joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4

Function at 0x418e89
Capabilities:
Encode data using xor

Disassembly:
call 0x8b97d354
jne 0x418e98
cmp esi, dword [0x4d1944]
je 0xdb58f35
cdq
add byte [ebp + ecx - 0x75], dh
adc eax, 0x4d1924
mov edx, dword [0x4d1924]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x418eb7
push ecx
call 0xdb58f48
mov edx, dword [0x4d1924]
mov eax, dword [edx + esi*4]
and dword [eax], 0
dec dword [0xd4d1930]
mov edx, dword [0x4d1924]
cmp esi, dword [0x4d1934]
jne 0x418ee7
cmp esi, 3
jl 0x418ee1
mov eax, dword [edx + esi*4]
or esp, 0xffffffcc
int3
mov dword [0x4d1934], esi
mov ecx, dword [0x4d1928]
pop esi
cmp ecx, 3
jbe 0x418efc
mov eax, dword [edx + ecx*4 - 4]
int3
xor eax, 0x490d04dc
mov dword [0x4d1928], ecx
push 4
push dword [edx + ecx*4]
call 0xc129fde9
mov eax, dword [0x4d1924]
pop ecx
pop ecx
mov ecx, dword [0x4d1928]
and dword [eax + ecx*4], 0
mov ecx, dword [0x4d1928]
cmp ecx, 3
jbe 0x418efc
mov edx, dword [0x4d1924]
jmp 0x418ef3
Function at 0x46969a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fe27
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420e3c
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x4696f5
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x4696ec
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x471f78
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4d06e0], 1
jne 0x471f86
call fcn.00472062
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x471fbe
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
sub dword [0x4d06e0], 1
jne 0x471fd1
call fcn.00472062
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x472014
fadd qword [0x4c81c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4c8190]
leave
ret

Function at 0x472022
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d2630], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d262c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d2630], eax
inc edx
cmp edx, 0x870270
jl 0x47202e
mov dword [0x4d06e0], esi
mov dword [0x4d2ff0], esi
pop esi
ret
Function at 0x472062
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x472085
push 0
call fcn.0042e504
pop ecx
mov ecx, eax
call fcn.00472022
mov dword [0x4d06e0], 0x870270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x870634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x47209a
mov eax, dword [esi]
mov dword [ebp - 4], 0x87018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720d4
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret

Function at 0x47291a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea ecx, [ebp - 0xdc]
call fcn.0047276a
push dword [ebp + 8]
lea ecx, [ebp - 0xdc]
call fcn.004727ae
xor esi, esi
test ebx, ebx
je 0x47295e
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.004728ee
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jb 0x472949
pop edi
pop esi
pop ebx
leave
ret

Function at 0x472963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11b8
call fcn.00441f6c
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x994]
push edi
mov dword [ebp - 0x30], ebx
call fcn.004725f2
push 0x18f00
call fcn.0041fe27
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.0040573e
lea ecx, [ebp - 0x324]
call fcn.0047276a
xor edi, edi
xor esi, esi
push edi
push dword [ebx + 4]
inc esi
mov ecx, ebx
push dword [ebx]
mov dword [ebp - 0x1c], esi
call fcn.0040513b
push 0x4c63b8
push dword [ebp + 8]
call fcn.0042524e
pop ecx
pop ecx
push ecx
test eax, eax
mov ecx, ebx
lea eax, [ebp - 0x11b4]
push eax
push dword [ebp + 8]
jne 0x472a88
call fcn.00472e82
test eax, eax
jne 0x472a91
invalid
add byte [eax], al
invalid
lea eax, [ebp - 0xfac]
push eax
lea eax, [ebp - 0xda4]
push eax
lea eax, [ebp - 0xb9c]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call fcn.00472e82
test eax, eax
je 0x472a98
push 6
jmp 0xce2cd2
mov eax, dword [ebp + 0xc]
Function at 0x41a477
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a119

Function at 0x41a482
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a2a8

Function at 0x41a87c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00408ef0
mov eax, dword [0x431040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004183b6
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41a8be
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41aa1a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00425120
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47c488]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041ba4c
mov ecx, dword [esi*4 + 0x47c488]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41aa13
cmp eax, dword [edi + ecx + 0x24]
jne 0x41aa13
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41aa13
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041ba4c
add esp, 0x14
test edx, edx
jl 0x41aa13
jg 0x41a989
test eax, eax
jb 0x41aa13
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41aa13
jl 0x41a9a3
cmp dword [ebp - 0x1008], eax
ja 0x41aa13
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41a9c1
test ebx, ebx
je 0x41a9fa
cmp ecx, edi
jae 0x41a9fa
mov al, byte [ecx]
cmp al, 0xd
jne 0x41a9db
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41a9e7
cmp byte [ecx + 1], 0xa
jne 0x41a9e7
inc ecx
jmp 0x41a9e7
movzx eax, al
movsx eax, byte [eax + 0x431310]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41a9c1
cmp edx, ebx
jne 0x41a9c1
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41aa18
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00408148
leave
ret
Function at 0x41aeea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x47c488]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41af2a
cmp byte [ebx], 0xa
jne 0x41af2a
or byte [eax + edi + 0x28], 4
jmp 0x41af2f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41b02d
mov al, byte [edx]
cmp al, 0x1a
je 0x41b00f
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41af5e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41af83
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41af8d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41af40
jmp 0x41b02d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b00a
cmp dword [ebp - 0xc], 0
je 0x41b00a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x47c488]
test byte [eax + edi + 0x28], 0x48
je 0x41afe4
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41afcf
mov byte [esi], dl
jmp 0x41afe0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x47c488]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41b02d
cmp byte [ebp - 1], 0xa
jne 0x41aff3
cmp esi, ebx
jne 0x41aff3
mov byte [esi], 0xa
jmp 0x41b02c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041ba6a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41b02d
mov byte [esi], 0xd
jmp 0x41b02c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x47c488]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b029
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b02d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41b036
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x47c488]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b079
cmp word [esi], dx
jne 0x41b079
or byte [edi + eax + 0x28], 4
jmp 0x41b07e
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41b1d1
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41b1b1
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41b0c0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41b0f6
cmp eax, edx
jae 0x41b102
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41b098
jmp 0x41b1d1
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b1ad
cmp dword [ebp - 0x14], 0
je 0x41b1ad
mov eax, dword [ebx*4 + 0x47c488]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41b185
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41b14e
mov word [esi], cx
jmp 0x41b181
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x47c488]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x47c488]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x47c488]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41b1d1
pop ebx
cmp word [ebp - 4], bx
jne 0x41b196
cmp esi, dword [ebp + 0xc]
jne 0x41b196
mov word [esi], bx
jmp 0x41b1ce
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041ba6a
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41b1d1
push 0xd
jmp 0x41b1ca
mov ecx, dword [ebx*4 + 0x47c488]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b1c8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b1d1
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x85bfb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
jmp 0x85c16a
mov dword [esp + 8], edx
call 0x85bfed
jmp 0x85c0e3
rdtsc
neg ch
lea edi, [esp]
jmp 0x85c0f0
setp cl
rdtsc
rol dl, cl
jl 0x85c12c
sub cx, dx
jmp 0x85c111
pop word [esp + 1]
push dword [esp]
jmp 0x85c0ad
jmp 0x85c182
mov ebp, esp
mov cx, word [esp]
mov edx, esp
stc
jb 0x85c1e6
xchg dx, bx
jmp 0x85c1d3
sub cx, dx
call fcn.0085c14b
in eax, 0x8b
mov edx, dword [esp + 3]
btc ebp, edx
xchg dword [esp + 4], edi
jmp 0x85c154
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
or bp, 0xb9cb
mov bp, 0xbb3d
jmp 0x85c1b7
push word [esp + 3]
jbe 0x85c107
pop word [esp + 1]
push dword [esp]
mov dword [esp + 8], edx
jmp 0x85c0b1
sub esp, 0xc0
jmp 0x85c113
xchg dword [esp + 4], edi
push eax
pop ecx
mov ch, 0x69
neg cl
push dword [esp + 4]
ret 8
sbb ebx, ebp
lea edi, [edi - 0x23]
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
mov ax, 0x8f31
cpuid
mov cl, byte [esp]
jmp 0x85c198
xchg dx, bx
jmp 0x85c1d0

Function at 0x85c01b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf084b3e4
jmp 0x85c097
mov dword [esp + 0x28], esp
jmp 0x85c015
mov dword [esp + 0x28], esp
call 0x85c01b
mov ecx, dword [ecx + reloc.iphlpapi.dll_GetAdaptersInfo]
push edi
lea esp, [esp + 2]
mov dword [esp + 0x24], esi
call fcn.0085c059
and bl, byte [ebp - 0x54]
mov edi, 0x48f6686
pop word [esp]
mov byte [esp], bh
pop word [esp]
mov byte [esp], bh
push word [esp + 1]
je 0x85c011
jne 0x85bffb
lea esp, [esp]
mov byte [esp + 1], dh
push dword [esp + 5]
mov byte [esp + 5], cl
jmp 0x85c085
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
pushfd
jmp 0x85bedc
jmp 0x85c0cc
bswap esi
mov al, byte [esp]
mov esi, dword [esp + 0x2c]
rcr eax, cl
jnp 0x85c0b6
rdtsc
neg ch
jmp 0x85c0e7

Function at 0x85c059
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jmp 0x85c07a
push dword [esp + 5]
mov byte [esp + 5], cl
lea esp, [esp + 2]
jmp 0x85c089
ja 0x85c043
lea esp, [esp]
mov byte [esp + 1], dh
jmp 0x85c060

Function at 0x89b808
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x89b75f
mov byte [eax], 0
inc eax
jmp 0x89b678
pushal
pop word [esp + 6]
lea esp, [esp + 2]
jmp 0x89b768
mov ecx, dword [ebp + 0x74]
lea esp, [esp + 0x1c]
dec dword [ebp + 0x74]
stc
jmp 0x89b88a
and eax, 0x3f
jmp 0x89b7c0
lea esp, [esp + 2]
mov dword [ebp + 0x6c], eax
shr eax, 3
jmp 0x89b79e
push edx
pushal
rdtsc
rdtsc
jmp 0x89b7e3
mov eax, ebp
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push bx
jmp 0x89b7b4
mov ax, sp
mov dword [esp + 0x14], ebp
sub esp, 7
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
jmp 0x89b82a
lea esp, [esp + 8]
jne 0x89b658
je 0x89b7d8
mov ecx, eax
push edx
xchg al, ah
jmp 0x89b84b
add edx, 0x70
mov dword [edx], ecx
pop edx
btc ecx, ecx
jmp 0x89b814
lea esp, [esp + 4]
push 0x38
pop eax
call fcn.0089b835
test ecx, ecx
Function at 0x8fc043
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe dl
lea esp, [esp + 1]
not dx
sub esp, 0xa
mov ah, ch
jmp 0x8fc069
adc si, 0xc480
add esp, 2
xchg word [esp], bp
xchg byte [esp + 1], ch
jmp 0x8fc02d

Function at 0x8fc524
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, bh
pop ax
neg esi
mov ch, 0xe7
not bl
inc dx
jmp 0x8fc548
mov bx, 0x7fbb
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
xchg dl, al
jmp 0x8fc508
rol si, 0
btr bx, ax
bsf edi, esp
xchg bp, di
jmp 0x8fc575
lea ecx, [eax + eax]
bswap edi
inc edx
mov ecx, dword [esp + 0x12]
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
mov edx, dword [esp + 0xd]
jmp 0x8fc532
mov byte [esp + 0xa], bh
sub esp, 0x19
pop dword [esp + 0x1d]
pop di
jmp 0x8fc5c1
mov dx, 0xae3c
pop dword [esp + 0x11]
clc
mov bp, word [esp + 0xd]
cpuid
jmp 0x8fc55f
mov ecx, 0x6598fff1
pop bx
push dword [esp + 6]
mov si, cx
xchg ah, dh
mov byte [esp + 0x18], al
jmp 0x8fc59d

Function at 0x8ffe2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
shr bx, 0xb
mov byte [esp + 0x15], dl
add esp, 4
xchg dx, bp
jmp 0x8ffed0
bsf ebx, ecx
pushfd
cpuid
rdtsc
popal
not bl
jmp 0x8ffeb3
rdtsc
mov bx, word [esp + 0x29]
mov word [esp + 0x1d], dx
mov edx, dword [esp + 0xc]
jmp 0x8ffe58
mov ebp, ebx
setne cl
lea edx, [edx*4]
lea edi, [edi + ebp]
bswap eax
bsf dx, bp
jmp 0x8ffe6e
ror eax, 7
bsr ebp, edi
std
xchg dword [esp + 8], esi
sub esp, 9
stc
jmp 0x8fff30
mov di, si
lea ebx, [edi + ebp]
lea esi, [eax*4]
xchg dx, si
mov cl, byte [esp + 0xd]
cld
jmp 0x8ffe9d
rdtsc
mov word [esp + 9], bx
bswap esi
pop dword [esp + 0xa]
cld
bswap ecx
jmp 0x8ffe86
bsr ecx, ebx
pop dword [esp + 1]
call fcn.008ffee2
mov ebp, 0x788f2962
mov word [esp], bx
sbb esi, 0x97eacd5
mov ebx, dword [esp + 1]
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
mov dword [esp + 8], esi
jmp 0x8fff5d
add esp, 8
sete cl
push word [esp + 5]
bsf ebx, edx
bswap esi
xchg word [esp + 0xe], bx
jmp 0x8ffef8
mov word [esp + 0x27], cx
setb dl
pop dx
bsr edi, edi
call fcn.008fffbb
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
mov cl, byte [esp + 0xa]
mov esi, 0x69a12d32
sub esp, 0x1b
mov dword [esp + 0x1d], ebp
bsr ebx, esi
mov word [esp + 2], sp
jmp 0x8fff47
Function at 0x8fffbb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, esp
bswap ebp
rdtsc
popal
pop word [esp + 4]
xchg byte [esp + 1], al
jmp 0x8fffa3
sub esp, 0xf
xchg edi, eax
adc eax, 0xf149cc9e
add esp, 0x10
bsf cx, bx
pop dword [esp + 0x11]
jmp 0x8fff77
dec cx
mov ch, byte [esp + 6]
not bh
mov ebx, 0xc6dec6b7
lea ebp, [eax + esi]
jmp 0x8fffd8
lea edi, [esp + ebp]
cpuid
jmp 0x8fff8d
pop dword [esp + 0xa]
mov bx, word [esp]
mov ebp, 0x841f8105
jmp 0x900e67
lea esp, [esp + 1]
mov dx, cx
xchg byte [esp + 1], cl
xchg bl, cl
add esp, 6
sub esp, 0x14
jmp 0x8fffc2
dec edx
lea edi, [ebp*4]
mov dl, byte [esp]
mov byte [esp + 1], dh
jmp 0x900018
mov si, 0x5d55
xchg dword [esp + 9], eax
cpuid
xchg byte [esp + 1], dl
clc
bsf di, ax
jmp 0x8fffed
mov word [esp + 6], dx
mov eax, esp
bswap ebp
inc esi
mov bp, ax
xchg ebp, ebx
jmp 0x900154
sub esp, 2
push dword [esp + 6]
push dword [esp + 6]
inc cl
mov bp, word [esp + 5]
rdtsc
jmp 0x900003
mov byte [esp + 0x10], ah
xchg si, di
pop eax
pop dword [esp]
jmp 0x9000db
push dword [esp + 0xc]
not dh
bsr bp, dx
not bx
mov ebp, eax
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x900047
not dl
lea ebx, [edx*4]
mov word [esp], di
mov si, 0xe346
xchg esi, edi
cld
jmp 0x9000bf
add esp, 8
inc ch
mov dx, 0x4a27
inc ebp
mov al, 0x58
xchg word [esp], si
jmp 0x900074
setle dl
call fcn.00900128
popal
jmp 0x90012f
lea esp, [esp + 2]
mov ah, 0x4a
lea ecx, [edx - 0x41]
clc
xchg word [esp], si
sub edi, 0x6de16840
jmp 0x9000a9
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
mov word [esp + 7], sp
xchg cx, ax
or ebx, esi
cpuid
mov ebx, 0x5cc273e3
jmp 0x900097
mov al, 6
neg bp
lea ebx, [edx*4]
jmp 0x900139
not eax
mov ax, 0xfb0a
pop ax
cpuid
clc
mov ebp, 0x6afedcfb
jmp 0x9000f4
inc esi
mov byte [esp + 4], dl
lea ecx, [ecx + ebp]
jmp 0x90010a
mov word [esp + 2], sp
push word [esp + 2]
setg dh
bsf si, bx
jmp 0x9001b4
inc bx
pop dword [esp + 9]
shl bh, 0
bsf edi, esp
mov ax, word [esp + 0xf]
xchg dx, bx
jmp 0x90005d
mov bh, 0x36
lea esi, [ebp + ebp]
lea edx, [edi*4]
mov bp, word [esp + 8]
sub esp, 0x11
bsr edi, ebp
call fcn.0090016d
push 0xef1c75e5
setp byte [esi]
test bl, ah
push ds
cmc
or byte [ebx + 0x688d7e1b], cl
scasb al, byte es:[edi]
mov ecx, 0xb6e1e8be
xchg esi, eax
mov esi, 0x96b6e1e8
lea esp, [esp]
push word [esp + 2]
inc esi
lea eax, [esi*4]
xchg edx, esi
jmp 0x900183
not bp
push dword [esp + 2]
mov bx, cx
ror esi, cl
cpuid
and dh, al
jmp 0x900031
mov esi, dword [esp + 5]
bswap ecx
mov bp, 0x9d74
pop bx
mov ecx, edi
add esp, 8
jmp 0x900247