byte [esp + 2], ch
jmp 0x7c66d9
cpuid
mov cx, word [esp + 0x10]
neg ah
setno bh

Function at 0x7c6950
Capabilities:
Execute anti-debugging instructions

Disassembly:
and cl, bh
inc ax
add si, 0x5656
mov cl, 0xfa
add esp, 6
cld
jmp 0x7c6ac5
mov cx, word [esp + 0x13]
jmp 0x7c692e
lea edx, [esi*4]
call fcn.007c697a
push ebx
je 0x7c6a01
popal
jae 0x7c6a2c
inc ebp
jb 0x7c6a2d
outsd dx, dword [esi]
jb 0x7c69be
mov byte [esp + 1], ch
push esp
mov edi, ebp
inc eax
bswap ecx
xchg word [esp], cx
jmp 0x7c69a5
xchg ecx, edx
mov ax, di
mov word [esp + 0x16], di
rdtsc
push word [esp + 0xc]
xchg byte [esp + 4], bl
jmp 0x7c69be
mov ebp, 0x6652592f
mov dword [esp + 0x1d], edi
insb byte es:[edi], dx
jae 0x7c6aa3
jb 0x7c6a94
insd dword es:[edi], dx
jo 0x7c6a9d
inc ecx
add byte [edi + 0xf082444], cl
xor dword [eax - 0x79fedb9c], ecx
or al, 0x24
pop dword [esp + 8]
rdtsc
mov byte [esp + 1], ah
xchg byte [esp], cl
sub esp, 6
pop dword [esp + 0xa]
jmp 0x7c69e4
push es
push eax
je 0x7c6b0f
dec esp
push eax
add byte [esi - 0x47], ah
dec ebx
clc
lea ebp, [ebx*4]
mov al, 0x66
bsf dx, ax
lea esi, [edx*4]
jmp 0x7c6a36
invalid

Function at 0x7c6988
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0x69df0ac8
mov ax, word [esp + 4]
jmp 0x7c69ce
xor ebp, esi
cpuid
lea esp, [esp + 2]
mov esi, eax
lea esp, [esp]
xchg byte [esp], dl
jmp 0x7c6a19
mov dh, byte [esp + 0x20]
push esp
mov bp, 0x592f
push edx
mov word [esp + 0x1d], di
mov byte [esp + 0x17], dh
jmp 0x7c6aa3
lea ebp, [eax + edx]
mov edx, ecx
pushal
xchg word [esp + 0x20], si
mov ah, byte [esp + 0x1f]
xchg edx, ebp
jmp 0x7c69fb
lea eax, [esi + 0xdbc5a45]
lea esp, [esp + 0x1a]
pop ebx
mov edi, ebp
lea esi, [ecx + edx]
btr edx, esp
jmp 0x7c75f5
xchg word [esp + 0x12], ax
pop dword [esp + 7]
mov dword [esp + 8], ecx
xchg dword [esp + 0xe], edx
clc
jmp 0x7c6a4c
mov byte [esp + 1], ch
pop dword [esp + 0x12]
mov bl, bh
mov dword [esp + 6], esi
not esi
lea edi, [ecx + edi]
jmp 0x7c6a6d
mov cx, 0xf84b
lea ebp, [eax - 0x41b6b50f]
cld
neg ch
setae dh
neg bh
jmp 0x7c6a87
Function at 0x7c6afb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x7baad60
xchg byte [esp + 0x22], al
bswap ecx
lea esi, [ecx + ebx]
sete bh
mov dl, dh
jmp 0x7c601f
shl si, cl
xchg dword [esp + 4], ebx
mov ax, word [esp + 9]
mov dx, 0x23b9
mov cl, 0xd2
pushal
jmp 0x7c5feb
push dword [esp + 0x27]
mov dword [esp + 0x25], ebp
xchg ch, dl
add esp, 9
xchg byte [esp + 0x23], bl
btr edi, esp
jmp 0x7c605a
xchg dword [esp], eax
push dword [esp + 2]
btc esi, ebx
lea ebp, [edi*4]
mov cx, word [esp + 3]
neg di
jmp 0x7c600a
add esp, 0xf
bsf dx, ax
pop word [esp + 0xc]
xchg dword [esp + 0x10], eax
mov dword [esp], esi
mov al, ah
jmp 0x7c629c
mov ch, byte [esp]
bsf ax, si
xchg bx, bp
cpuid
push esp
push word [esp + 2]
jmp 0x7c603f
stc
lea ebx, [eax + edi]
lea edi, [esi + edi]
rdtsc
add esp, 2
cld
jmp 0x7c607d
mov edi, esi
mov byte [esp + 3], bh
push dword [esp + 0x12]
stc
stc
shr bh, 3
jmp 0x7c60f9
mov dword [esp + 0x28], esi
mov si, word [esp + 0x1b]
bsr si, cx
mov ecx, ebp
mov cx, word [esp + 0x23]
jmp 0x7c60b1
mov bl, bh
pop esi
xchg word [esp + 0x13], ax
neg ax
xchg dh, al
mov bh, byte [esp + 4]
jmp 0x7c60cc
cpuid
mov dword [esp + 1], ecx
mov byte [esp + 7], bh
push word [esp + 0x13]
mov al, ah
lea esi, [esi - 5]
jmp 0x7c61a7
bswap ebx
mov ecx, eax
xchg byte [esp + 0x16], bl
btr ecx, esp
xchg byte [esp + 0x2a], bl
lea eax, [ebp + 0x9f]
jmp 0x7c60e6
bswap edi
rdtsc
sub esp, 0x1e
mov di, dx
mov bx, 0x159d
sub esp, 6
jmp 0x7c6113
mov ebx, esi
btc ebp, edi
mov edx, dword [esp]
call fcn.007c6257
imul esi, dword [eax + 0x68], 0x7061706c
imul ebp, dword [esi], 0x6c6c64
inc esp
neg esi
sub dword [eax + 0x60], ecx
pushal
lea esp, [esp + 0x5f]
xchg esi, ecx
xchg ecx, ebx
mov bx, 0xe337
mov bx, dx
jmp 0x7c6145
mov bl, 0x10
lea ecx, [ecx - 0x3b]
mov ebp, dword [esp + 0x32]
push dword [esp + 0x1c]
mov bl, 0x68
mov eax, esi
jmp 0x7c6164
push word [esp + 0x26]
mov cl, ch
xchg ecx, ebx
not bp
mov ebx, 0x93d92e48
xchg dword [esp + 0x28], edx
jmp 0x7c6189
bswap edi
mov ebx, 0xf6c701e
mov byte [esp + 0x11], ch
mov ah, byte [esp + 7]
lea ebx, [esi + 0xe5]
xchg byte [esp + 8], al
jmp 0x7c6132
mov dh, byte [esp + 0xa]
mov bp, word [esp + 0xb]
pop word [esp + 0xa]
mov esi, dword [esp + 0x12]
mov dx, word [esp + 0xc]
mov ah, byte [esp + 5]
jmp 0x7c61c3
pop cx
bsf cx, si
stc
rdtsc
neg eax
inc edi
jmp 0x7c60a2
xchg edx, eax
xchg byte [esp], al
lea ebx, [esi + edi]
jmp 0x7c6782

Function at 0x7c6b08
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], sp
sete dh
bsr ax, cx
xchg dword [esp + 6], eax
push edx
jmp 0x7c6b8f
mov cl, ch
pop word [esp + 1]
cpuid
cmc
clc
mov si, bx
jmp 0x7c6b3a
mov al, ah
sub cx, 0x7568
shr ebp, 0x13
mov ecx, dword [esp + 7]
setae ah
jmp 0x7c6b53
lea edx, [ecx*4]
mov ch, byte [esp + 0xd]
lea eax, [ebp*4]
xchg di, ax
setl ch
jmp 0x7c6b78
Function at 0x7cb748
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.007ca194
mov byte [esp + 2], dh
jmp 0x7cb7a6
push word [esp + 3]
mov byte [esp + 1], bh
mov word [esp + 2], sp
jmp 0x7cb7bc
pop word [esp]
push edx
mov dword [esp], ebp
mov word [esp], di
mov dword [esp], ebp
pop word [esp + 1]
jmp 0x7cb78f
pop word [esp + 1]
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
jmp 0x7cb82b
push eax
jmp 0x7ca18f
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x7cb7f3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x7cb80f
Function at 0x40d132
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00418091
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00418091
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x40d1ae
mov eax, dword [0x539ae4]
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 3
call fcn.004180a9
cmp dword [ebp - 0x18], esp
je 0x40d1da
push 6
call fcn.004180a3
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x1e
call fcn.004180a9
cmp dword [ebp - 0x18], esp
je 0x40d208
push 6
call fcn.004180a3
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 0x1f
call fcn.004180a9
cmp dword [ebp - 0x18], esp
je 0x40d234
push 6
call fcn.004180a3
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x20
call fcn.004180a9
cmp dword [ebp - 0x18], esp
je 0x40d2c3
push 6
call fcn.004180a3
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 4
call fcn.004180a9
cmp dword [ebp - 0x18], esp
je 0x40d2e8
push 6
call fcn.004180a3
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x40d2f0
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00418085
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00418085
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8