joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100062fa
pop dword [ebp - 0x2c]
mov eax, 0x100062fa
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x342f0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x53cbd1ed
sub ecx, 0x53cb9d48
xor esi, esi
add esi, eax
mov edi, 0x62a000d
add edi, 0x9d785f3
add edi, dword [ebp - 0x2c]
mov edx, 0x7f6cf4a8
add dword [ebp - 4], 0xc2b54614
mov ebx, dword [edi]
add dword [ebp - 0x18], edx
xor ebx, edx
add dword [ebp - 0x1c], 0xe94b62af
mov dword [esi], ebx
add dword [ebp - 0x10], 0xf21f52ea
add esi, 4
add edi, 0x31f155fc
sub edi, 0x31f155f8
loop 0x1000634b
add eax, 0xc567
mov ebx, eax
add eax, 0x93141f76
add eax, 0x6cebe08f
mov ecx, 0x2d5b879e
add ecx, 0xe2a47862
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4618ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cl, ch
bswap eax
not ax
cpuid
xchg dword [esp], ebx
call fcn.004618a4
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
out 0x8b, eax
je 0x4618f8
sub al, 0x8a
xor al, 0x24
rdtsc
jmp 0x461973
or al, 0x24
mov edx, dword [esp]
jmp 0x461958
jmp 0x461940
sub esp, 0xc0
jmp 0x46198a
lea ecx, [eax*4]
lea edi, [esp]
mov bp, word [esp]
rcl edx, cl
jne 0x461956
mov edx, dword [esp]
jmp 0x461958
mov ebp, esp
mov bl, byte [esp]
sub esp, 0xb
jne 0x4619cd
je 0x4619b7
in eax, 0x65
cmc
pushfd
outsd dx, dword [esi]
lodsb al, byte [esi]
adc eax, 0x9e630496
pop eax
xchg dword [esi], ebp
cmp dword [ebx - reloc.USER32.dll_CreateWindowExW], ecx
sub esp, 0xf
lea esp, [esp + 2]
jmp 0x4619d4
sub esp, 0xf
lea esp, [esp + 2]
mov ecx, esi
mov al, 0x58
bswap eax
jmp 0x461a13
sub esp, 0xc
jmp 0x4619fa
rcl bh, 2
shl edx, 0x1e
jmp 0x4619dc
ror esi, 0
jle 0x461a57
mov ax, word [esp]
jmp 0x461a37
dec edx
jb 0x4619f2
rcl bh, 2
shl edx, 0x1e
sub esp, 0xc
jmp 0x4619fa
ror esi, 0
mov ebx, 0xc1585984
rdtsc
rcr bx, cl
jmp 0x461a69
sbb eax, 0xa28e4777
rol eax, 0x17
btr ax, cx
jmp 0x461a67
mov ax, word [esp]
sbb eax, 0xa28e4777
rol eax, 0x17
btr ax, cx
jmp 0x461a21
jl 0x461a7f
lea edx, reloc.USER32.dll_CreateWindowExW
push ebx
jmp 0x461ac8
lea edx, reloc.USER32.dll_CreateWindowExW
push ebx
xchg byte [esp + 1], al
jmp 0x461a9e
lea esp, [esp + 0x10]
inc esi
lea ebx, [eax + ecx]
lea eax, reloc.USER32.dll_CreateWindowExW
xchg dx, ax
jmp 0x461ae5
jmp 0x461ace
mov eax, 0x9640dca7
jmp 0x461b0f
xchg byte [esp + 1], al
jmp 0x461a9e
inc esi
rdtsc
neg bx
jne 0x461ab2
mov eax, 0x9640dca7
setnp ah
jmp 0x461af9
rdtsc
mov edx, dword [esp]
lea eax, [edi*4]
bts ax, di
jp 0x461ab0
jnp 0x461ab0
btc dx, si
xchg dh, dl
jmp 0x461b18
setnp ah
btc dx, si
xchg dh, dl
xor esi, 0x43c72b2b
lea eax, [ecx*4]
jmp 0x461b68
mov ebx, esp
lea ebx, [ebx + ebx]
jmp 0x461b8e
adc bh, 0x21
jae 0x461b52
mov ebx, esp
lea ebx, [ebx + ebx]
jmp 0x461b8e
add esi, dword [edi]
pushfd
mov bl, 0xab
jmp 0x461b74

Function at 0x46ffd9
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x20]
jmp 0x453792
lea esp, [esp + 2]
mov dword [esp], edx
push dword [esp + 2]
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0x46fb60
Function at 0x49071b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0xc]
mov ecx, dword [esp]
jmp 0x49086b
mov ecx, dword [ebp - 8]
jmp 0x49071d
jmp 0x490705
lea esp, [esp + 4]
push dword [ebx + edi]
mov edx, esp
rdtsc
rdtsc
jmp 0x4907a3
lea esp, [esp + 4]
add edi, 4
jmp 0x49077b
add dword [esi], eax
mov ecx, dword [esp]
xchg ch, cl
jmp 0x490741
pushfd
mov word [esp], bp
push dword [esp]
mov byte [esp + 4], ch
jmp 0x490784
add esi, 4
dec dword [ebp - 4]
pop ecx
jmp 0x490765
lea esp, [esp + 8]
jne 0x450f6f
je 0x450f42
pop es
popfd
or eax, 0x7767a754
out dx, al
jl 0x4907b9
test byte [eax + 0x7f], 0x46
int1
mov edx, edi
mov eax, edi
call fcn.0046ebe6
jmp 0x49075c
mov eax, dword [esp]
jmp 0x4907e5
mov ebx, edi
mov al, byte [esp]
lea ebx, [eax*4]
jmp 0x490807
mov edi, dword [esp]
mov al, 0xc6
lea esp, [esp + 4]
pop esi
jmp 0x4907cf
mov dword [esp + 0x14], ebp
pushal
lea esp, [esp + 0xb]
pop dword [esp + 7]
jmp 0x490845
push edx
pushal
lea esi, reloc.USER32.dll_CreateWindowExW
xchg bx, dx
jmp 0x4907f1
not cx
lea ecx, reloc.USER32.dll_CreateWindowExW
call 0x4907c4
mov ecx, 0x48f4dd07
jmp 0x490854
lea esp, [esp + 1]
lea esp, [esp + 0x10]
popal
lea edx, [edx - 4]
push ecx
jmp 0x49082f
lea ecx, reloc.USER32.dll_CreateWindowExW
call fcn.00490896
aam 0x55
lds ebp, [edi + ebx*2 - 0x2108bb65]
sub dword [eax - 0x15], ecx
mov cx, 0xd92a
setbe ah
mov eax, dword [ebp + 8]
lea ecx, [ebx*4]
xchg cl, ch
jmp 0x490821

Function at 0x514eda
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6ef880
Capabilities:
Execute anti-debugging instructions

Disassembly:
or esp, dword [edx - reloc.MSVCRT.dll_strncpy]
mov ah, 0x98
pop eax
lea esp, [esp + 2]
jmp 0x6ef882
jmp 0x6ef86a
xor ebp, 0x7290829d
bswap ebx
sbb ebx, 0x86e85a24
and al, 0x5a
call 0x77e16f19
sub esi, dword [edi - 0xa]
jbe 0x6ef904
ja 0x6ef8bf
ja 0x6ef88c
add edi, esi
cmp esp, dword [ebx - 0x15]
jnp 0x6ef8bc
in eax, dx
mov ds, word cs:[ecx]
js 0x6ef840
rol edx, 8
jmp 0x6ef90d
invalid
mov edx, ecx
dec dh
rdtsc
jmp 0x6ef8a9
neg edx
setns ah
jmp 0x6ef8eb
clc
jne 0x6ef8c7
neg edx
setns ah
jmp 0x6ef8eb
xor ebp, 0x6ea161f9
not bx
bsf bx, sp
jp 0x6ef952
jnp 0x6ef933
mov byte [0x29dabf2f], al
xchg edx, eax
jge 0x6ef890
mov edx, ecx
dec dh
sar esi, 1
into
rdtsc
rol edx, 8
add ebp, 0x3890bd34
mov edx, ebx
lea edx, [ebx + ebx]
mov ax, cx
jmp 0x6ef8dd
lea ebx, reloc.MSVCRT.dll_strncpy
dec dl
xchg al, bl
btr bx, bx
jmp 0x6ef95c
mov ah, byte [esp]
not ebx
jmp 0x6ef957
jl 0x6ef91d
lea ebx, reloc.MSVCRT.dll_strncpy
dec dl
jmp 0x6ef972
mov ah, byte [esp]
not ebx
neg ebp
clc
jmp 0x6ef93a
dec ebp
btc dx, sp
jge 0x6ef990
bsr dx, si
lea eax, [eax + edi]
jmp 0x6ef9d5
xchg al, bl
btr bx, bx
jmp 0x6ef95c
lea eax, [eax + edi]
call fcn.006ef9bf
and al, 0xb3
and eax, dword [esi - 0x4b]
add eax, 0x4d2ab43a
mov esp, 0x66602178
bsr edx, esi
bsr dx, si
jmp 0x6ef97a
add ebp, dword [esi]
mov ebx, 0x5399bbd5
rol dx, 0xd
jmp 0x6efa65
clc
jmp fcn.006efa48
jb 0x6efa1b
clc
jmp fcn.006efa48
Function at 0x6f67e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0x7b49
adc ax, ax
jo 0x6f6c72
jno 0x6f6b5a
aas
mov eax, 0x7db8492e
adc eax, 0xc68a3784
sub bl, dl
mov dl, byte [esp]
rdtsc
inc esi
jmp 0x6f681c
neg edx
js 0x6f69fe
bswap edx
mov al, cl
call fcn.006f6871
inc edx
std
int3
bt eax, ecx
inc ax
jmp 0x6f680e
xchg edx, eax
call fcn.006f68fa
movsb byte es:[edi], byte [esi]
xor esp, dword [ebx - reloc.MSVCRT.dll_strncpy]
xor al, 0xaa
int 0x3c
clc
mov eax, dword [reloc.MSVCRT.dll_strncpy]
or dword [esi + 0xf], esp
mov ebp, 0x87e174c4
ret 0x70b4
xor cl, 9
bsr ax, sp
je 0x6f68a8
xchg edx, eax
mov ah, 0x70
xchg dh, al
jmp 0x6f6966
neg cl
lea edx, [esi - 0x32]
lea eax, [edx*4]
lea edx, [ebx - 0x5e]
cmc
jmp 0x6f699a
mov eax, 0xc1c420a5
bswap edx
lea edx, [eax + ecx]
sub esp, 0
jmp 0x6f68be
jns 0x6f69b0
mov ah, byte [esp]
not ax
jmp 0x6f69d4
mov ah, byte [esp]
not ax
dec ah
not cl
lea edx, [ecx + esi]
mov dl, 0x30
inc ah
jmp 0x6f6a04
dec ah
jmp 0x6f69b8
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x6f6a0f
jmp 0x6f6a64
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x6f6b01
bswap edx
mov al, cl
jmp 0x6f6988
jbe 0x6f69d8
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x6f69df
lea esp, [esp + 0x10]
neg cl
mov edx, esp
mov dx, word [esp]
bsf eax, ecx
jnp 0x6f69e1
and dx, 0xd1cc
rcr eax, cl
push eax
call fcn.006f6ade
jns 0x6f6a95
neg ax
neg eax
jl 0x6f6833
bt eax, ecx
inc ax
jmp 0x6f680e
neg dx
jmp 0x6f6aeb
and dx, 0xd1cc
rcr eax, cl
push eax
jmp 0x6f69e6
lea ebp, [ebp + 0x14]
neg ax
sub esp, 6
not dx
mov dl, bh
lea esp, [esp + 2]
jmp 0x6f6ab8
and al, 0x92
clc
neg edx
mov dx, word [esp]
xchg dl, dh
jmp 0x6f6a71
push dword [esp + 4]
ret 8
xchg dword [esp + 4], ebp
mov dx, bp
stc
neg eax
lea edx, [esi*4]
rdtsc
jmp 0x6f6aa2
bswap edx
jmp 0x6f6b2e
ror cl, 0
adc dh, 0x57
jl 0x6f6a4e
neg dx
bswap edx
jmp 0x6f6b2e
popal
lea edx, [esi + ebp]
lea edx, [edx*4]
pushfd
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x6f6b3c
pushal
mov ah, dh
mov dword [esp + 0x1c], ecx
mov dh, 0x80
setne dl
jmp 0x6f6b14
shl eax, 2
mov dx, word [esp]
call fcn.006f6b9c
jns 0x6f6b44
push esp
add byte [eax], al
add byte [ecx - 6], bh
push 0x593cfa0f
fisttp word [edi + 0x2a]
fldenv [esi]
mov dl, 0xad
mov esp, 0x6681168f
mov eax, ecx
mov ax, cx
mov eax, dword [esp]
jmp 0x6f6c78
mov ax, cx
mov eax, dword [esp]
rol dl, 0
lea eax, [ecx*4]
jmp 0x6f6a2e

Function at 0x6f71fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr esi, ebp
mov dword [esp + 4], eax
lea esp, [esp + 4]
jmp 0x6f71cb
xchg word [esp + 1], cx
bsr esi, ebp
mov dword [esp + 4], eax
lea esp, [esp + 4]
popal
pushal
rdtsc
not bx
pushal
jmp 0x6f71ce
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
jmp 0x6f71df
popal
jmp 0x6f71a9
mov word [esp + 0x11], di
mov dword [esp + 0x38], ecx
lea esp, [esp + 0x20]
popal
cld
jmp 0x6f71b2
pop esi
popfd
jmp fcn.006f7221
bt bx, di
jno 0x6f7198
xchg word [esp + 1], cx
jmp 0x6f7182
Function at 0x6f7318
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 3]
jmp 0x6f72a1
mov byte [esp], dl
cmp al, 0xf4
jg 0x6f7261
mov edx, dword [esp + 3]
jmp 0x6f72a1
shl al, 5
mov dl, cl
mov eax, 0x55fd9237
dec ax
jbe 0x6f72ac
or eax, 0xe75eeaf9
call fcn.006f72cf
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0x8acb2a98
xor al, 0x24
sub cl, bl
mov dh, byte [esp]
neg dl
jb 0x6f7284
jae 0x6f72ca
jmp 0x6f72e6
shl al, 5
jmp 0x6f7287
or eax, 0xe75eeaf9
mov ax, 0x27
jmp 0x6f73d3
jmp 0x6f7277
mov ah, 0x2c
bts ax, dx
jmp 0x6f736a
bts ax, cx
jno 0x6f7380
mov ah, 0x2c
bts ax, dx
sub esp, 0x18
mov byte [esp], bh
mov ah, 0x3d
jmp 0x6f73b6
lea eax, [ebp*4]
bswap eax
inc dl
jmp 0x6f739b

Function at 0x6f7603
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea edx, [edx*4]
lea esp, [esp + 2]
jmp 0x6f7623

Function at 0x72649e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.007263bf
xchg esp, eax
cmp al, byte [edx + 0x3ca149e3]
fidiv word [esi]
dec edx
xchg edx, eax
and eax, 0x9011e6b1
adc ecx, dword [ebp - reloc.MSVCRT.dll_strncpy]
sub eax, ecx
jmp 0x726495
push edi
mov edi, eax
jmp 0x7264f1
lea ecx, [ebp - 0xc]
call 0x72649e
inc esp
mov dword [esp], ecx
call fcn.006fde6d
jmp 0x7264bf
rdtsc
mov cx, 0x31fb
not edx
mov ecx, dword [esp]
mov dx, word [esp]
jmp 0x72650d
lea esp, [esp + 0x24]
lea eax, [esi + 0x1a]
jmp 0x7264eb
push ebx
jmp 0x72523c
add edi, 1
movzx edx, byte [edi]
pop edi
mov bh, byte [esp]
mov bx, word [esp]
jmp 0x72652c
mov ah, 0x31
xor ecx, ecx
pushal
rdtsc
jmp 0x7264d0
movzx ebx, byte [eax]
call fcn.00726516
mov ebp, eax
add ebp, reloc.MSVCRT.dll_strncpy
movzx ebx, byte [ebp]
pop ebp
jmp 0x72657a
or edx, ebx
jmp 0x726589
sub esp, 0x12
mov byte [esp], bh
lea esp, [esp + 2]
shl edx, 8
jmp 0x726564
movzx ebx, byte [eax - 2]
push eax
pop word [esp]
lea esp, [esp + 2]
jmp 0x727bf0
push dword [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
add eax, 4
call fcn.007278fb
pushfd
jmp 0x727b10
mov dword [ebp + ecx*4 + 0x34], edx
lea esp, [esp + 0x50]
inc ecx
sub esp, 0x1a
jmp 0x7279aa
lea esp, [esp + 4]
pop edi
jmp 0x727b4e
pop esi
clc
cmc
call fcn.00727b38
shl edx, 8
sub esp, 0x17
lea esp, [esp + 3]
or edx, ebx
jmp 0x727a08

Function at 0x7278fb
Capabilities:
Encode data using xor

Disassembly:
push word [esp]
jmp 0x727751
Function at 0x9fb91b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, esi
cpuid
bts eax, ecx
sub esp, 0x10
mov bp, ax
cld
jmp 0x9fb8d3
cpuid
btr esi, esi
pop word [esp + 7]
bt bx, bx
mov bx, 0x5627
xchg word [esp + 7], di
jmp 0x9fb88e
xchg byte [esp + 8], bl
cpuid
lea esi, [eax + ebp]
mov ch, byte [esp + 1]
mov ebx, ebp
jmp 0x9fb8f9
xchg cx, bp
lea ebx, [eax + edi]
mov si, cx
pop dx
xchg ebp, ebx
cld
jmp 0x9fb8bd
mov byte [esp + 9], bl
clc
mov bp, word [esp + 0xe]
rol ebx, 0xa
jmp 0x9fb93e
push bp
pushfd
mov word [esp], si
mov bh, dl
mov bl, byte [esp + 0x12]
bts ebp, esi
jmp 0x9fb8e3
mov word [esp + 9], sp
std
mov bh, ch
jmp 0x9fb8a4
mov si, word [esp + 2]
lea edx, [ecx + edx]
pop cx
bt ecx, esi
jmp 0x9fb98b
bts bp, bp
mov ah, 0x53
popal
bswap ecx
rdtsc
pushfd
jmp 0x9fb928
mov si, 0x77be
cpuid
rcr bx, 8
bswap edi
mov bp, word [esp]
mov al, dh
jmp 0x9fb971
Function at 0x9fbc24
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x33
mov bp, word [esp]
rdtsc
lea edi, [esi - 0x7e]
mov byte [esp], ch
bswap ebp
jmp 0x9fbbf4
neg dh
mov di, sp
xchg edx, eax
lea ecx, [esi + 0x75]
bsf bp, bx
jmp 0x9fbc08
btc ax, sp
lea ebx, [edx + ebx]
xchg edx, esi
lea esi, reloc.MSVCRT.dll_strncpy
add di, si
neg edi
jmp 0x9fbbb7
lea edi, [ecx + edi]
pop cx
not cl
lea ecx, [esi*4]
mov ecx, ebx
bswap eax
jmp 0x9fbbcd
lea ebx, reloc.MSVCRT.dll_strncpy
neg ch
neg cl
lea edx, [eax + 0x63]
xchg bp, di
xchg al, ah
jmp 0x9fbd07
lea ebx, [ecx + ebx]
xchg word [esp + 0x31], bx
pop eax
mov byte [esp + 0x13], bh
mov word [esp + 0x23], sp
jmp 0x9fbb89
rdtsc
mov edx, eax
mov ebx, ecx
mov ecx, dword [esp]
call fcn.009fbc67
cpuid
lea edi, [ecx*4]
mov bx, 0xc7b9
mov esi, dword [esp + 0xb]
mov si, word [esp]
jmp 0x9fbd47
xchg byte [esp + 1], cl
rdtsc
lea edx, reloc.MSVCRT.dll_strncpy
add ah, cl
mov dword [esp + 7], ecx
mov si, bx
jmp 0x9fbdad
pop eax
mov dx, cx
cpuid
bsf eax, esi
neg si
lea edi, reloc.MSVCRT.dll_strncpy
jmp 0x9fbdbc
neg ebp
stc
bswap ebp
pop word [esp]
push sp
mov cl, 0xda
jmp 0x9fbd87
neg eax
pop ebp
cld
cld
xchg bl, cl
pushfd
jmp 0x9fbdca
mov edi, dword [esp + 7]
adc ah, dl
mov ecx, dword [esp + 2]
xchg byte [esp + 2], ch
jmp 0x9fbf0d
xchg byte [esp + 5], bh
xchg word [esp + 6], bx
cpuid
mov ax, 0x9c94
lea ebx, [eax*4]
pop eax
jmp 0x9fbe36
bswap eax
mov dh, byte [esp + 6]
sub esp, 9
pop edx
and edx, 0xac7fdeca
lea esp, [esp + 8]
jmp 0x9fbdfc
pop word [esp]
neg bl
mov ah, al
call 0x9fbe44
scasb al, byte es:[edi]
add esp, 4
bswap edi
cpuid
jmp 0x9fbed2
cpuid
pop word [esp + 4]
mov byte [esp + 6], dl
inc si
rcr di, cl
mov esi, dword [esp + 2]
jmp 0x9fbe20
bswap ebx
not dx
bswap edx
clc
call fcn.009fbe87
mov ebp, 0x81562bad
bsf ecx, edx
mov byte [esp + 1], bh
lea ebx, [esp + eax]
inc ecx
push word [esp + 3]
jmp 0x9fbee2
clc
mov eax, edx
bswap ebp
mov byte [esp], dh
push word [esp]
xchg bl, cl
jmp 0x9fbea5
sub cl, 0x40
xchg di, bx
lea edx, [ebx + 0xe3]
btc ebp, ecx
neg esi
lea esp, [esp + 1]
jmp 0x9fbf9b
push word [esp]
bsr si, dx
pushfd
not edi
mov di, word [esp + 8]
shl bp, cl
jmp 0x9fbe5b
mov cx, 0xde0b
mov edx, ebx
mov bh, byte [esp + 6]
xchg byte [esp + 6], bh
jmp 0x9fbf66
pop word [esp + 1]
rdtsc
xchg word [esp + 2], cx
xchg dl, bl
xor bh, 0x99
mov al, bl
jmp 0x9fbf25
xchg ebp, ebx
pop esi
rdtsc
push dx
lea esp, [esp]
jmp 0x9fbf7c
pop dword [esp]
mov ax, di
xchg cx, di
xchg edx, ebp
not si
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x9fbf50
lea ecx, [esi*4]
rdtsc
sub dl, al
xchg edx, ecx
sub esp, 9
neg cx
jmp 0x9fbfcc
mov ebp, 0x85e7a4b9
neg ebp
mov cl, 0xe0
mov esi, ecx
push word [esp + 7]
xchg edx, ebx
jmp 0x9fbf3b
mov byte [esp + 7], ch
mov ax, bx
mov di, word [esp + 2]
clc
xchg dword [esp], edx
mov word [esp + 2], bx
jmp 0x9fbfe6
not bl
mov dx, 0x3dd4
lea edx, [ebp*4]
xchg byte [esp + 6], cl
mov edi, eax
xchg word [esp + 5], si
jmp 0x9fbfaf
lea esp, [esp + 5]
neg edx
mov dl, byte [esp + 1]
neg ecx
not bl
call fcn.009fc551
test eax, 0xab5839
push eax
retf 0x3f58
Function at 0x9fbcde
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, esp
rdtsc
inc edx
sub esp, 0x12
cpuid
mov dh, 0x41
jmp 0x9fbcee
neg ebx
rdtsc
lea eax, [edx + edi]
mov dword [esp], edx
mov bp, 0x56b8
jmp 0x9fbcc8
xchg word [esp], ax
lea esp, [esp + 2]
lea edi, reloc.MSVCRT.dll_strncpy
rdtsc
jmp 0x9fbd32
pop word [esp + 6]
and dl, bh
rdtsc
xchg di, ax
mov dword [esp + 5], eax
lea esp, [esp + 6]
jmp 0x9fbd15

Function at 0x9fc057
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bp
push edi
pop word [esp + 1]
mov dl, al
cpuid
mov al, bl
jmp 0x9fc062
popal
mov esi, 0x47977878
mov edi, ebx
std
jmp 0x9fc03a
xchg word [esp + 1], bp
cpuid
add esp, 2
mov ah, 0xe8
not ch
stc
jmp 0x9fc128
pushal
pushfd
popal
bsf dx, bp
xchg word [esp], ax
btc ebp, esp
jmp 0x9fc0b3
pop dx
xchg bx, cx
lea eax, reloc.MSVCRT.dll_strncpy
mov eax, ebx
push word [esp]
jmp 0x9fc0f4
sete bh
rdtsc
mov bl, byte [esp]
bts di, sp
neg bl
xor dl, 0xb6
jmp 0x9fc09f
push word [esp]
pop word [esp]
xchg ecx, eax
pop bx
jmp 0x9fc105
bsf esi, ebp
xchg cl, ah
mov bp, di
mov di, bp
rdtsc
pop ax
jmp 0x9fc0de
lea ebx, reloc.MSVCRT.dll_strncpy
mov al, cl
xchg cl, ch
push si
mov ecx, 0xa27904c2
xchg byte [esp], al
jmp 0x9fc152
pop bp
rdtsc
xchg edx, edi
dec ecx
mov ax, 0x4418
lea ecx, [esp + ebx]
jmp 0x9fc0cb
dec edx
lea esp, [esp]
or edx, 0x687be6d4
shl cx, 9
not si
neg cx
jmp 0x9fc1d2
xchg bh, al
bts edi, esp
mov ebx, dword [esp]
mov ch, byte [esp]
stc
add esp, 1
jmp 0x9fc138
mov dx, word [esp]
call fcn.009fc17c
bswap ecx
sub esp, 0x1e
mov dh, 0x44
mov dl, byte [esp + 0x16]
mov byte [esp + 0xb], ah
jmp 0x9fc3bf
push dword [esp + 5]
pushfd
bt ebp, edi
pop dx
inc cl
pop ax
jmp 0x9fc34e
xchg dword [esp + 0xe], edx
mov cl, 0x2e
lea ebx, [ebp*4]
mov si, word [esp + 0xf]
bsf esi, edi
mov byte [esp + 0x15], al
jmp 0x9fc234
push word [esp + 0x15]
bsf ecx, esi
btc dx, si
call fcn.009fc2c0
btr dx, cx
mov di, word [esp + 0xe]
bsr eax, ebx
rdtsc
jmp 0x9fc3a0
inc si
xchg edi, esi
lea esp, [esp + 8]
bswap esi
pop ax
bsf esi, edx
jmp 0x9fc43b
mov edx, 0xc6c34d9a
bsf ebx, ecx
mov di, 0xfe79
lea eax, [ecx*4]
std
mov edi, dword [esp + 0x15]
jmp 0x9fc38a
pop dword [esp + 0xe]
push bp
pop edx
mov edi, dword [esp]
bswap edi
setne dh
jmp 0x9fc252
inc cl
pop dword [esp + 1]
mov bh, 0xa6
lea esp, [esp + 0xd]
mov byte [esp + 1], dl
jmp 0x9fc41a
push word [esp + 0xe]
cld
mov word [esp + 3], sp
lea ebp, [ebx*4]
not ah
mov bx, word [esp + 0xb]
jmp 0x9fc3d3
rdtsc
mov si, 0x5b42
rdtsc
setbe dl
lea edx, [edx + edi]
pop di
jmp 0x9fc4f8
xchg word [esp], cx
xchg al, ah
neg ecx
lea ebp, reloc.MSVCRT.dll_strncpy
setne ch
xchg esi, edi
jmp 0x9fc404
rdtsc
mov bh, al
std
mov cl, bl
mov word [esp + 0xf], di
neg bh
jmp 0x9fc3e9
mov cl, byte [esp]
btr dx, ax
rdtsc
call fcn.009fc47d
neg ebx
call fcn.009fc52d
add dword [esi + reloc.MSVCRT.dll_strncpy], ecx
xchg ecx, eax
and esi, dword [ebx - reloc.MSVCRT.dll_strncpy]
adc dword [eax + reloc.MSVCRT.dll_strncpy], edx
push esp
bts edx, ebp
btc ebx, ecx
pop esi
mov bp, dx
jmp 0x9fc506
Function at 0x9fc2c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebp, esi
rdtsc
sub esp, 0x15
lea esi, [edx*4]
rdtsc
jmp 0x9fc29b
mov cl, 0x7b
pop ax
mov byte [esp + 3], al
rcl ebp, 4
mov word [esp + 0x1d], si
lea edi, [eax + 0xb0]
jmp 0x9fc26d
add esp, 0xf
xchg byte [esp + 0x20], ah
bsr cx, si
push dword [esp + 0xd]
push edx
pop dword [esp + 0x10]
jmp 0x9fc2e1
sub cl, 4
mov dword [esp + 0xf], ecx
neg dh
jmp 0x9fc283
cpuid
setns dh
mov dx, word [esp + 0xf]
pop dword [esp + 0x1b]
jmp 0x9fc313
lea edi, [ebp*4]
mov dx, word [esp + 2]
bt edi, esi
lea esi, reloc.MSVCRT.dll_strncpy
push dword [esp + 0xf]
cld
jmp 0x9fc2cb
btc dx, ax
std
push word [esp + 0xa]
not eax
pop dword [esp + 3]
jmp 0x9fc32b
bsr edi, ecx
mov word [esp + 0x25], bx
setb dh
pop dword [esp + 0x1f]
pop dword [esp + 9]
add esp, 0x17
jmp 0x9fc2fd
clc
lea edi, reloc.MSVCRT.dll_strncpy
btr ecx, esp
lea ebp, reloc.MSVCRT.dll_strncpy
sub esp, 0xf
cpuid
jmp 0x9fc375
cmc
mov dword [esp + 4], esp
bt esi, ecx
neg dl
mov word [esp + 0x12], sp
push dword [esp + 0x16]
jmp 0x9fc35f

Function at 0x9fc47d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx + ebp]
mov byte [esp + 4], ah
pop cx
lea eax, [ebx*4]
jmp 0x9fc4cb
lea edx, reloc.MSVCRT.dll_strncpy
xchg byte [esp], dl
cmc
sub esp, 0x14
lea eax, [esi*4]
jmp 0x9fc44b
mov si, 0x60c3
mov ecx, dword [esp + 1]
mov ah, 0xa1
jmp 0x9fc461
pop si
pushal
mov edx, esi
bsf di, di
mov dl, 0xa6
rdtsc
jmp 0x9fc4b2
xchg byte [esp + 8], ch
mov edx, esi
mov bx, bp
push ebp
add esp, 0
mov bx, word [esp]
jmp 0x9fc489
xchg byte [esp + 5], dh
lea ebx, reloc.MSVCRT.dll_strncpy
mov byte [esp + 0x29], bl
pop word [esp + 0x16]
jmp 0x9fc4de
push dword [esp + 4]
mov dl, dh
rdtsc
rdtsc
add esp, 0xb
mov dword [esp + 1], ecx
jmp 0x9fc49f
lea ecx, [esi*4]
xchg ebx, eax
add cx, bx
rdtsc
mov dword [esp + 0x1e], ebx
rdtsc
jmp 0x9fc51c
neg ax
push sp

Function at 0x9fc56e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x13
add esp, 8
jmp 0x9fc59d
setb ch
sub esp, 0xb
add bx, 0xc9b0
mov dl, 0x4e
xchg bh, cl
cld
jmp 0x9fc5f2
mov dword [esp], eax
push dword [esp + 1]
mov ah, byte [esp + 9]
mov dword [esp + 3], eax
jmp 0x9fc5dc
mov eax, dword [esp + 8]
xchg si, ax
add esp, 7
sub esp, 0x1b
bswap edi
jmp 0x9fc61c
mov ah, al
cpuid
add ebx, edi
bsr bx, bp
lea esp, [esp + 0x15]
xchg byte [esp + 4], dl
jmp 0x9fc5af
bsf di, sp
lea eax, [ecx + ebx]
pop word [esp + 0xd]
push dword [esp + 3]
jmp 0x9fc630
pop si
mov bp, dx
lea esp, [esp + 0xe]
xchg si, dx
cpuid
push dword [esp + 6]
jmp 0x9fc606
mov bp, word [esp]
pop dword [esp + 1]
pop eax
mov word [esp + 7], dx
neg ax
dec ecx
jmp 0x9fc74c
xchg edx, edi
rdtsc
mov bx, 0x9cbf
stc
xchg dh, ah
mov dh, 0xca
jmp 0x9fc65b
lea ebp, [esi*4]
xchg word [esp + 4], dx
mov si, bp
xchg word [esp + 6], si
lea ecx, reloc.MSVCRT.dll_strncpy
not bx
jmp 0x9fc679