joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd4e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8ed7a8]
xor edx, edx
cmp eax, edx
jne 0x4dd506
xor eax, eax
mov byte [eax + 0x8ed6a8], al
inc eax
cmp eax, 0x100
jl 0x4dd4ee
mov dword [0x8ed7a8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8ed6a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4dd597
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4dd56a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4dd538
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4dd610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4dd663
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4dd64a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e3fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52bf8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004e4900
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x7a2b54
call fcn.005177f1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4e4073
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005177f1
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4e406c
push 0
mov ecx, eax
call fcn.004db110
mov dword [esi + 0xc], eax
jmp 0x4e4075
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4e4075
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x519f7c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x519fb4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00517f57
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00517f2f
jmp 0x519fc0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x51b77a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51b7bc
call fcn.00521e9f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51b7bc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x51b7b3
xor eax, eax
jmp 0x51b7c4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0051b7ca
pop edi
pop esi
pop ebx
ret 4

Function at 0x5223cf
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5223fd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x52241b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00522335
jmp 0x52241b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x52241b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00522335
test edi, edi
mov eax, edi
jne 0x522405
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401050
Capabilities:
Terminate process

Disassembly:
push str.Usage:_gdal_contour___b__band_____a__attribute_name_____3d____inodata__n______________________snodata_n____f__formatname_____i__interval___n______________________f__formatname______dsco_NAMEVALUE__..._____lco_NAMEVALUE__...__n______________________off__offset_____fl__level___level_...__n______________________nln__outlayername_____q__n_____________________src_filename___dst_filename__n
call dword [sym.imp.MSVCR120.dll_printf]
mov eax, dword [esp + 8]
add esp, 4
test eax, eax
je 0x40107f
push eax
push str._nFAILURE:__s_n
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR120.dll_fprintf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x741610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7474cc]
cmp dword [eax + 0x28], 0
jne 0x741628
xor eax, eax
jmp 0x741757
mov ecx, dword [0x74743c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x747430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x74742c], eax
push 0
call dword [0x745138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x745138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x747430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x74742c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x7474b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x745680
push 0x7456d0
push 0x88
call dword [0x745134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x747428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x74510c]
push eax
call fcn.00741550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x745148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x74512c]
push 0x7415e0
mov edx, dword [0x7474cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x74513c]
mov dword [0x747434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x745130]
test eax, eax
je 0x741757
cmp dword [ebp - 0x38], 0x12
jne 0x74174b
mov dword [0x747444], 0
call fcn.00741760
xor eax, eax
jmp 0x741757
lea edx, [ebp - 0x3c]
push edx
call dword [0x745140]
jmp 0x74171c
mov esp, ebp
pop ebp
ret 4

Function at 0x742b30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.007450dc]
call dword [fcn.00745124]
call dword [fcn.00745128]
call dword [fcn.00745094]
call dword [fcn.007450fc]
call dword [fcn.007450f4]
call dword [fcn.00745150]
call dword [fcn.0074500c]
call dword [fcn.00745000]
call dword [fcn.00745160]
call fcn.00744674
mov eax, 1
pop ebp
ret 4
Function at 0x7436cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x745168
sub eax, eax
test esi, esi
je 0x7437a4
sub eax, 1
test ecx, ecx
je 0x7437a2
test esi, 3
je 0x74370a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x7436ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x743789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x743714
mov ecx, edx
test ecx, ecx
je 0x7437a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x74378f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x7437ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0074382f
jae 0x7437ba
xor ecx, ecx
call fcn.0074382f
jae 0x7437e9
xor eax, eax
call fcn.0074382f
jae 0x7437f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0074382f
adc al, al
jae 0x7437db
jne 0x743825
stosb byte es:[edi], al
jmp 0x7437bd
call fcn.0074383b
sub ecx, ebx
jne 0x743802
call fcn.00743839
jmp 0x743821
lodsb al, byte [esi]
shr eax, 1
je 0x74384b
adc ecx, ecx
jmp 0x74381e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00743839
cmp eax, 0x7d00
jae 0x74381e
cmp ah, 5
jae 0x74381f
cmp eax, 0x7f
ja 0x743820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7437bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x74417c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x747000]
jne 0x744186
repz ret
jmp fcn.0074442d

Function at 0xada094
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
jl 0xada115
jge 0xada11f
mov byte [esp + 2], al
call fcn.00ada13e
sbb eax, 0x2244488
mov byte [esp + 2], al
pop dword [esp]
jmp 0xada1fd
mov dword [esp + 0x40], ebp
jmp 0xada1e7
pushfd
pop word [esp]
push word [esp + 1]
js 0xada209
push dword [esp + 3]
call fcn.00ada23c
fisub word [esi + 0x56]
push si
mov byte [esp + 2], ah
pushal
jmp 0xada15e
push dword [esp + 3]
jmp 0xada294
pushfd
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x40], esi
jmp 0xada273
Function at 0xada82e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, ah
lea ebp, [ebp + 0x36]
xchg al, ah
rcr al, 2
xchg dword [esp + 8], ebp
call fcn.00ada818
and byte [ecx + 0x2eab5839], ch
dec eax
jmp 0xada84c
pop ds

Function at 0xada9bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax + ebx]
not dl
pushal
add esp, 0x1a
lea esp, [esp + 2]
jmp 0xadaa00
xchg dword [esp + 4], ebx
inc dl
and al, cl
not edx
btc eax, esp
lea ebx, [ebx + 0x15]
jmp 0xadad4f
lea edx, [edx + ebx]
call 0xadaab0
not ax
setle ah
lea eax, [eax - 0x7b16]
mov eax, 0xf084d283
xchg dword [esp + 4], ebx
setnp dl
jmp 0xadaae8
Function at 0xaef333
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
xchg al, ch
mov ebx, 0xb508f157
clc
call fcn.00aef2ff
mov dh, 0x48
lea ebp, [eax*4]
jmp 0xaef396
lea edi, [esp]
mov eax, dword [esp]
mov ax, bp
bt esi, ecx
jmp 0xaef3a8
mov ebp, dword [esp + 0x2c]
mov ecx, 0xf5ecbb46
lea eax, [edx + edx]
mov cx, 0x369a
jmp 0xaef380
jge 0xaef3be
mov ah, byte [esp]
jmp 0xaef3c1
mov ah, byte [esp]
sub esp, 0xc0
jmp 0xaef3ff
cpuid
jmp 0xaef3e3
xchg dx, ax
cpuid
mov ebx, ebp
xchg dx, ax
mov dx, 0x2e3a
rdtsc
pushal
jmp 0xaef422
mov esi, esp
cmp cx, 0xdfbf
jo 0xaef3df
xchg dx, ax
jmp 0xaef3c9
add ax, sp
jmp 0xaef486
mov ah, byte [esp]
mov dh, byte [esp]
ror eax, cl
je 0xaef40c
add ax, sp
jmp 0xaef486
lea eax, [ebp*4]
add dx, cx
jle 0xaef441
xchg edx, eax
jmp 0xaef46a
sete dl
jmp 0xaef4e0
rol ebp, 0
not ecx
setno cl
mov ch, 0x14
xchg dh, dl
jmp 0xaef457

Function at 0xaefb87
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xbe850156
jmp 0xaefe94
add eax, 0x333c7af6
jmp 0xaefe7d
lea esp, [esp + 4]
not al
jmp 0xaefd09
setb dl
mov dl, 0x33
bswap edx
call fcn.00aefca0
neg ax
mov ah, dl
rcl edx, cl
jmp 0xaefd4b
push cx
jmp 0xaefdef
lea eax, [ebp*4]
setl ah
neg al
jo 0xaefd35
push cx
bswap eax
lea esp, [esp + 2]
jmp 0xaefdf5
rol ah, cl
jmp 0xaefd8b
rol ah, cl
dec cl
mov dh, 0x5b
lea edx, [eax + ebx]
bswap eax
jmp 0xaefdcb
lea eax, [ecx + edi]
rdtsc
mov ah, byte [esp]
dec al
ja 0xaefd89
jbe 0xaefd73
rol cl, 0
mov eax, dword [esp]
jmp 0xaefdd4
bswap eax
bt edx, ebx
jne 0xaefdb5
je 0xaefdb5
rdtsc
bswap edx
bswap eax
mov edx, esp
jmp 0xaefe32
bswap eax
lea esp, [esp + 2]
neg cl
jmp 0xaefda7
ror cl, 0
lea edx, [ecx*4]
mov eax, ebx
jmp 0xaefe14
inc eax
jg 0xaefdf9
jle 0xaefdf9
mov ax, 0x90d7
mov eax, ecx
neg edx
jl 0xaefed0
jge 0xaefe62
and byte [ebp + 0x1daf5c35], ah
push edx
salc
inc esp
and ebx, esi
outsd dx, dword [esi]
invalid
not cl
rdtsc
lea eax, [eax*4]
lea eax, [0x3a7f353a]
bswap eax
jmp 0xaefe0f
shl eax, 2
mov dx, 0xa569
mov dh, ah
jmp 0xaef29b
dec edx
push eax
fimul dword [eax + 0x2f]
ficomp dword [ebp - 0x45]
sub esp, 0x10
setae dl
xchg dh, dl
jmp 0xaefed8
cmp dl, cl
jmp 0xaefeaf
cmp dl, cl
jmp 0xaefeaf
call 0xaefe99
lea edx, [edi - 0xbbe0]
call fcn.00aefef3
div byte [edx + ebp*8 - 0x73]
jl 0xaefe5a
loope 0xaefeb0
arpl word [edx + 0x73f5e4f5], bx
aad 0x72
fucomi st(1)
invalid
cmc
jae 0xaefe6c
jb 0xaefe74
jmp 0xaef363
mov eax, dword [eax + 0x4229f3bc]
mov edx, 0xf0453e6f
dec dh
jge 0xaefe78
cmp byte [ebx + esi*8 + 0x6fba4229], 0x3e
inc ebp
invalid
jl 0xaefe78
das
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 8
cmp eax, ebx
push ebx
lds esi, ss:[edx + 6]
mov cl, 0xb0
mov bl, 0x83
in al, dx
adc byte [edi], cl
xchg ebx, eax
ret 0xd686
sub esp, 0x10
setae dl
xchg dh, dl
jmp 0xaefe47
Function at 0xaf340d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0adcfcc
jmp 0xaf3436
mov dword [esp], eax
jmp 0xaf3382
lea esp, [esp + 2]
mov dword [esp], ebx
push edi
push dword [esp + 1]
mov dword [esp + 4], esp
jmp 0xaf33bb
mov byte [esp + 2], al
mov dword [esp], edx
push esp
push word [esp + 3]
jb 0xaf336c
jae 0xaf33b1
push dword [esp + 1]
mov dword [esp + 4], esp
jmp 0xaf33bb
lea esp, [esp + 2]
mov dword [esp], ebx
push edi
jmp 0xaf3393
push bp
lea esp, [esp + 2]
mov dword [esp], ebp
call 0xaf340d
leave
dec edx
fdivr dword [edi - 0x109604b6]
jg 0xaf33ed
jmp 0xcecb61f
mov byte [esp + 2], al
mov dword [esp + 0x20], edi
jmp 0xaf342c
xchg ebx, eax
das
nop
adc ecx, dword [edx + 0x66c75425]
push dword [esp]
push word [esp]
jg 0xaf33df
mov byte [esp + 2], al
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
call fcn.00af3416
outsb dx, byte [esi]
pushal
mov dword [esp + 0x20], esi
push cx
jmp 0xaf33f5
lea esp, [esp + 0x20]
pushfd
jmp 0xaf320f
mov al, byte [esp]
lea ebx, [esi*4]
and bp, bx
ja 0xaf36bd
jbe 0xaf3569
invalid
mov ecx, dword [esp]
mov dh, cl
lea esi, [esp]
call fcn.00af34ab
jmp 0xaf3509
jmp 0xaf34f3
mov ebx, ecx
jmp 0xaf34c1
lea eax, [eax + 0x996f]
bts edx, eax
mov ebx, 0x17fc8c7
jmp fcn.00af34d2
sub esp, 0xb8
mov ebp, esp
neg dh
jb 0xaf34d0
lea eax, [eax + 0x996f]
bts edx, eax
mov ebx, 0x17fc8c7
jmp fcn.00af34d2
mov edi, dword [esp + 0x2c]
cmc
jl 0xaf34ef
mov ebx, ecx
mov ecx, dword [esp]
mov dh, cl
jmp 0xaf34c6
jmp 0xaf3569

Function at 0xaf3416
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00af3476
jge fcn.00af3416
imul ecx, dword [eax], 0xda5d48fb
dec eax
das
fisubr dword [edx - 0x45]
xchg edx, eax
or eax, 0x648def9c
and al, 0x20

Function at 0xaf34ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0xaf34ce
das
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 8
cmp eax, ebx
push ebx
lds esi, ss:[edx + 6]
mov cl, 0xb0
mov bl, 0xaa
Function at 0xaf34ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0adcfcc
jmp 0xaf3436
mov dword [esp], eax
jmp 0xaf3382
lea esp, [esp + 2]
mov dword [esp], ebx
push edi
push dword [esp + 1]
mov dword [esp + 4], esp
jmp 0xaf33bb
mov byte [esp + 2], al
mov dword [esp], edx
push esp
push word [esp + 3]
jb 0xaf336c
jae 0xaf33b1
push dword [esp + 1]
mov dword [esp + 4], esp
jmp 0xaf33bb
lea esp, [esp + 2]
mov dword [esp], ebx
push edi
jmp 0xaf3393
push bp
lea esp, [esp + 2]
mov dword [esp], ebp
call 0xaf340d
leave
dec edx
fdivr dword [edi - 0x109604b6]
jg 0xaf33ed
jmp 0xcecb61f
mov byte [esp + 2], al
mov dword [esp + 0x20], edi
jmp 0xaf342c
xchg ebx, eax
das
nop
adc ecx, dword [edx + 0x66c75425]
push dword [esp]
push word [esp]
jg 0xaf33df
mov byte [esp + 2], al
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
call fcn.00af3416
outsb dx, byte [esi]
pushal
mov dword [esp + 0x20], esi
push cx
jmp 0xaf33f5
lea esp, [esp + 0x20]
pushfd
jmp 0xaf320f
mov al, byte [esp]
lea ebx, [esi*4]
and bp, bx
ja 0xaf36bd
jbe 0xaf3569
invalid
mov ecx, dword [esp]
mov dh, cl
lea esi, [esp]
call fcn.00af34ab
jmp 0xaf3509
jmp 0xaf34f3
mov ebx, ecx
jmp 0xaf34c1
lea eax, [eax + 0x996f]
bts edx, eax
mov ebx, 0x17fc8c7
jmp fcn.00af34d2
sub esp, 0xb8
mov ebp, esp
neg dh
jb 0xaf34d0
lea eax, [eax + 0x996f]
bts edx, eax
mov ebx, 0x17fc8c7
jmp fcn.00af34d2
mov edi, dword [esp + 0x2c]
cmc
jl 0xaf34ef
mov ebx, ecx
mov ecx, dword [esp]
mov dh, cl
jmp 0xaf34c6
jmp 0xaf3569

Function at 0xaf35e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [esp + 1]
neg al
jmp 0xaf35ec
jbe 0xaf35b7
ja 0xaf35b7

Function at 0xaf3909
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
mov edx, dword [esp]
lea esp, [esp + 1]
jmp 0xaf393e
sub bl, al
mov ah, 0xff
lea eax, [0x162bbdb4]
mov al, dl
stc
jmp 0xaf39b7

Function at 0xbb92eb
Capabilities:
Encode data using xor

Disassembly:
dec ecx
stosd dword es:[edi], eax
inc ebx
cli
aad 0x44
daa
lds esp, [eax - 0x18]
pushal
call fcn.00bb940b
pushal
call fcn.00bb940b
and byte [edi + 0x2d70ded6], ch
in al, 0x82
cmp byte [ecx], 0xfe
xor byte [0xe929def7], dh
out dx, al
add byte [eax], al
add byte [edi - 0x74b6c290], ah
test al, 0x88
mov eax, dword [0xdac49bd1]
sub eax, 0xb7ee8817
jns 0xbb9368
invalid
imul edx, dword [eax + esi*8 - 0x5520db5b], 0xffffff83
in eax, 0xd
or dword [eax + ecx*2], 0xabd02eb
xor eax, 0x5c9743c8
xor eax, dword [ebx - 0xf]
shl dl, 0xbd
adc dword [edx], esi
scasb al, byte es:[edi]
arpl word [esi - 0x36], bp
jne 0xbb9310
in al, 0x60
adc eax, 0xfbaa4b28
fisubr dword [ebx]
jne 0xbb9376
pop ebx
imul dword [edi + 0x92e7fd1]
push 9
jp 0xbb92e3
fimul word [0x4a93c82f]
sbb bh, byte [edi + 0x1f8ca7d2]
imul ecx, ebp, 0x28cd0a0
and bh, ah
push ds
or eax, 0xa9bdea4a
into
mov al, byte [0x33c8358a]
ljmp 0xef8d
imul ebp, edx, 0xffffff8d
out dx, eax
mov edi, 0xcc135ee0
test dword [esi - 0x65], ebp
cmp ebp, edx
daa
push ds
xor dword [edi - 0x2c69889c], ebp
int 0x84
cmp eax, 0x661dd27b
imul bl
mov cl, 0x16
cmp cl, bh
sub dword [ebp + 0x3c], ecx
xor dword [ecx], 0xf09617d0
mov ebx, 0x7f8d07e6
pop ebp
sbb eax, dword [edx + 0x63f3d2b0]
cmc
mov esp, 0x2f16e5cb
Function at 0xc985a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
dec bp
jmp 0xc985ae
ror ebp, cl
mov word [esp], bp
mov dl, byte [esp + 1]
clc
mov dl, byte [esp]
mov ebp, dword [esp]
jmp 0xc985ef
sub esp, 0x11
mov esi, ecx
mov cl, 0xf2
std
lea eax, [ebx + edi]
dec di
jmp 0xc985d9

Function at 0xc98786
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
mov ebx, esi
push cx
bswap ebx
xchg ebx, eax
jmp 0xc98795
mov word [esp + 3], dx
mov word [esp + 1], di
neg ebp
bsf di, bp
neg dx
jmp 0xc987c2
setb ah
xchg dh, al
lea eax, [ebp + 0xbd14]
stc
dec dh
pushfd
jmp 0xc9881b
pushal
mov bh, byte [esp + 0xf]
setnp dh
mov bx, word [esp + 0x11]
sub esp, 4
sub esp, 0x1d
jmp 0xc987f8

Function at 0xc98b0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
or ecx, 0x8bf94b93
xchg byte [esp + 2], al
mov byte [esp], dl
mov esi, edx
jmp 0xc98b22
lea eax, [esi*4]
mov dx, si
mov al, cl
lea ecx, [esi + 0x5c9b3a67]
jmp 0xc98af8
xchg dword [esp], edi
mov al, byte [esp]
rdtsc
rdtsc
neg si
add esp, 0
jmp 0xc98cff
xchg byte [esp + 0xe], bh
setbe bh
inc bh
call fcn.00c98b46
lea esi, [eax*4]
mov ebx, esp
not ch
sub esp, 0x1b
not edi
pop word [esp + 9]
jmp 0xc98b5c
clc
setp cl
mov ch, al
stc
mov ah, byte [esp]
mov bx, cx
jmp 0xc98bd3
xchg dword [esp], eax
xchg byte [esp + 1], bh
mov cl, byte [esp]
xchg word [esp], bp
pop ecx
dec ebp
jmp 0xc98c35
cpuid
xchg ecx, edx
add esp, 0
xchg byte [esp + 1], dl
xchg dl, al
mov edx, dword [esp + 3]
jmp 0xc98c73
Function at 0xc98cce
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [ebx + ebp]
rol bh, cl
pop ebp
mov cl, 0x3f
mov edi, dword [esp + 4]
mov cl, 0x82
jmp 0xc98cda
sets dh
lea esi, [ebp*4]
jmp 0xc98cb8
xchg cx, ax
pop dword [esp]
push word [esp + 3]
xchg dword [esp], eax
xchg byte [esp + 3], al
mov bh, byte [esp + 3]
jmp 0xc990f5
mov word [esp + 0xd], bp
xchg word [esp + 6], cx
mov al, byte [esp + 8]
jmp 0xc98d5a
lea esp, [esp]
sbb ah, bh
pushal
mov ebp, eax
cld
bswap eax
jmp 0xc98d15
lea edx, [0xb75be287]
mov edi, dword [esp + 1]
xchg word [esp + 4], bp
bswap edx
pop bp
ror di, cl
jmp 0xc98dbb
add esp, 0x14
xor dx, sp
cpuid
xchg bl, dl
mov dword [esp + 1], ebp
mov cx, 0x2a7d
jmp 0xc98d38
mov bx, word [esp + 3]
mov word [esp + 4], bx
stc
add esp, 0
xchg ebx, esi
mov dx, 0x2364
jmp 0xc98da4
btr eax, eax
mov ah, byte [esp + 0xb]
mov ch, dh
mov cl, 0x2d
mov byte [esp + 9], dl
pop dword [esp + 2]
jmp 0xc98d6e
push dword [esp + 7]
xchg dword [esp], edi
mov word [esp + 3], di
sub esp, 0x18
pushal
jmp 0xc98dfe
bsf ebp, eax
mov eax, 0xa618b00d
cpuid
mov edi, 0x1aedbf0
lea ebp, [edi + ebp]
mov dword [esp + 1], ebx
jmp 0xc98d8f
bsf edi, ebp
push cx
xchg ebp, edi
add esp, 0
mov byte [esp], ah
add di, 0x8a4f
jmp 0xc98e26
lea esp, [esp + 0x44]
mov dx, word [esp]
cld
mov ah, 0x8a
rdtsc
sets dl
jmp 0xc98dd3
lea ebx, [eax*4]
xchg ebp, ebx
push word [esp + 1]
call fcn.00c98de7
mov ebx, 0xfdb2ad56
rdtsc
pop ecx
bsr eax, eax
dec al
jmp 0xc98f30
push word [esp + 3]
mov ah, 0x3e
mov si, word [esp + 2]
lea esp, [esp + 6]
bsr ebx, ebp
rdtsc
jmp 0xc98d2b
xchg byte [esp + 0x19], dh
xchg dword [esp + 0x15], esi
cpuid
xchg bx, si
jmp 0xc98ec5
mov word [esp + 0xb], sp
push word [esp + 6]
mov bx, sp
push dword [esp + 0x12]
rdtsc
bswap ebx
jmp 0xc98e82
push dword [esp + 7]
call fcn.00c98eaf
xchg ebp, edi
stc
stc
mov edx, esp
mov cx, ax
lea esi, [esi - 0xf851]
jmp 0xc98f04
cmc
dec esi
sub esp, 0x15
mov cx, word [esp + 0x10]
push dword [esp + 0x15]
xchg word [esp + 0x27], dx
jmp 0xc98e98
mov eax, dword [esp]
std
mov cl, dh
neg si
xchg ah, bh
seto al
jmp 0xc98f18
inc edx
lea ebp, [ebx + ebx]
bsr ebx, edx
xor di, bp
xchg dx, bx
call fcn.00c98f7f
in eax, dx
cld
iretd
lea ecx, [edi*4]
bts bp, sp
lea edi, [ebp - 0xa2]
neg bh
bsr bx, sp
xchg word [esp + 6], bp
jmp 0xc98eef
xchg ecx, edi
xchg bl, ch
lea ebp, [ecx + esi]
not dh
rcr ebx, 7
mov dl, byte [esp + 2]
jmp 0xc98e68