joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432f75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x432fbf
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x432f66
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x432f75
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x838c18
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x432fc6
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.00419e3c
cmp eax, dword [ebp + 0xc]
pop eax
je 0x433065
add edi, 4
add eax, 2
dec ecx
jne 0x432fab
call 0x433012
loope 0x433008
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x433062
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x433073
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x433026
cmp eax, ecx
ja 0x433026
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4330b0
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4330a6
lea edi, [ebp - 0x100]
push pe_nt_image_headers32
push edi
push esi
call fcn.0041a31b
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x48bf9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edx
jmp 0x48bfd9
push edx
call fcn.0048bfa1

Function at 0x48bfdf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
jmp 0x48c4c3
push dword [esp + 7]
lea esp, [esp + 1]
mov dword [esp + 0x10], esp
call fcn.0048c215
lea esp, [esp + 3]
mov dword [esp + 8], ebx
push esp
push word [esp + 1]
lea esp, [esp + 1]
push edx
jmp 0x48c33a

Function at 0x48c18a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, byte [esp]
mov bp, word [esp]
sub esp, 2
jmp 0x48c128
mov bl, byte [esp]
mov bp, word [esp]
sub esp, 2
lea esp, [esp + 2]
mov edi, dword [esp + 0x28]
xchg ebp, eax
rdtsc
lea edx, [edx*4]
jmp 0x48c149
rdtsc
sub esp, 0xc0
jmp 0x48c12e
lea esp, [esp + 2]
jmp 0x48c0ff
mov ebp, esp
cmc
jno 0x48c16f
jo 0x48c16f
call fcn.0048c13a
mov bl, 0x48
lea esi, [esp]
mov ecx, 0xfee071d4
lea ebp, [ecx + edx]
lea ebp, [eax + 0x61]
jmp 0x48c10f
lea esp, [esp + 0x54]
pushfd
stc
jp 0x48c0f1
jnp 0x48c0da
call fcn.0048c1b4
mov dword [esp + 0x14], ebp
lea esp, [esp + 3]
mov dword [esp + 0x54], edi
jmp 0x48c161

Function at 0x48c1a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], di
pop dword [esp + 7]
call fcn.0048c18a

Function at 0x48c1b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x48c1f1
dec cx
jg 0x48c174
rcl dx, cl
jmp fcn.0048c1f4
rcl dx, cl

Function at 0x48cafa
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, al
lea edx, [esi*4]
jmp 0x48cbad
mov dh, byte [esp + 1]
bswap eax
neg ax
jg 0x48cc41
sub esp, 0x18
add esp, 3
jmp 0x48cbfc
lea esp, [esp + 1]
jmp 0x48cc20
jmp 0x48cd0a
add esp, 3
lea esp, [esp + 1]
lea esp, [esp + 0x18]
add cl, 0xec
neg ah
ja 0x48cc02
lea edx, [ebx*4]
lea eax, [ebp - 0x67]
inc dx
push esp
jmp 0x48cc7a
sub esp, 0x18
jmp 0x48cc19
add eax, ebp
jmp 0x48cc80
lea esp, [esp + 0x20]
neg cl
bts eax, ebx
jns 0x48cc46
add eax, ebp
mov eax, 0x1e4cd712
xchg ah, dh
jmp 0x48cce9
mov eax, dword [esp + 3]
jmp 0x48cc9f
mov eax, 0x1e4cd712
xchg ah, dh
bsf ax, ax
setb dh
not eax
jmp 0x48cccd
push esp
mov eax, dword [esp + 3]
pop word [esp]
mov dh, byte [esp + 1]
pushal
lea esp, [esp + 2]
jmp 0x48cc5d
dec cl
mov edx, 0x70e441c8
sete dh
mov dx, word [esp]
bsf ax, si
jmp 0x48cd9d
lea eax, [ecx + 0xd3]
mov ax, word [esp]
setnp ah
jmp 0x48ccae
bsf ax, ax
setb dh
jmp 0x48cc8e
and ecx, 0x3c
mov edx, 0xb6229e74
bsf dx, ax
je 0x48cd35
mov ax, word [esp]
jmp 0x48cd82
lea edx, [ebx*4]
lea eax, [ebp - 0x67]
inc dx
jmp 0x48cc9a
mov ax, word [esp]
rol dh, 3
sub esi, 4
mov eax, dword [esp]
lea eax, [esi*4]
bswap edx
jmp 0x48cd51
jmp 0x48cd18
lea ebx, [ecx + ebx]
mov edx, dword [ebx]
pop ebx
lea eax, [ebx*4]
bsf cx, si
jmp 0x48cd87
mov edx, esp
push ebx
mov ebx, ebp
jmp 0x48cd37
sub esp, 0x16
pop word [esp + 0xf]
jmp 0x48ce07
rol dh, 3
jmp 0x48cd1f
jge 0x48cd58
sub esp, 0x16
pop word [esp + 0xf]
jmp 0x48cd60
jl 0x48ccf2
jge 0x48ccf2
mov dword [esi], edx
mov cl, ch
mov dl, byte [esp]
mov ecx, eax
mov cx, word [esp]
jmp fcn.0048cd65
Function at 0x49aac1
Capabilities:
Encode data using xor

Disassembly:
or byte [esi + 0x3db908f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x546caf5c
invalid
pushal
pop word [esp + 0x15]
lea esp, [esp + 2]
jmp 0x49aac3
jmp 0x49aaa6
mov dword [esp + 0x1c], 0x47df1a
mov eax, 0xd0596bee
lea eax, [eax - 0x61]
imul ebx, dword [ecx - 0x30], reloc.KERNEL32.dll_LeaveCriticalSection
inc eax
lahf
jmp 0x49aaf0
push ss
lea ebx, reloc.KERNEL32.dll_LeaveCriticalSection
push ds
mov ebx, gs
xchg ebx, eax
out dx, eax
mul cl
and byte [ebx - 0x73], ah
and al, 0x14
ret
lea esp, [esp + 0x1c]
mov eax, dword fs:[0]
call fcn.0049ad3f
xchg dword [eax], ebx
mov gs, ecx
sbb ah, bl
cmc
in al, 0x25
pop ebp
jo 0x49aad5
and eax, 0x7fca705d
cli
jg 0x49ab07
jl 0x49aa90
or eax, eax
mov bl, 0x94
cmp al, 0x95
loop 0x49ab32
pop ax
outsb dx, byte [esi]
scasd eax, dword es:[edi]
cwde
loopne 0x49ab59
in al, 0x75
aam 0x2d
salc
stosd dword es:[edi], eax
cmp eax, 0xe5f7cfe5
inc eax
fistp word [ecx]
pushfd
xor dword [edx], reloc.KERNEL32.dll_LeaveCriticalSection
inc esi
inc esp
invalid
push edx
xchg ebp, eax
loop 0x49ab65
jl 0x49aacd
test dword [edi + 3], esi
cmp bl, dh
ljmp 0xb32
sbb eax, 0xe4a27aa1
clc
inc esi
pop ebp
jl 0x49ab9b
mov edx, 0xeb1a90cd
nop
sbb ch, bl
mov eax, 0x2adfb82a
call 0xbb28fb4c
dec ecx
jecxz 0x49abe5
loopne 0x49abed
adc eax, esp
pop esi
mov ds, word [0xe427d48d]
clc
outsb dx, byte [esi]
cld
wait
jbe 0x49ab46
ljmp 0xd034:0x85761383
fidivr dword [ebp - 0xe9977b4]
popal
add bl, dh
inc eax
push 0xf20760f2
xor ebp, dword [edx - 9]
pop es
xor ebp, dword [edx - 9]
add dh, cl
dec esi
jo 0x49ab8e
jle 0x49abc1
call 0x954f49db
cld
lss ebp, [eax]
mov dh, 0x24
inc ebx
mov esi, 0x3bab3a0b
pop esi
lodsd eax, dword [esi]
outsd dx, dword [esi]
push eax
int3
push ss
invalid
lds ecx, [ebx - 0x2d]
inc ebx
aad 0x6c
rcl dword [edx + ecx*8 - 0x53], cl
pop esp
ljmp 0x72c3
push esp
retf 0x5cad

Function at 0x4ac030
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 0x11]
xchg edx, edi
jmp 0x4ac0b5
jmp 0x4ac702
lea esp, [esp + 4]
jle 0x47eeb8
jg 0x4ac083
mov ebx, 0x2fdcb525
out dx, eax
retf
lea esp, [esp + 0x20]
mov ecx, 0xff
jmp 0x47ee99
pushal
xchg di, cx
jmp 0x4ac055
lea ecx, [eax - 1]
mov edi, 0x61dddea2
mov dl, dh
mov dword [ebp - 4], ecx
jmp 0x4ac06c
lea edx, [ecx*4]
add esi, 0x10
mov edi, dword [esp]
push ecx
jmp 0x4ac0cb
bswap edx
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
neg edx
mov di, word [esp]
adc di, 0x41fc
jmp 0x4ac092
mov ecx, esi
mov edx, dword [ecx]
pop ecx
mov di, 0x4ee3
pushal
jmp 0x4ac137
pushal
lea edi, [ecx + edx]
add edi, ebp
xor si, 0x85cc
mov dword [esp], edx
call fcn.004ac115
dec cl
push 0xfc48a8b
enter 0xffffffffffffd0f6, 0xffffffffffffff8b
inc ebp
clc
mov di, 0x668b
jmp 0x4ac0d7
push esp
mov word [esp], bx
pushal
mov byte [esp + 8], ch
jmp 0x4ac77c
pop ebx
pushal
lea esp, [esp + 0x20]
leave
jmp 0x4ac85d
lea esp, [esp + 0x28]
pop esi
lea ebx, [edx + ebx]
lea ebx, [esi*4]
lea ebx, [ebp*4]
jmp 0x4ac744
mov edi, dword [esp + 0x24]
lea esi, [esi - 0xed]
mov esi, 0x4592b4fa
mov esi, 0xfc8483de
jmp 0x4ac75e
ret
push esp
mov dword [esp], ebp
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x4ac839
Function at 0x4ac2d2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x4ac347
lea esp, [esp + 1]
add esp, 0
call 0x4ac325
mov byte [esp], bh
call 0x4ac331
shr edi, 0x18
sub esp, 0x14
mov byte [esp + 8], bh
mov edi, dword [edi*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4ac8cb
lea esp, [esp + 2]
and edx, ecx
call fcn.004ac3b3
mov edx, dword [esi + 8]
jmp 0x4ac424
movzx ebx, byte [esi + 9]
cmc
push edx
push word [esp + 1]
sub esp, 8
jmp 0x4ac3da
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
bswap edi
jmp 0x4ac472
mov dword [esi + 4], edi
jmp 0x4ac40b
pop dword [esp + 0xc]
pop word [esp + 9]
lea esp, [esp + 2]
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4ac3fb
mov edi, edx
sub esp, 0x18
mov byte [esp + 6], ch
shr edi, 0x18
call fcn.004ac455
clc
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
mov bx, 0x6367
sub ebx, ebp
jmp 0x4ac4b3
xchg bl, bh
lea ebx, [edx + edi]
jmp 0x4ac4fe
and ebx, ecx
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
lea ebx, [esp + ebp]
mov bx, word [esp]
cmc
jmp 0x4ac50c
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
stc
jmp 0x4ac4e4
movzx ebx, byte [esi + 0xd]
sub esp, 2
sub esp, 0x12
and edx, ecx
jmp 0x4ac51e
pushal
mov edx, dword [edx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
cmc
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x4ac54a
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
stc
and ebx, ecx
sub esp, 0xc
pushal
jmp 0x4ac43b
and edx, ecx
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
call fcn.004ac700
sub al, 0xc3
push ebx
lds eax, ss:[edx]
adc al, byte [edx + ebx - 0x4ec57383]
mov al, 0x8d
and al, 0x50
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
mov bx, 0x1d57
movzx ebx, byte [esi + 6]
jmp 0x4ac537
sub esp, 0x1e
push dword [esp + 0xe]
lea esp, [esp + 2]
and ebx, ecx
jmp 0x4ac56a
cmc
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
stc
jmp 0x4ac7a2

Function at 0x4ac455
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x4ac4cb
mov byte [esp + 7], bh
and edi, ecx
jmp 0x4ac4a6
mov edi, dword [edi*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
push edx
and ebx, ecx
clc
jmp 0x4ac483
push edx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
sub esp, 0x1a
mov byte [esp + 0x12], ch
pop word [esp + 3]
jmp 0x4ac457
Function at 0x4ac57f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
shr edi, 0x18
jmp 0x4ac5f2
lea esp, [esp + 1]
and ebx, ecx
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4ac5d1
push edx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
sub esp, 2
stc
lea esp, [esp + 1]
jmp 0x4ac59d
mov ebx, dword [esp]
mov ebx, 0xd59b8c9c
mov ebx, 0xb8f15e7e
jmp 0x4ac641
mov edi, dword [edi*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
and edi, ecx
pushal
pop dword [esp + 8]
mov word [esp + 0x16], sp
jmp 0x4ac5bf
and edx, ecx
sub esp, 0x1c
push word [esp + 0x19]
lea esp, [esp + 2]
jmp 0x4ac64c
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
push edx
pushal
mov word [esp + 0x20], sp
jmp 0x4ac607
movzx ebx, byte [esi + 0xe]
clc
cmc
sub esp, 0xc
jmp 0x4ac624
mov edx, dword [edx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
and ebx, ecx
lea esp, [esp + 0x4c]
jmp 0x4ac677

Function at 0x4ac700
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
cmc
call fcn.004ac598
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
push esp
push dword [esp]
mov byte [esp + 5], dh
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x4ac6d4
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [esp]
push edx
jmp 0x4ac66f
mov edx, dword [esi + 0xc]
push edx
mov byte [esp + 2], bh
mov dword [esi + 8], edi
jmp 0x4ac695
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4ac6e4
and edx, ecx
push edx
pop word [esp]
mov byte [esp], bh
lea esp, [esp + 2]
jmp 0x4ac6bc
dec dword [ebp - 4]
push esp
pop word [esp]
push word [esp + 1]
jmp 0x4ac73c
jmp 0x4ac6af
mov dword [ebx], edi
pop ebx
pushal
lea esp, [esp + 0x24]
jne 0x47ee99
je 0x47eeb8
or byte [ecx], 0x99
clc
or edi, dword [esi - reloc.KERNEL32.dll_LeaveCriticalSection]
fimul word [ebp - 0x2314f3a5]
push ebx
mov ebx, esi
lea ebx, [ebx + 0xc]
jmp 0x4ac720
Function at 0x4b53cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
mov dword [esp + 0x1c], esi
lea esp, [esp + 8]
popal
mov dword [edx], ecx
jmp 0x4b5353

Function at 0x4b541c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esi]
lea edx, [ebp*4]
mov dl, 0x7c
jmp 0x4b5425
xchg edx, eax
pushfd
jmp 0x4b53ef
xchg byte [esp], dh
mov edx, dword [esp + 3]
jmp 0x4b5405
lea eax, reloc.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [esp]
jmp fcn.0048c21d
Function at 0x4b982e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
lea esp, [esp + 3]
jmp 0x4b9826
xchg edx, ecx
call 0x4b982e
and cl, byte [ecx + 0x66602434]
pop dword [esp + 0xf]
lea esp, [esp + 2]
jmp 0x4b98b1
pushfd
pop dword [esi]
lea ecx, [esp + esi]
xchg ecx, eax
jmp 0x4b9858
mov dword [esi + 8], eax
lea ecx, [ecx + 0xb3]
not cl
seto ch
mov ch, bh
jmp 0x4b986f

Function at 0x5bc6d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x1e]
pop dword [esp + 0x16]
cld
xchg byte [esp + 0xa], dl
pop esi
xchg byte [esp + 0x14], dh
jmp 0x5bc6ed
jmp 0x5bc6b6
lea esi, reloc.KERNEL32.dll_LeaveCriticalSection
bswap esi
mov al, 0xe6
mov edx, dword [esp + 0x19]
pop ax
mov dx, bx
jmp 0x5bcba2
rdtsc
mov dh, 0x62
mov word [esp + 0x12], di
xchg word [esp + 0x20], ax
xchg edx, esi
jmp 0x5bc6d3
push dword [esp + 4]
mov dh, bh
bsr si, cx
lea esi, [ecx*4]
jmp 0x5bc72b
mov ax, bx
sub esp, 6
pop word [esp + 2]
xchg dx, si
mov al, ah
inc al
jmp 0x5bc742
bsr ax, bp
pop word [esp + 0x10]
mov si, 0x1d99
cmc
shr eax, 1
neg dx
jmp 0x5bc759
pop dword [esp + 0x10]
pop si
neg si
lea eax, [esi + 0x75]
mov byte [esp + 0x1b], ah
pop word [esp + 3]
jmp 0x5bc7b3
mov word [esp + 0xe], bx
bsr si, bp
xchg edx, eax
cld
mov dh, byte [esp + 5]
inc si
jmp 0x5bc86c
xchg si, ax
mov byte [esp + 0x19], dh
pop word [esp + 0xb]
cld
mov word [esp + 0xd], dx
mov dl, 0xb4
jmp 0x5bc95a
pop word [esp + 0x15]
bswap edx
bt eax, ebx
sub esp, 6
rol dx, cl
rdtsc
jmp 0x5bcb51
mov ax, 0x5dbb
lea edx, [edx + ebx]
mov word [esp + 0x1c], dx
mov dl, 0x2c
mov word [esp + 0xb], bx
ror dh, 5
jmp 0x5bcb87

Function at 0x5bc971
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0xd0f9
jmp 0x5bc9bc
lea esi, [esi - 0x75]
mov byte [esp + 0xb], ch

Function at 0x5bcf9a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, dl
neg eax
xchg dword [esp + 4], edx
mov dh, 0x7a
sub esp, 0x1e
sub esp, 8
jmp 0x5bcfd0
btr edx, esp
jmp 0x5bcf78
xchg dx, ax
xchg word [esp + 0x13], ax
xchg dword [esp + 0xb], eax
mov dh, ch
mov ax, si
jmp 0x5bcfe1
pushal
mov dx, 0x86b3
mov esi, ecx
bswap edx
mov si, word [esp]
mov eax, edx
jmp 0x5bcf9f
lea esp, [esp + 0x45]
mov dh, byte [esp]
clc
rdtsc
bswap esi
mov ax, bx
jmp 0x5bcfb7
ror esi, 0x11
lea eax, [ebx*4]
push dword [esp]
pop dword [esp + 0xe]
shr ax, cl
jmp 0x5bd1fa
mov byte [esp + 0x13], dh
mov eax, ebp
mov byte [esp + 9], dh
mov edx, esi
xchg edx, eax
neg eax
jmp 0x5bd018
bswap esi
sub esp, 6
lea esp, [esp + 0x46]
pushal
mov ax, dx
mov word [esp + 0xe], di
jmp 0x5bd034
pop esi
push dword [esp + 0x16]
pushal
xchg word [esp + 1], ax
xchg byte [esp + 0xb], dh
stc
jmp 0x5bd123
Function at 0x5bd399
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf si, si
lea eax, reloc.KERNEL32.dll_LeaveCriticalSection
neg dh
mov dl, dh
mov si, word [esp + 0x28]
mov eax, 0xf0c5a1dc
jmp 0x5bd3b2
inc si
xchg word [esp + 0x10], dx
rdtsc
mov ah, byte [esp + 0xb]
pushal
mov eax, 0xaf1d6774
jmp 0x5bd34e
jmp 0x5bd37a
shl esi, 0x15
pop dx
mov ax, di
mov al, ah
mov edx, 0xeb3ad51a
jmp 0x5bd3cc
rol ax, cl
mov dx, word [esp + 0xa]
bswap edx
rcl edx, 5
xchg word [esp + 0x32], dx
lea esi, reloc.KERNEL32.dll_LeaveCriticalSection
jmp 0x5bd39b
rol dh, 3
sub edx, esi
pop dword [esp + 0x1a]
rcr dh, 7
xchg dx, si
clc
jmp 0x5bd43c
mov esi, dword [esp]
cmc
neg dh
mov esi, dword [esp]
xchg byte [esp], dh
bswap eax
jmp 0x5bd480
cmc
not esi
xchg edx, eax
mov si, cx
bswap eax
add esp, 0x2d
jmp 0x5bd417
lea eax, [eax + edi]
pop dword [esp + 7]
pop dword [esp + 0xd]
rcr eax, 0xf
mov eax, dword [esp + 3]
mov byte [esp + 0xd], ah
jmp 0x5bd4a4
mov ax, word [esp + 1]
mov dx, 0xaf25
pushal
xchg word [esp + 0x12], dx
not edx
jmp 0x5bd45b
neg eax
pop word [esp + 6]
lea eax, [eax*4]
bswap edx
bswap esi
jmp 0x5bd4f8
add esp, 7
sbb esi, esi
xchg dword [esp + 2], esi
xchg word [esp + 7], si
pop word [esp + 5]
neg esi
jmp 0x5bd540
pop dword [esp + 1]
mov word [esp + 9], di
pop dword [esp + 0xa]
rdtsc
mov dx, 0xc405
setae ah
jmp 0x5bd4d3
mov dl, dh
ror eax, 0x1f
rol dh, 3
mov si, ax
sub esp, 0x1a
jmp 0x5bd555
add esp, 1
bt esi, ebx
mov dh, ch
rcl esi, 0x19
mov eax, 0x84f4a0b6
mov word [esp], di
jmp 0x5bd510
lea edx, [esp + esi]
mov edx, 0x6fe98568
pop esi
xchg edx, esi
bsr ax, bp
bsr ax, cx
jmp 0x5bd526
mov dx, word [esp + 0x11]
neg esi
xchg edx, eax
not dh
bswap edx
rcr eax, 3
jmp 0x5bd593
mov word [esp + 0x13], dx
not eax
xchg ah, dh
push word [esp + 0x11]
call fcn.005bd5dd
sub eax, 0x81660f3c
out dx, al
cmp byte [eax - 0x76], dh
mul dword [esi + 0x5e]
mov ah, byte [esp + 0x13]
xchg dh, al
mov al, 0x8e
lea esp, [esp + 6]
mov word [esp + 0x13], di
mov eax, 0x1970a916
jmp 0x5bd566

Function at 0x5bd5b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
add esp, 0x1f
lea edx, [edx + ebx]
xor edx, esi
push edx
lea esp, [esp + 3]
jmp 0x5bd25d
lea esp, [esp]
mov al, ah
btr edx, edx
xchg ah, dh
inc esi
rol edx, 0xf
jmp 0x5bd20f
mov eax, 0x904440a4
mov si, ax
call fcn.005bd2a7
test al, 0x27
mov bh, 0xd2
and eax, eax
salc
pop eax
into
test eax, 0x2435b658
push edi
add esp, 1
rdtsc
bswap esi
not ax
mov edx, ebx
lea esi, [esi*4]
jmp 0x5bd241
mov esi, 0x2ef32fdc
bswap eax
mov dh, byte [esp]
mov si, bx
xchg byte [esp], dh
mov edx, esp
jmp 0x5bd231
mov dh, bh
sub dh, ah
not ax
clc
mov dx, word [esp]
lea eax, reloc.KERNEL32.dll_LeaveCriticalSection
jmp 0x5bd276
rdtsc
mov edx, dword [esp]
mov byte [esp], ch
clc
setl ah
mov eax, 0x16ef2f2c
jmp 0x5bd2c6
sub si, 0x7038
mov dh, bh
pop si
setns dh
neg si
setg dh
jmp 0x5bd4bd
pop word [esp]
jmp 0x5bd57c
Function at 0x5bf583
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 5], bx
mov bl, 0xf8
xchg dword [esp + 3], edi
mov al, 0x96
mov word [esp + 2], dx
jmp 0x5bf5ef
neg esi
cmc
neg eax
mov dword [esp + 0xa], ecx
mov word [esp + 9], sp
jmp 0x5bf693
push esp
mov dx, sp
setle dh
mov bh, byte [esp + 2]
inc esi
mov di, dx
jmp 0x5bf5d9
xchg dword [esp + 0xc], ebx
lea ebp, [ecx + edi]
setge bh
bsr di, bp
lea esp, [esp + 0x12]
jmp 0x5bf77d
rdtsc
inc bl
mov dx, 0x9f4d
bswap edi
sub esp, 0
rdtsc
jmp 0x5bf61d
inc al
neg ah
cpuid
mov dword [esp + 4], ecx
lea eax, [ebx*4]
sub esp, 8
jmp 0x5bf635
pop di
mov ch, byte [esp + 9]
neg di
lea eax, reloc.KERNEL32.dll_LeaveCriticalSection
not ecx
jmp 0x5bf657
btr eax, edx
pop edx
mov cx, 0xc56b
xchg ch, dl
mov edx, eax
push dword [esp + 0xa]
jmp 0x5bf67c
mov dword [esp + 0x17], ebp
inc si
mov ecx, dword [esp + 0x16]
xchg word [esp + 0x37], bp
call fcn.005bf6a5
int1
pushal
pushal
xchg dword [esp + 0x10], edi
sub esp, 0x1a
shl bx, cl
xchg word [esp + 8], bx
neg ch
jmp 0x5bf6bd
cpuid
mov dl, dh
push word [esp]
add esp, 4
mov ebx, esi
inc si
jmp 0x5bf6d4
mov edx, dword [esp]
cpuid
xchg word [esp], cx
mov byte [esp + 1], bh
bsr si, bp
and di, 0x50a
jmp 0x5bf724
Function at 0x5bf816
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, dh
btr ebx, esp
not ah
mov ebx, dword [esp]
bswap ebx
mov di, word [esp]
jmp 0x5bf7bf
lea esp, [esp + 0x41]
jmp 0x5bf735
neg bh
lea edx, [edx + edi]
mov si, word [esp]
ror bh, 3
mov ax, 0xd1bf
push edx
jmp 0x5bf7d5
mov bp, word [esp]
btc eax, edi
cpuid
xchg byte [esp], dl
lea eax, [edx + esi]
jmp 0x5bf846
xchg bh, cl
lea ebp, [edi + ebp]
bsr si, bp
shr ch, 5
sub di, 0xbb48
setle dh
jmp 0x5bf795
xchg byte [esp], al
lea esi, [edx + ebx]
mov al, ah
pop si
mov byte [esp], ch
not eax
jmp 0x5bf7a8
xchg ch, dl
mov ch, byte [esp]
mov esi, dword [esp]
btr esi, edx
call 0x5bf816
aam 0x8a
les esp, [esi - 0x71]
add al, 0x24
jmp 0x5bf895
cpuid
rdtsc
shr bh, 3
cpuid
mov ebx, 0x28f3abf6
mov bh, byte [esp]
jmp 0x5bf805
mov esi, 0x6226a7ec
cld
mov ebp, 0xb1283f72
lea esi, [eax - 0x41]
add esp, 1
add esp, 0
jmp 0x5bf82e
push esp
neg ch
mov word [esp + 2], dx
mov dword [esp + 3], esi
xchg di, bp
xchg bh, cl
jmp 0x5c1113
add esp, 1
mov byte [esp], ah
mov bl, 0x80
push word [esp + 1]
cld
sub bl, ah
jmp 0x5bf85c
and cl, bh
lea eax, [ebp*4]
lea ecx, [edx + ebx]
lea esi, reloc.KERNEL32.dll_LeaveCriticalSection
lea ecx, [edx + ebx]
mov cx, bx
jmp 0x5bf876
cld
push word [esp + 5]
setp ch
pop word [esp + 1]
jmp 0x5c0c66
xchg ecx, ebx
pop dword [esp + 4]
mov dh, byte [esp + 6]
pop bx
pop bp
mov dx, sp
jmp 0x5c0c1e
lea ebx, [esp + ebx]
mov dl, 0x84
cmc
xchg dh, al
xchg byte [esp], bl
xchg ch, dl
jmp 0x5c0c8f
and bx, 0xdc22
add esp, 6
mov edi, 0xa0466ef8
cpuid
jmp 0x5c0c49
mov al, 0xbe
pop dword [esp + 1]
xchg byte [esp + 0xe], dl
rdtsc
not bh
bswap edx
jmp 0x5c0c36
mov byte [esp + 1], ah
mov al, ah
sub esp, 8
lea esi, [esi + 0x9d]
pop ax
stc
jmp 0x5c0cc1
cpuid
cpuid
mov ebp, dword [esp + 0xb]
mov dword [esp + 9], esi
bsf cx, ax
xchg dword [esp + 7], edi
jmp 0x5c0c7d
btr ebp, esp
pop word [esp]
xchg word [esp + 3], ax
lea esp, [esp + 2]
push word [esp + 4]
not ch
jmp 0x5c0d5f
mov byte [esp + 5], bh
push dword [esp + 7]
not esi
stc
lea ebp, [esp + ecx]
mov byte [esp + 3], ah
jmp 0x5c0cab
mov bp, di
clc
lea ebx, [eax - 0x49]
lea esp, [esp]
mov dh, byte [esp]
sub esp, 0x10
jmp 0x5c0ce8
xchg bh, cl
mov edx, 0xf09a7072
lea esp, [esp + 1]
lea edi, [eax - 0xa9]
lea esp, [esp + 1]
add edx, ebp
jmp 0x5c0d0a
bsr si, bp
mov ebp, dword [esp]
call fcn.005c0e1f
ror byte [esi - 0x24], 0xbb
push esi
mov eax, 0x1673e352
in eax, 1
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
in eax, 0x86
invalid
xchg dh, al
pop word [esp]
neg edi
xchg dh, al
pop word [esp]
mov word [esp], di
jmp 0x5c0d41
pop word [esp + 1]
xchg ah, bl
add esp, 3
neg di
mov edi, dword [esp]
stc
jmp 0x5c0d28
mov byte [esp + 3], dh
cmc
mov ebp, 0x4944b9cc
not bx
xchg bh, cl
lea esi, reloc.KERNEL32.dll_LeaveCriticalSection
jmp 0x5c0d7a
mov dh, byte [esp + 7]
clc
rdtsc
xchg dword [esp], esi
lea ebx, [eax + 0x99]
mov bp, 0xda2d
jmp 0x5c0e50