joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ecd80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xe5e6e8]
xor edx, edx
cmp eax, edx
jne 0x6ecda6
xor eax, eax
mov byte [eax + 0xe5e5e8], al
inc eax
cmp eax, 0x100
jl 0x6ecd8e
mov dword [0xe5e6e8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xe5e5e8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x6ece37
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x6ece0a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x6ecdd8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x6ece40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x6ece93
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x6ece7a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6f3850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72182e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.006f4170
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xdc9e8c
call fcn.007127b6
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x6f38e3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.007127b6
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x6f38dc
push 0
mov ecx, eax
call fcn.006ea9c0
mov dword [esi + 0xc], eax
jmp 0x6f38e5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x6f38e5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x7037e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x703803
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
push eax
call fcn.0070323a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x703826
test byte [esp + 8], 2
je 0x703826
call fcn.007032ad
mov dword [eax], 0xd
call fcn.007032b6
mov dword [eax], 5
jmp 0x7037ff
xor eax, eax
ret

Function at 0x714e46
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x714e7e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00712ed0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00712ea8
jmp 0x714e8a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x716534
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x716576
call fcn.0071c2a9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x716576
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x71656d
xor eax, eax
jmp 0x71657e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00716584
pop edi
pop esi
pop ebx
ret 4

Function at 0x71c7d9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x71c807
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x71c825
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0071c73f
jmp 0x71c825
mov eax, dword [esi + 0x14]
test eax, eax
je 0x71c825
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0071c73f
test edi, edi
mov eax, edi
jne 0x71c80f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x3484eeb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3484ef09
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push str.DW0200
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3484ef09
mov al, 1
jmp 0x3484ef0b
xor al, al
leave
ret 8

Function at 0x3484ef60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x3484ef6f
pop dword [ebp - 8]
mov eax, 0x3484ef6f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xc02865ee
add dword [ebp - 0x18], 0x8e29df5d
mov dword [ebp - 0x14], 0xa0db5803
add dword [ebp - 0x14], 0x9157f442
mov dword [ebp - 0x10], 0xb57e5c9b
sub dword [ebp - 0x10], 0x6932186d
mov dword [ebp - 0xc], 0xf38e2e1e
add dword [ebp - 0xc], 0xc71d1e2
lea eax, [ebp - 0x18]
push eax
mov eax, 0xa39ea449
sub eax, 0x6f198341
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xbe42279d
sub dword [ebp - 0x18], 0x49cfbe47
mov dword [ebp - 0x14], 0x15a9f2dc
sub dword [ebp - 0x14], 0xd43d9167
mov dword [ebp - 0x10], 0xb293c451
add dword [ebp - 0x10], 0xb0dba81b
mov dword [ebp - 0xc], 0x271c222b
sub dword [ebp - 0xc], 0x271c222b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x74647c8f
sub eax, 0x3fdf5b67
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3699e
push 0
call eax
mov ecx, 0x74b85ed9
sub ecx, 0x74b8176e
mov ebx, eax
mov edi, 0xba490ef5
add edi, 0x7a3dc10b
add edi, dword [ebp - 8]
mov edx, 0xace82cbb
add dword [ebp - 4], 0x589a7855
mov esi, dword [edi]
xor dword [ebp - 4], ebx
sub esi, edx
mov dword [ebp - 4], 0x6b57d167
mov dword [ebx], esi
mov dword [ebp - 4], 0xfb1fce67
add ebx, 4
add edi, 0x78b749a
add edi, 0xf8748b6a
loop 0x3484f086
add eax, 0x85d7c294
sub eax, 0x85d6b215
mov ebx, eax
add eax, 0xdeb12b10
sub eax, 0xdeb12b0b
mov ecx, 0x34810000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x411019
Capabilities:
Terminate process

Disassembly:
jmp 0x4127e0
jmp fcn.004136d0
cmp ecx, dword [section..data]
jne 0x4127ea
repz ret
jmp 0x41108c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x8d0879
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ebx, esp
inc ah
neg edx
bsr bx, si
bsf bx, cx
jmp 0x8d08a5
xchg dword [esp], ebx
mov esi, 0xb36834c2
mov ecx, ebp
mov ax, word [esp]
jmp 0x8d08ec
mov ecx, 0x836fe271
xchg dword [esp], ebx
mov si, 0x26fc
rdtsc
jmp 0x8d0919
mov dx, 0x2469
sub al, 0x1f
lea ebx, [ebx - 0x46]
mov ax, 0x32d2
dec ax
rcl si, 1
jmp 0x8d08d6
mov esi, 0x7a6efa6f
call fcn.008d0903
jne 0x8d0939
je 0x8d0939
stosb byte es:[edi], al
and eax, 0xe82fdcb5
les edx, [esi - 0x3c]
mov dword [reloc.KERNEL32.dll_GetStartupInfoA], eax
stc
fdivr dword [ebx]
adc al, byte [ecx + 0xbcec]
add byte [ebx + 0x2b048df4], cl
sub esp, 0xbc
mov esi, esp
lea eax, [ebx + ebp]
jmp 0x8d094a
mov ebx, edx
mov ecx, edi
shr ebx, 0x18
jmp 0x8d11a4
or ax, 0x64bf
not bh
mov bx, word [esp]
mov ax, 0x9e0f
mov bx, word [esp]
neg dl
jmp 0x8d0b2a
mov bx, word [esp]
mov ax, 0x9e0f
mov bx, word [esp]
jmp 0x8d0969
jl 0x8d0957
or ax, 0x64bf
not bh
jmp 0x8d0e77

Function at 0x8d0974
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x60756a6d
call fcn.008d1092
sahf
sbb cl, byte [eax - 0x455e511]
ror byte [ebp - 0x76fddb9c], cl
and al, 0x18
call fcn.008d077e
mov byte [esp], dl
mov dword [esp], ecx
push eax
call fcn.008d084f
xchg al, ah
rdtsc
jmp 0x8d1031
cmc
dec dl
shl eax, 2
neg dl
js 0x8d1053
jns 0x8d116e
std
outsd dx, dword [esi]
call [edx - 0x42fd3997]
invalid

Function at 0x8d0c87
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], ch
pop ax
sub esp, 0x1e
jg 0x8d0ca6
cmc
rol ax, cl
jmp 0x8d0cc3
jmp 0x8d0cd9
cmc
rol ax, cl
jmp 0x8d0cc3

Function at 0x8d0e16
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0x14]
mov edx, esp
lea edx, reloc.KERNEL32.dll_GetStartupInfoA
xchg word [esp + 8], dx
jmp 0x8d0dc3
Function at 0x8d1ec5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x8d2083
mov dx, cx
mov dx, sp
lea eax, [edx + edi]
setg ah
jmp 0x8d1f0c
bswap eax
neg dx
jmp 0x8d1fb2
inc bl
mov dh, ch
rcl edx, 0x16
jge 0x8d1f55
jl 0x8d1f39
bswap eax
bt edx, ebx
jmp 0x8d1f63
btr dx, di
rdtsc
sbb ax, si
jmp 0x8d1f02
bsf dx, dx
rdtsc
lea eax, [eax + ecx]
jmp 0x8d1f17
bsf dx, dx
rdtsc
lea eax, [eax + ecx]
bswap eax
bt edx, ebx
ror bl, 0
jl 0x8d1f82
mov dh, ah
mov ax, 0x6441
xchg dh, dl
lea edx, [edi*4]
jmp 0x8d1fd3
jmp 0x8d2055
lea edx, [edi*4]
lea edx, [edi*4]
jmp 0x8d1fbd
btr dx, di
rdtsc
sbb ax, si
bswap eax
neg dx
dec bl
mov dx, word [esp]
jmp 0x8d1eec
dec bl
neg ax
jno 0x8d2027
setle dl
mov ah, 0x42
jmp 0x8d1ff4
lea edx, [edi*4]
jmp 0x8d1fbd
lea eax, [ecx + esi]
btc ax, ax
jbe 0x8d1ffc
lea eax, [esi + ebp]
call fcn.008d202c
inc eax
add edi, dword [edx + reloc.KERNEL32.dll_GetStartupInfoA]
mov ah, 0x42
pushal
mov dword [esp + 0x14], ebx
popal
jmp 0x8d1fdc
lea eax, [esi + ebp]
rcl eax, 0x11
jmp 0x8d25a4
call fcn.008d2500
lahf
sbb al, 0xb2
aad 0x24
xchg esi, eax
jmp 0x8d2086
setle dl
jmp 0x8d1ff2
mov dh, ah
mov ax, 0x6441
xchg dh, dl
jmp 0x8d1f87
sub bl, 0xf9
xchg dx, ax
xchg dl, al
neg dx
js 0x8d1fa4
jns 0x8d1f2e
shl edx, 2
mov ax, bx
mov eax, 0xc7d80aaf
xor eax, 0x5f2e3c7a
jb 0x8d2010
jae 0x8d2010
mov al, byte [esp]
shr eax, 5
ja 0x8d2611
push edx
jmp 0x8d262f
mov al, 0x59
push word [esp + 3]
setne al
jmp 0x8d2660
mov ax, 0x3ee5
jmp fcn.008d26d3

Function at 0x90492e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp fcn.009048f0

Function at 0x90494e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
cmp al, 0x2b
jmp 0x904950
jmp 0x904938
je 0x8c2a01
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x904b8d
lea esp, [esp + 0x18]
cmp al, 0x2f
call fcn.00904b4c
cmp dl, 0x2f
push si
push esi
lea esp, [esp + 2]
jmp 0x904c39
lea esp, [esp + 4]
je 0x8c2ade
call 0x904ba7
Function at 0x904ab6
Capabilities:
Encode data using base64

Disassembly:
mov bl, byte [ecx + 1]
pushal
push word [esp + 0xb]
jmp 0x8c2a10
lea esp, [esp + 2]
jmp 0x904994
call fcn.0090494e
out 0x8c, al
pop edi
dec ebp
lodsb al, byte [esi]
std
xor byte [eax], bh
jmp 0x8c2a98
jmp 0x904a90
pushfd
lea esp, [esp + 4]
jmp 0x9049fe
lodsd eax, dword [esi]
mov esp, 0x54e9168f
loop 0x8c2aa1
add byte [esi - 0x60], cl
push eax
mov ch, 0xf3
ret
dec esi
mov al, byte [0xc3f3b550]
pushal
sub edx, esp
inc ebx
outsb dx, byte [esi]
outsb dx, byte [esi]
test dword [ecx - reloc.KERNEL32.dll_GetStartupInfoA], 0x27e861fa
and byte [eax + eax], al
cmp dl, 0x61
call 0x904ae1
xchg ebp, eax
add al, 0xb7
sahf
jge 0x8c2b07
out dx, eax
retf 0x378f
jmp 0x904a58
cmp bl, 0x30
jmp 0x904a0f
in al, dx
fisttp dword [ecx + reloc.KERNEL32.dll_GetStartupInfoA]
and byte [eax + eax], al
or ah, byte [eax + 0x20ed588e]
sub byte [eax + 0x1d33aad], ah
push ecx
rcl byte [ebx - 0x36]
cmp al, 0x61
pushal
call fcn.009048ae
lea esp, [esp + 4]
jbe 0x8c2a01
ja 0x8c2a53
xchg edi, eax
dec cl
push 0x24648d8b
and al, 0x3c
cmp eax, ebp
invalid
lea esp, [esp + 0x20]
mov byte [ebp - 1], bl
call fcn.0090497e
jb 0x8c2a7f
call fcn.00904ace
mov dl, byte [edx + ecx*4]
in eax, dx
sbb al, 0xac
add eax, eax
cmp dword [edx], 0x15
lea esp, [esp + 4]
cmp bl, 0x41
pushfd
lea esp, [esp + 4]
jmp 0x9049a0
cmp bl, 0x61
jb 0x8c2af5
cmp bl, 0x7a
call fcn.009049e8
jb 0x8c2ac8
cmp bl, 0x39
jbe 0x8c2a69
ja 0x8c2ac8
rcl byte [ecx - 0x3f]
mov al, byte [0xd252e353]
inc eax
daa
rcl byte [esi], cl
ror dword [edx - 0x73], cl
and al, 4
jbe 0x8c2a69
ja 0x8c2af5
cmc
push ecx
jmp 0x904a69
push sp
lea esp, [esp + 2]
cmp bl, 0x2b
je 0x8c2a69
jne 0x904a42
lea esp, [esp + 4]
cmp bl, 0x2f
call 0x904aa6
enter 0xffffffffffffdd4d, 0xffffffffffffffa4
push edi
jmp fcn.00904ad8
mov dl, byte [ecx + 2]
call 0x904ab6
and eax, 0xa15237a7
pop ds
pop ebp
fmul dword [esi + 0x29]
fcomp dword [esi*4 + 0x24648da4]
add al, 0xf
test dword [ebp + reloc.KERNEL32.dll_GetStartupInfoA], ecx
test byte [ebx + 0x66fffbdf], dh
push dword [esp + 1]
lea esp, [esp + 2]
jmp 0x904afc
lea esp, [esp + 4]
cmp dl, 0x41
jb 0x8c2ab2
jmp fcn.00904ad9
Function at 0x904b21
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jbe 0x8c2ade
ja 0x8c2ab2

Function at 0x904bc3
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
je 0x8c2ade
jne 0x904b98
Function at 0x905478
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push ax
jmp 0x90554d
jmp 0x9054e3
push dword [esp]
jmp 0x9054b1
lea esp, [esp + 8]
cmp dword [ebp + 0xc], 2
jb 0x8c2bce
bsf edx, esp
jmp 0x90552e
cmp dword [ebp + 0xc], 3
jmp 0x905507
shl edx, 8
or eax, edx
lea esp, [esp + 4]
jmp 0x8c2bce
jne 0x8c2b9f
pushal
push ebx
jmp 0x90553f
clc
or eax, ecx
lea esp, [esp + 0x20]
jmp 0x8c2b9f
movzx edx, byte [ecx + 1]
stc
pushfd
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x9054f9
mov ebx, ecx
add ebx, 2
movzx ecx, byte [ebx]
pop ebx
sub esp, 0
jmp 0x905511
lea esp, [esp + 2]
jmp 0x90558a
mov edx, esp
cmc
jmp 0x90558f
push ebx
push esi
push edi
jmp 0x905574
mov ecx, eax
cmc
rcl dx, 8
jmp 0x90595d
stc
shr esi, 0xc
and ecx, edx
pushfd
call fcn.009055ce
mov word [esp + 3], bx
bsr edx, esi
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
pop edx
jmp 0x905609
inc dl
and dx, 0x4c3
shr ecx, 0x12
dec dh
sub esp, 0x1b
jmp 0x905698
push 0x3f
pushfd
mov dx, word [esp + 1]
mov esi, eax
jmp 0x905838

Function at 0x9b534d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [edi - 0x7f]
mov word [esp + 0x15], sp
setbe ah
lea esp, [esp + 0xf]
pop eax
push dword [esp + 2]
jmp 0x9b5394
lea edx, [edi*4]
xchg dl, dh
not dx
xchg word [esp + 8], dx
mov dword [esp + 0xc], eax
jmp 0x9b532d
setae dl
push dword [esp + 0xc]
mov bp, 0x7c2d
mov dword [esp + 0xd], esi
jmp 0x9b53a9
rdtsc
pop ebp
xchg bp, dx
xchg byte [esp + 9], dl
push edi
mov ah, 0xcb
jmp 0x9b5364
mov dl, al
lea edx, [ecx + edx]
xchg byte [esp + 3], al
lea ebp, [ebx + ebp]
push dword [esp + 7]
lea ebp, [eax + edi]
jmp 0x9b537a
mov dx, cx
not al
push dword [esp + 1]
lea esp, [esp + 2]
mov ah, byte [esp + 0xb]
mov ebp, dword [esp + 0x12]
jmp 0x9b53ee
setle dl
rdtsc
mov bp, cx
mov edx, dword [esp + 0x14]
call fcn.009b541c
test al, 0xcb
bound ebx, qword [ebp - 0x74990014]
invalid
mov ax, si
lea esp, [esp + 1]
mov dx, 0xbed8
mov dh, byte [esp]
mov edx, dword [esp]
mov edx, 0xde0b5690
jmp 0x9b53d7

Function at 0x9b80ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ax, ax
neg dx
xchg byte [esp + 1], cl
add esp, 2
jmp 0x9b80ce

Function at 0x9b84b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bp, cx
std
rcr bl, 2
mov bl, al
rcl ecx, 0x1e
jmp 0x9b847f
Function at 0x9b884a
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
push word [esp + 1]
add esp, 5
rcl bh, 2
jmp 0x9b885a
mov byte [esp + 1], dh
mov dx, 0x795e
xchg byte [esp + 6], al
rdtsc
jmp 0x9b8834
mov ebx, dword [esp + 2]
mov dx, sp
mov esi, dword [esp + 5]
std
lea esp, [esp + 3]
mov bl, byte [esp + 2]
jmp 0x9b88c5
lea esp, [esp + 1]
xchg byte [esp], ah
mov dl, byte [esp + 1]
mov edi, dword [esp]
pushfd
jmp 0x9b88a0
neg esi
cpuid
xchg dword [esp], esi
mov ecx, esp
lea esp, [esp + 2]
pop ax
jmp 0x9b88f0
mov byte [esp + 1], dl
std
or cx, bx
xor al, 0xad
bswap ebp
mov cl, bl
jmp 0x9b8870
cpuid
shr ebx, cl
adc edx, ecx
sub esp, 3
lea esp, [esp + 2]
lea ebx, reloc.KERNEL32.dll_GetStartupInfoA
jmp 0x9b88ff
mov bh, cl
lea esp, [esp]
cld
rol ax, cl
cpuid
xchg bh, dl
jmp 0x9b88d5
rdtsc
xchg byte [esp], ch
mov bh, 0xa
mov edx, edi
xchg word [esp], bx
lea esp, [esp + 1]
jmp 0x9b89bc
mov dword [esp + 4], ebp
xchg byte [esp + 0x12], cl
add esp, 0x14
cmp bp, 0xa937
jmp 0x9b895f
not ch
mov bh, bl
bswap esi
pushfd
inc dh
pushal
jmp 0x9b893d
not edi
lea esi, [ebp + 0x7a]
btr ebx, edx
bt edx, esi
pop dword [esp + 6]
mov bx, dx
jmp 0x9b8998
bsr edx, eax
dec dl
mov byte [esp], bh
cld
cpuid
mov byte [esp], ah
jmp 0x9b8953
xchg dword [esp + 1], edx
push dword [esp + 0xb]
mov word [esp + 0xd], si
pop word [esp + 0xb]
mov bp, bx
pop edx
jmp 0x9b8a08
cmp bp, sp
mov bl, 9
mov byte [esp], al
xchg bl, bh
mov bp, word [esp]
mov ax, 0xb446
jmp 0x9b8988
xchg dword [esp + 6], esi
add esp, 0xb
call fcn.009b89e6
lea esp, [esp + 2]
pop word [esp + 5]
lea eax, [edi*4]
jmp 0x9b8a74
rdtsc
xchg word [esp + 1], bp
xchg byte [esp + 1], dh
lea ebx, [ecx + esi]
mov dl, bh
jmp 0x9b8b4b
mov word [esp + 8], sp
mov eax, esi
inc eax
pop word [esp + 1]
mov esi, 0xcc596f53
pop dword [esp]
jmp 0x9b8a5e
mov dl, 0xdc
mov ebp, 0xf3b8245
sub esp, 0x10
bsr edx, ecx
cpuid
cld
jmp 0x9b8b12
xchg bh, ah
xchg byte [esp], al
btc ecx, esi
cpuid
btc di, cx
setbe dh
jmp 0x9b8ab3
dec bx
sbb dh, 0xaa
bts cx, ax
mov ebx, edi
bsf ax, bx
pop dx
jmp 0x9b8ac9
add esp, 0xf
mov al, bh
pop si
mov edi, edx
call fcn.009b8afc
rol di, 0
bswap ebp
lea ebp, [ecx + edi]
stc
xchg byte [esp + 2], ch
mov byte [esp], ah
jmp 0x9b8c15
lea esi, [edi*4]
cmp ecx, ebp
pop ax
std
ror ah, cl
mov ah, byte [esp + 2]
jmp 0x9b8ae9
setb bl
push dword [esp + 2]
call fcn.009b8b95
xchg ebx, edi
bsf ax, bp
mov ch, 0x1d
dec esi
neg esi
neg bp
jmp 0x9b8c74
mov ebp, esi
bsf eax, edi
lea edx, [esi*4]
mov dl, al
mov ch, 0x50
call fcn.009b8c5e
push word [esp + 2]
xchg dword [esp], ecx
xchg byte [esp + 4], ah
dec dx
rdtsc
jmp 0x9b8ccc
not bh
mov ebx, edi
mov word [esp + 5], sp
call fcn.009b8ce2
mov dh, 0x3c
sal byte [ebp + 0x2889a644], cl
dec ebx
mov si, word [esp + 5]
push dword [esp]
mov ecx, dword [esp + 6]
xchg byte [esp + 2], bh
not eax
inc ch
jmp 0x9b8cb5
Function at 0x9b8ee1
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
cld
rdtsc
sub esp, 3
xchg ebp, eax
push word [esp + 6]
jmp 0x9b8e68
mov ch, byte [esp + 1]
mov eax, 0xe8b3dd76
pop esi
neg ebp
mov bx, word [esp + 0xa]
lea edx, [ebp + ebp]
jmp 0x9b8e22
mov ebp, dword [esp + 6]
pop word [esp + 5]
cld
push esi
setp ah
jmp 0x9b8eb4
mov ecx, dword [esp + 0x16]
xchg cx, bp
pop edi
mov byte [esp + 0x12], bl
neg ebx
xchg bp, bx
jmp 0x9b8e52
rcl dx, 5
mov bx, 0x31d4
sub esp, 0x13
lea eax, [edx*4]
mov byte [esp + 0xc], bh
mov eax, dword [esp + 0xc]
jmp 0x9b8e3b
rdtsc
mov cx, 0x68cc
call fcn.009b8ec2
or dword [esi + reloc.KERNEL32.dll_GetStartupInfoA], ebx
outsd dx, dword [esi]
jbe 0x9b8f13
mov al, byte [0x2474ffe3]
or eax, dword [esi + reloc.KERNEL32.dll_GetStartupInfoA]
push dword [esp + 0xb]
xchg cl, dh
mov al, 0x5d
inc ebx
stc
neg edi
jmp 0x9b8e9e
xchg dword [esp], ecx
xchg ecx, esi
mov bl, byte [esp]
stc
lea edi, [ecx*4]
jmp 0x9b8e82
dec ebx
invalid

Function at 0x9b8f01
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [esp + 0x19]
add ax, 0xf73
mov ax, word [esp + 0x15]
lea edx, [ebp*4]
jmp 0x9b8ef3
mov bh, 0x47
mov bh, byte [esp + 0x19]
push si
call 0x9b8f01
xchg edi, eax
stc
mov dl, 0x72
mov dx, bx
jmp 0x9b8f4d
cpuid
mov dword [esp + 5], eax
cld
add esp, 0xb
mov byte [esp], cl
shr dh, 3
jmp 0x9b8f60
mov ecx, dword [esp]
or dh, 0x77
lea esp, [esp + 0x19]
xchg edx, eax
neg al
xchg di, bx
jmp 0x9b8f37
mov cx, word [esp]
btc edx, esi
bt eax, ebx
xchg byte [esp], dh
dec bp
mov si, di
jmp 0x9b8fcf
bswap edx
mov bx, word [esp]
mov di, 0xc3d1
cld
not dx
not bh
jmp 0x9b8fe1
mov al, 0x2e
bsf eax, ecx
std
mov ax, word [esp]
mov al, 0xe4
mov bx, dx
jmp 0x9b8f98
inc ax
add esp, 0
mov byte [esp], bh
neg edx
mov byte [esp], ah
mov di, sp
jmp 0x9b8fae
rdtsc
mov edx, 0x442679c2
xchg esi, eax
rdtsc
sub bh, 0xaa
bswap edi
jmp 0x9ba472
clc
mov ebx, 0x7ed790cc
mov dx, 0x131a
rdtsc
call fcn.009b8ff7
lea ebx, reloc.KERNEL32.dll_GetStartupInfoA
dec dx
mov ecx, 0xf5415068
mov cl, 0xc1
cmc
bsf cx, cx
jmp 0x9b9090
pushfd
lea esp, [esp + 0x44]
clc
mov ecx, 0xc457060c
stc
btr eax, edi
jmp 0x9b901a
shl ebp, 0x1c
dec dh
popal
call fcn.009b9070
mov word [esp], di
lea esp, [esp + 3]
push eax
push esp
mov dword [esp], ecx
call fcn.009b90d5
nop
adc ecx, dword [edx + reloc.KERNEL32.dll_GetStartupInfoA]
add al, 0x9c
lea esp, [esp + 1]
mov byte [esp], dl
jmp 0x9b909b
inc dh
lea ebp, [ebp - 0x49]
sub esp, 0x1d
mov cl, ah
mov ecx, esi
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
jmp 0x9b9049
xchg ebp, esi
rdtsc
xchg word [esp + 0x19], ax
mov cx, word [esp + 0x1f]
neg bl
mov si, 0xc4c7
jmp 0x9b90f9
pop word [esp + 6]
push dword [esp + 7]
lea edx, [ecx*4]
cld
mov byte [esp + 0x11], dh
lea esi, reloc.KERNEL32.dll_GetStartupInfoA
jmp 0x9b9192
mov dx, 0xbe9c
xchg byte [esp], cl
rdtsc
bswap ebp
cpuid
pushal
jmp 0x9b9663
setne ah
cld
mov cl, byte [esp]
mov ecx, dword [esp]
rdtsc
add esp, 0
jmp 0x9b9a34
mov cl, byte [esp]
mov bx, di
xchg byte [esp], dh
bt eax, eax
mov ah, 2
bts si, ax
jmp 0x9ba299
Function at 0x9b9126
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 3]
mov byte [esp + 5], al
mov dword [esp + 1], ebx
mov dword [esp + 4], ebp
jmp 0x9b913e
jmp 0x9b9110