joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60530c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
jmp 0x6052ed
mov eax, esi
xchg ebx, eax
xchg ebx, eax
jmp 0x6052cc
xchg ebx, eax
mov ax, 0x19cd
int 0x19
call fcn.0060530c
push ecx
leave
pop ecx
cmp bl, cl
or al, 0xe8
or esp, dword [edx - reloc.KERNEL32.dll_GetVolumeInformationA]
mov bx, 0x6beb
push edx
jmp 0x6052e6
lea eax, [edx + edi]
sub bl, ah
je 0x605414
jne 0x60535c
ret
jmp 0x6053a7
xchg ebx, eax
lea esp, [esp + 3]
neg ax
xchg al, ah
jmp 0x605387
mov byte [esp + 1], dh
jmp 0x605362
xchg ebx, eax
jmp 0x605415
mov dword [esp], eax
pop ebx
lea esp, [esp + 3]
call fcn.006053e1
js 0x6052f1
xor dl, 0xe7
xchg al, ah
setle bh
neg al
jl 0x60543d
out 0x86, eax
loopne 0x605385
sahf
invalid
jge 0x60543f
add byte [ebx + 0xf], bl
retf
pop ebx
bswap ebx
xchg dword [esp], eax
bsr bx, bp
je 0x605345
mov byte [esp + 1], dh
mov dword [esp], eax
pop ebx
lea esp, [esp + 3]
jmp 0x605370
neg ax
sub esp, 0xa
lea ebx, [edi*4]
jmp 0x605339
xchg ebx, eax
lea esp, [esp + 4]
inc dl
or bx, 0x339c
je 0x605337
neg ax
sub esp, 0xa
lea ebx, [edi*4]
xchg ebx, eax
lea esp, [esp + 3]
jmp 0x60533e
jmp 0x605461
sub esp, 0xc
push dword [esp]
mov bl, 0x80
jmp 0x6054b2
sub esp, 0xc
push dword [esp]
mov bl, 0x80
neg ebx
bt eax, edx
push esp
jmp 0x605494
lea esp, [esp + 0x14]
sub dl, 0x45
shr bx, cl
je 0x6054b9
jne 0x6054da
int3
neg ebx
bt eax, edx
jmp 0x60546e
lea ebx, [edx*4]
not bh
btc ebx, ebx
jmp 0x6055ce
lea ebx, [edx*4]
not bh
btc ebx, ebx
jmp 0x6055ce
setnp al
mov ebx, dword [esp]
jmp 0x605531
mov eax, dword [esp]
mov ax, 0xb3e1
mov ebx, dword [esp]
mov ebx, dword [edx + ebp]
lea eax, [esp + esi]
xchg ah, dh
xchg edx, eax
jmp 0x605559
setnp al
mov ebx, dword [esp]
sub esi, 4
neg al
jmp 0x6055b7
mov dl, 0x24
jmp 0x605562
mov dl, 0x24
neg dh
bsr dx, bp
jmp fcn.0060559a
xchg ah, dh
mov dword [esi], ebx
cmc
ja 0x605538
jbe 0x605541
neg dh
bsr dx, bp
jmp fcn.0060559a
mov ebx, dword [esp]
jmp 0x605514
jae 0x60550a
mov eax, dword [esp]
mov ax, 0xb3e1
jmp 0x605579
and edx, 0x3c
mov eax, 0x3a841a5a
inc ax
jo 0x60552b
jno 0x605502

Function at 0x6053e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
mov ax, word [esp]
bswap ebx
add ebx, ecx
or ebx, eax
lea eax, [eax*4]
jmp 0x6053f2
neg eax
mov bx, word [esp]
mov ax, 0x1233
bswap ebx
shr ax, cl
jmp 0x6053b6
lea edx, [edx + 1]
lea eax, reloc.KERNEL32.dll_GetVolumeInformationA
sub bl, ah
mov bx, ax
call fcn.006054d0
mov edx, 0x38c9ae38
xchg byte [ebp + edx - 0x5ce0137b], dl
add al, 0xb7
sahf
Function at 0x618caa
Capabilities:
Encode data using xor

Disassembly:
jmp 0x619449
lea esp, [esp + 4]
jne 0x616605
sub esp, 8
jmp 0x618f18
lcall 0x4a8d, 0xc7448c77
pop edi
cli
nop
cmp edi, dword [ebp + 0xc]
call 0x618f47
jae 0x618ef5
or al, 0xe8
aas
add byte [eax], al
add byte [ebx - 0x15], dh
jnp 0x618f2a
in eax, dx
wait
or al, 0x82
in eax, 0x14
aad 0x19
js 0x618f72
mov dl, 0x8d
and al, 7
lea esp, [esp + 7]
push esp
clc
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0x618f00
lea esp, [esp + 4]
and al, 4
jb 0x616605
jae 0x6165b6
mov ebx, 0x37c4bd2d
xchg byte [ebx + 0x46cbac3e], ch
test byte [edi + 0x648d8116], cl
and al, 1
push word [esp + 2]
mov word [esp + 1], sp
lea esp, [esp + 1]
jmp 0x618f28
mov al, byte ds:[0x38c9ae38]
mov edx, dword [ebp - reloc.KERNEL32.dll_GetVolumeInformationA]
xchg ebp, eax
add al, 0xb7
dec eax
rcl byte [esi + 0x31], 0xc0
push esi
xor eax, eax
je 0x618f6d
jge 0x618f66
je 0x618f02
xor eax, eax
dec esi
fdivr qword [ebx - 0x1cad16aa]
jae 0x618f9c
in eax, 0x50
test al, 0x24
mov edx, 0xde9f2cdd
push ecx
shl dword [eax - reloc.KERNEL32.dll_GetVolumeInformationA], 0x40
daa
shl byte [ebp - 0x3e], cl
push edi
invalid
movzx eax, word [ebp - 4]
mov si, dx
mov cx, dx
mov bl, 0xde
movzx ecx, dx
jmp 0x61660a

Function at 0x6246c9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
call 0x6246c9
ror dword [ebp - reloc.KERNEL32.dll_GetVolumeInformationA], 0x64
and al, 3
jmp 0x624770
push esp
call fcn.006246f8
push eax
mov eax, esi
lea eax, [eax + 8]
jmp 0x62472e
mov edx, dword [eax]
pop eax
push esp
mov dword [esi + 4], edi
jmp 0x6247a0
and edx, ecx
sub esp, 0x12
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
jmp 0x62471c
mov edi, edx
push esp
stc
mov byte [esp + 1], bh
jmp 0x6247ef
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
inc di
jmp 0x624782
and ebx, ecx
jmp 0x624825
stc
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
clc
jmp 0x6247c2
shr edi, 0x18
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
push edx
and edi, ecx
jmp 0x6247d8
dec bx
movzx ebx, byte [esi + 0xa]
pushal
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
jmp 0x624854
lea esp, [esp + 0x5c]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
jmp 0x62483c
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
inc bl
shl bl, 7
mov ebx, 0x19bb2ec
jmp 0x6247fe
movzx ebx, byte [esi + 0xd]
call fcn.00624bc3
or ch, byte [eax + 0x2fa8593e]
inc ebp
lds edx, [ebp + 0x3c]
iretd
and ebx, ecx
sub esp, 0x1a
stc
pushal
push word [esp + 0x33]
jmp 0x62480e

Function at 0x6246f8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 4], ch
and edx, ecx
call 0x624704
inc esp
pop word [esp]
push word [esp + 1]
jmp 0x62474c
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
mov edx, 0xa10690a4
mov dh, bh
btr edx, esp
jmp 0x624722
Function at 0x624704
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 4], ch
and edx, ecx
call 0x624704
inc esp
pop word [esp]
push word [esp + 1]
jmp 0x62474c
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
mov edx, 0xa10690a4
mov dh, bh
btr edx, esp
jmp 0x624722

Function at 0x6247b9
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x6243cd
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
add esi, 0x10
mov dx, ax
mov edi, 0x2f30efca
jmp 0x624390
mov bx, 0xb70d
shl edi, 9
mov edi, 0x93c4f9b0
movzx ebx, byte [esi + 0x11]
mov dh, byte [esp]
jmp 0x6243aa
lea ecx, [eax - 1]
neg edi
mov dword [ebp - 4], ecx
mov ecx, 0xff
jmp 0x5f7696
lea esp, [esp + 4]
jmp 0x6244b4
Function at 0x62490a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
lea esp, [esp + 0x20]
cmp eax, 1
jmp 0x62486c
call 0x624a46
sete cl
jmp 0x5fea61
test al, 8
stosd dword es:[edi], eax
ret 0x33a9
push 0x5e8432e6
call fcn.00604dbc
push 0xffffffffffffffef
outsb dx, byte [esi]
cld
wait
jbe 0x5fea3a
inc esi
jno 0x5feae6
jae 0x5feaad
push 0x5e7c72bd
call fcn.00604dbc
push edx
pop word [esp + 3]
mov word [esp], di
push edx
pop dword [esp]
jmp 0x5fead7
out dx, al
pushal
cpuid
rdtsc
popal
call fcn.005fea98
lea esp, [esp + 4]
push 0x5e7c70aa
call fcn.00604dbc
and al, 0x37
mov ah, 0x2a
dec ebp
mov esp, 0xa3602102
fidiv dword [reloc.KERNEL32.dll_GetVolumeInformationA]
sub al, 0x24
mov dword [esp], ebp
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x5feaba
xor ch, byte [0xee7bb7e]
cdq
insd dword es:[edi], dx
jl 0x5feb3f
call fcn.005fea04
push edx
jmp 0x5feb16
mov word [esp], dx
mov dword [esp], reloc.KERNEL32.dll_GetVolumeInformationA
pushal
pop dword [esp + 0x10]
lea esp, [esp + 0x1c]
call fcn.00604dbc
and edi, dword [edi - reloc.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x75], edx
in al, dx
and esp, 0xfffffff8
call 0x5feaaf
sbb bh, byte [ebp + 0x44b5d23c]
cli
lea ecx, [ecx]
invalid
jle 0x5f7605
lea ecx, [edi*4]
lea ecx, [ebp + 0xff]
call fcn.006247b9
lea esp, [esp + 2]
mov dword [esi + 8], edi
push ebp
jmp 0x6248e0
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_GetVolumeInformationA
mov ebx, dword [ebp]
pop ebp
jmp 0x6248c8
pushal
mov dword [esp], edx
cmc
stc
stc
jmp 0x624933
not edi
bswap edi
mov edi, 0x4384ccaa
jmp 0x6248ad
mov ebp, ebx
jmp 0x62488e
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [esi + 0xc]
call fcn.006248a5
push dword [esp + 2]
jmp 0x624914
push dword [esp]
push ecx
mov ecx, edi
jmp 0x62496e
push word [esp + 0x29]
jmp 0x624954
popal
clc
pushal
shr edi, 0x18
call 0x62490a
and ebx, ecx
jmp 0x624986
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
sbb dword [eax], esp
jmp 0x62493e
lea ecx, [ecx*4]
lea ecx, reloc.KERNEL32.dll_GetVolumeInformationA
mov edi, dword [ecx]
pop ecx
sub esp, 0x1c
sub esp, 0x16
jmp 0x62491c
lea esp, [esp + 0x70]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
not bl
sub bl, dh
mov bl, bh
jmp 0x624b56
popfd
in al, 0x21
pushal
add dh, dh
shr dword [edx], cl
fimul word [edx + 0x1bae9df]
add byte [eax], al
xor dword [edx + edx*2 + reloc.KERNEL32.dll_GetVolumeInformationA], edi
test al, 0xcb
bound ecx, qword [ebx + 0x15e49514]
pushal
add byte [ebx - 0x35dee314], al
stc
jmp 0x6248f7
pop ecx
cmc
call fcn.00624ad4
lea ebx, reloc.KERNEL32.dll_GetVolumeInformationA
std
outsb dx, byte [esi]
cld
wait
jbe 0x62498c
inc esi
jno 0x62495a
mov ecx, ebx
lea ecx, [ecx*4]
lea ecx, reloc.KERNEL32.dll_GetVolumeInformationA
mov ebx, dword [ecx]
jmp 0x6249b8
retf
movzx ebx, byte [esi + 0xe]
clc
stc
push ecx
jmp 0x6249ce
Function at 0x624a25
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
call fcn.006249f8
mov dword [esi + 0xc], edi
call 0x624a25
sbb esp, dword [eax + 0x66]
pop dword [esp + 0xd]
lea esp, [esp + 2]
jmp 0x624a5c
and edx, ecx
clc
pushal
lea esp, [esp + 0x20]
jmp 0x624a10
and bl, ch
retf 0x7c88
lea esp, [esp + 0x20]
jne 0x5f7696
je 0x5f7605
mov esi, 0x2bd8b929
jmp 0x624a43
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
jmp 0x624a3c
mov dword [esp], ebp
and edx, ecx
jmp 0x624a79

Function at 0x624ad4
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
call fcn.006249f8
mov dword [esi + 0xc], edi
call 0x624a25
sbb esp, dword [eax + 0x66]
pop dword [esp + 0xd]
lea esp, [esp + 2]
jmp 0x624a5c
and edx, ecx
clc
pushal
lea esp, [esp + 0x20]
jmp 0x624a10
and bl, ch
retf 0x7c88
lea esp, [esp + 0x20]
jne 0x5f7696
je 0x5f7605
mov esi, 0x2bd8b929
jmp 0x624a43
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
jmp 0x624a3c
mov dword [esp], ebp
and edx, ecx
jmp 0x624a79

Function at 0x624bc3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetVolumeInformationA]
sub esp, 0x1c
and edx, ecx
mov dword [esp], eax
and edx, ecx
jmp 0x6249a6

Function at 0x6c0b42
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi*4]
mov dl, 0x6c
mov edi, ebp
mov di, word [esp]
mov ebx, esi
jmp 0x6c0b82
neg edx
sete ch
xchg bx, ax
mov edi, 0x7b35da98
not edx
rdtsc
jmp 0x6c0ac0
lea ebp, reloc.KERNEL32.dll_GetVolumeInformationA
xor dl, ch
mov cl, ch
shr ah, 1
mov cl, ch
btc eax, ebx
jmp 0x6c0ad7
mov di, dx
mov bl, 0xc8
lea edi, [edx + edx]
cmc
rdtsc
inc ax
jmp 0x6c0afa
lea esp, [esp + 0x44]
pushal
jmp 0x6c0b20
pop dword [esp]
xchg bp, dx
mov ah, byte [esp + 1]
mov ecx, 0xc01e083a
not cx
setae ah
call fcn.006c0bd6
sbb byte [ebx - 0x50], bh
out dx, al
mov al, 0xee
mov bp, word [esp + 6]
xchg byte [esp + 1], dl
bswap eax
mov ax, word [esp + 2]
add ebp, ebp
jmp 0x6c0b49
lea eax, [eax + ebx]
setns ch
sub esp, 0xc
mov di, word [esp + 6]
mov edi, ecx
pop dword [esp]
jmp 0x6c0b65

Function at 0x6c0cad
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 5
pop si
mov ecx, dword [esp]
jmp 0x6c0d02
cpuid
sub edx, eax
neg dx
lea edi, [eax - 0x51]
add esp, 0
add esp, 2
jmp 0x6c0cd6
Function at 0x6c0f85
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, di
push dword [esp + 8]
pop dword [esp + 2]
btr esi, esp
jmp 0x6c0f71
mov byte [esp + 0xa], ah
pop bx
sub di, 0xbfc0
pop di
push dword [esp + 6]
btr eax, edx
jmp 0x6c0f45
lea esp, [esp + 7]
pop ecx
lea ecx, reloc.KERNEL32.dll_GetVolumeInformationA
xchg di, bx
call 0x6c0f85
dec esp
pop esi
mov ebx, dword [esp]
jmp 0x6c0fcf
rol si, cl
mov byte [esp + 8], bh
mov eax, ebp
jmp 0x6c0f5b
btc edx, ebx
not ah
bswap esi
mov cl, 0xaa
neg dh
rdtsc
jmp 0x6c0fb9
mov word [esp + 3], dx
btr ebx, edx
rdtsc
cld
add esp, 6
cpuid
jmp 0x6c1000
lea esi, [edi*4]
mov dl, dh
sub esp, 0xa
lea edi, [esp + ebx]
mov dword [esp + 1], eax
mov word [esp + 6], di
jmp 0x6c0fa6
add esp, 0
mov ebx, ecx
btc ecx, edi
rdtsc
neg edi
mov di, word [esp]
jmp 0x6c1041
mov bl, bh
xchg byte [esp + 2], bl
pop ecx
lea edi, [ecx*4]
lea ecx, [eax + 0x89]
jmp 0x6c0fe9
mov bl, 0x48
lea eax, [edx + edi]
pushal
setge ch
not ah
pop si
jmp 0x6c1029

Function at 0x6c116f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
push esp
rdtsc
mov word [esp], di
cmc
clc
jmp 0x6c119a
bsr si, cx
mov cl, 0x12
add esp, 0
xchg bp, bx
xchg byte [esp], al
neg bh
jmp 0x6c113e
xchg word [esp + 2], cx
cpuid
lea edx, [ecx + 0xeb]
pop eax
lea esp, [esp]
jmp 0x6c1158
xchg byte [esp], cl
xchg edx, ebp
neg ax
rdtsc
lea esp, [esp + 1]
xchg byte [esp + 1], bl
jmp 0x6c1256
xchg ecx, ebx
mov ebx, 0x42097b42
xchg edi, ebx
mov ebp, dword [esp]
clc
xchg word [esp + 2], dx
jmp 0x6c1182
push dword [esp + 0x18]
lea esp, [esp + 0x42]
mov bp, 0x5351
bswap ebp
mov dx, 0xcf07
clc
jmp 0x6c11c9
and bp, 0xda2
xchg byte [esp + 0x1b], cl
mov dword [esp + 7], eax
not ebp
shl ax, cl
pushal
jmp 0x6c11e6
pop si
not bh
xchg byte [esp + 8], cl
btc ecx, ebx
not ch
setns dh
jmp 0x6c1205
sub esp, 0x14
push dword [esp + 8]
shl bx, cl
lea eax, [esi + edi]
push dword [esp + 0xe]
cmc
jmp 0x6c123a

Function at 0x6c15d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 5], ecx
mov word [esp + 6], dx
pushal
clc
mov di, word [esp + 0x1e]
jmp 0x6c168d
mov bx, di
pop si
jmp 0x6c15ba
lea esp, [esp + 0xd]
rdtsc
pop dword [esp + 3]
mov byte [esp + 0xb], ah
bsf si, si
mov ah, byte [esp + 4]
jmp 0x6c161f
xchg dword [esp + 0x14], ecx
neg ax
pop ax
setp ch
pop ecx
xchg byte [esp + 0x1d], cl
jmp 0x6c163d
bsr si, bp
mov word [esp + 0x18], di
mov bl, 0x80
mov ax, 0x39d5
mov al, 0xde
pop ebx
jmp 0x6c165a

Function at 0x6c17ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr bh, 3
cmc
mov cl, ch
inc bx
lea ecx, reloc.KERNEL32.dll_GetVolumeInformationA
stc
jmp 0x6c17d8
jmp 0x6c1790
Function at 0x6c40d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, 0x5c29
mov al, ah
xchg dword [esp + 0x15], ebx
sub esp, 0x12
xchg ch, dl
lea esp, [esp + 0x2d]
jmp 0x6c3fc9
cpuid
mov bl, bh
lea esp, [esp + 0x24]
add al, dh
pushal
mov eax, 0x697844
jmp 0x6c3f6c
stc
bswap ecx
bsr cx, cx
pop ebx
sub edx, eax
rdtsc
jmp 0x6c3fb3
xchg dword [esp], edx
lea esp, [esp + 3]
mov bl, bh
lea ebp, [ebp + 0xd7]
clc
jmp 0x6c4053
mov bh, byte [esp + 7]
xchg byte [esp + 6], bl
and esi, ecx
xchg word [esp + 1], ax
and edx, ecx
jmp 0x6c3fa1
pushal
inc al
mov dl, dh
btr esi, edx
xchg di, bx
push edx
jmp 0x6c3f8f
mov word [esp + 1], sp
add esp, 4
stc
btr eax, esp
call fcn.006c4035
sub al, 0xbf
das
dec edx
mov ecx, 0x310f126e
rdtsc
mov bl, 0xe8
mov bl, bh
mov dl, 0x74
xchg byte [esp], al
mov cl, 0xb2
jmp 0x6c3fee
mov al, ah
neg esi
lea eax, [esi*4]
pop dword [esp + 3]
pop dword [esp]
stc
jmp 0x6c4006
inc edx
sub esp, 0xa
mov ebx, dword [esp + 0xb]
mov dword [esp + 2], ebp
xchg dword [esp + 6], eax
setbe ch
jmp 0x6c4020
setp ah
inc cx
jmp 0x6c3fe0

Function at 0x6c4185
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xc], di
mov byte [esp + 0xf], ch
jmp 0x6c41f4
lea ecx, [esi*4]
pop dword [esp]
mov dx, word [esp + 0xa]
cpuid
xchg word [esp + 0xd], bp
add esp, 2
jmp 0x6c42ab
mov edi, ebp
push esp
xchg ecx, eax
neg dh
btr ebx, edx
lea esp, [esp + 1]
jmp 0x6c4242
xchg byte [esp + 5], al
bswap ebx
lea esi, [eax*4]
mov dword [esp + 0xb], eax
jmp 0x6c428d
not dh
bsr cx, bp
stc
mov bx, dx
cpuid
rdtsc
jmp 0x6c422e
xchg edi, ebx
lea eax, [ebp*4]
bswap ebp
lea ecx, [esp + ecx]
bswap esi
mov dx, word [esp + 2]
jmp 0x6c4259
push word [esp + 0xd]
lea edi, [edi*4]
lea edx, reloc.KERNEL32.dll_GetVolumeInformationA
mov word [esp + 6], sp
jmp 0x6c4391
sub bl, ah
rdtsc
bswap edx
btr esi, edx
mov dh, byte [esp + 0xf]
inc bl
jmp 0x6c4276
mov edi, 0xa15335ec
mov ecx, dword [esp]
xchg ah, bl
mov ebx, dword [esp]
xchg cx, bp
cmc
jmp 0x6c4375
mov esi, ebp
add esp, 0
btc ebx, ebx
xor cx, 0xca4
xchg bx, cx
jmp 0x6c42bc
mov bx, word [esp + 4]
push dword [esp + 3]
mov ebp, 0xf79c9388
lea esp, [esp + 0xc]
jmp 0x6c42df
pop word [esp + 7]
sub esp, 2
lea esp, [esp + 1]
mov edx, ecx
pop word [esp + 8]
mov edx, dword [esp + 1]
jmp 0x6c42fa
pop ax
lea ebp, [ecx*4]
xchg ah, bl
pop word [esp + 1]
not ax
mov byte [esp + 6], ah
jmp 0x6c4312
xchg edi, esi
bsr bp, cx
bswap ebx
btr eax, esp
lea esp, [esp + 1]
xchg ch, dl
jmp 0x6c5510
lea esi, [edi + ebp]
mov byte [esp + 1], ah
mov ah, byte [esp + 1]
clc
xchg ch, dl
xchg byte [esp], al
jmp 0x6c4356
pop dword [esp + 4]
xchg ch, dl
mov ax, sp
mov cx, 0x4f43
mov di, sp
sub bl, ah
jmp 0x6c433d
mov si, word [esp + 0x18]
call fcn.006c52bf
salc
inc esi
aam 0xb3
dec esi
jmp 0xed84e08
mov bp, 0xbfc1
cpuid
mov eax, dword [esp + 0x18]
cmc
mov di, word [esp + 0x1a]
mov eax, ebp
jmp 0x6c5290
bswap ecx
inc ebp
bsf bx, si
mov ah, byte [esp + 0xd]
mov ax, di
add esp, 3
jmp 0x6c52ab
pop word [esp + 0x13]
mov cx, sp
btc esi, edi
mov al, ah
xchg ecx, ebp
mov dh, byte [esp + 0xb]
jmp 0x6c52d9
bsf ax, ax
mov edx, dword [esp]
sub esp, 4
pushal
rcl bp, cl
mov dl, 0x4c
jmp 0x6c53da
Function at 0x6c53f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 4]
xchg dword [esp + 2], edx
inc bl
xchg edx, ecx
jmp 0x6c54b9
cmc
lea esp, [esp + 5]
mov al, ah
xchg word [esp + 1], bx
pop word [esp + 1]
xchg di, si
jmp 0x6c543e
sub di, 0xe588
rdtsc
mov dword [esp + 1], esi
not ecx
mov eax, 0xd02152
pop ecx
jmp 0x6c545b

Function at 0x6c548c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
pop word [esp]
mov word [esp], di
xchg di, si
sub esp, 2
rdtsc
jmp 0x6c548e
jmp 0x6c5471
lea eax, [edi*4]
mov ax, word [esp + 4]
add di, 0x4c36
pushal
mov dl, 0x24
mov ah, byte [esp + 0x20]
jmp 0x6c54ed
mov ax, word [esp]
mov al, ah
not bp
cpuid
mov dx, word [esp]
mov bl, byte [esp]
jmp 0x6c58b8
pushal
lea esp, [esp + 0x45]
bsf ax, ax
xchg ebp, edi
mov eax, dword [esp]
mov eax, ebp
jmp 0x6c54ce
mov ecx, dword [esp]
rcr bh, 3
ror ch, 5
call fcn.006c555a
rdtsc
push word [esp + 3]
call 0x6c5599
mov ecx, 0xfec58166
sbb edi, dword [edi - 0x666bddd0]
pop ebp
push word [esp + 3]
call fcn.006c5610
xchg esp, eax
sbb cl, byte [eax - 0x40be511]
shl byte [esi - 0x79], cl
je 0x6c55de
add dword [edi + reloc.KERNEL32.dll_GetVolumeInformationA], eax
mov ebx, 0x3c8966d9
and al, 0xf
leave
jmp 0x6c558c
mov di, 0xd8a9
mov dx, word [esp]
mov dl, byte [esp]
mov bp, 0x7479
xchg bh, cl
mov ebp, 0xcf867479
bsr dx, bp
jmp 0x6c557e
lea ebx, [eax*4]
xchg edx, ecx
rdtsc
and bp, 0x356a
btr esi, edx
btc ebx, ebx
jmp 0x6c55d2
xchg ah, bl
rcr bh, 3
cpuid
rcr eax, 7
shr ecx, 1
rdtsc
jmp 0x6c562d
lea ebx, [eax - 0xc9]
mov dl, dh
mov dx, word [esp]
ror ah, 1
mov cl, byte [esp]
mov dl, dh
jmp 0x6c581c
Function at 0x6c59fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
mov si, sp
push dword [esp + 2]
mov di, dx
lea ebp, [ebp*4]
sub esp, 0x1e
jmp 0x6c5a58
xchg ah, bl
lea esp, [esp + 3]
xchg byte [esp], bl
jmp 0x6c59d8
xchg bh, cl
mov word [esp], dx
setae ah
lea edi, [edx*4]
bswap ebx
jmp 0x6c5abf
mov esi, dword [esp + 0x1f]
cld
popal
pop dx
xchg edx, ebx
xchg cx, bx
jmp 0x6c5a27
bswap edi
pop ebp
bswap esi
mov al, 0x2e
and cl, bh
mov dx, word [esp + 0xe]
jmp 0x6c5a40
mov cx, 0x6b57
add bp, 0xfc46
rcr dh, 7
mov cl, 0xf2
mov ebx, dword [esp]
mov edi, eax
jmp 0x6c5b7c
cld
rdtsc
lea edx, [edx + edx]
lea edx, [esp + esi]
mov ax, word [esp]
mov cl, 0xda
jmp 0x6c5a68
cmc
not dh
mov cl, byte [esp]
xchg ecx, eax
mov bx, 0x195
setge dh
jmp 0x6c5a8e
mov dx, 0xe213
rcl ax, cl
lea esi, reloc.KERNEL32.dll_GetVolumeInformationA
pop dx
clc
and ebx, ecx
jmp 0x6c5aa7
xchg byte [esp + 0x10], bl
btr edx, edx
xchg bx, ax
setnp ch
sub bl, ah
push dword [esp + 0x12]
jmp 0x6c5b52
lea ebp, [esi - 0x2d]
mov dword [esp + 0x25], esi
lea ebp, [ebx*4]
mov dword [esp + 3], ebp
jmp 0x6c5af9
inc bx
pop word [esp + 0x1b]
mov al, ah
clc
xchg ch, dl
mov edx, eax
jmp 0x6c5b11
inc edx
push dword [esp + 0xa]
setae bh
mov dx, 0xf7ef
xchg ecx, edi
xchg dword [esp + 0x14], eax
jmp 0x6c5c74
bswap edi
not dh
lea edi, [edi*4]
mov byte [esp + 0x23], bh
mov di, 0xbc77
pop bx
jmp 0x6c5b39
setge bh
sub eax, eax
xchg cx, bx
pushal
sub esp, 0x18
xchg byte [esp + 0x13], dl
jmp 0x6c5b29
sub esp, 0xc
xchg bh, cl
xchg dx, ax
mov bp, word [esp + 6]
pop edx
mov ch, byte [esp + 9]
jmp 0x6c5c2f
mov al, 0x46
mov esi, 0xddf8ddce
btr ecx, esp
shl dx, cl
pop dword [esp]
lea esi, [edi*4]
jmp 0x6c5b8e
mov edx, dword [esp]
setp bh
xchg bh, cl
mov di, 0xe057
sub esp, 8
inc ebp
jmp 0x6c5ba8
sub esp, 0x1c
lea esp, [esp + 0x56]
xchg bp, ax
lea edx, [edx + edi]
shr dh, 7
mov bl, byte [esp]
jmp 0x6c5bcc
mov ch, byte [esp + 5]
cmc
mov si, word [esp + 4]
lea esp, [esp + 5]
add esp, 0
jmp 0x6c5c5d
xchg dword [esp + 2], ebx
pop word [esp + 1]
clc
mov byte [esp + 3], ah
jmp 0x6c5c01
mov al, 0xfe
cpuid
mov cl, ch
bswap eax
pop dword [esp]
mov bp, word [esp + 2]
jmp 0x6c5c18
lea edi, [ecx + ebx]
add esp, 0
lea esi, [ebx + ebp]
setae bh
rdtsc
call fcn.006c5e0a
invalid
and cl, bh
xor edx, esi
cpuid
btr ebx, edx
neg dx
btr eax, edx
jmp 0x6c5c41
xchg word [esp + 0x19], cx
mov bp, 0x9dd
mov si, word [esp + 0x2c]
pop ecx
push word [esp + 0x23]
cpuid
jmp 0x6c5bed
Function at 0x6c5e0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr ebx, edx
mov bh, byte [esp]
xchg di, ax
rcl si, cl
rdtsc
cpuid
jmp 0x6c5d23
lea eax, [ecx*4]
lea ecx, [ebp + 0x6f]
lea esp, [esp]
mov ch, byte [esp]
rcl ax, cl
mov ecx, ebp
jmp 0x6c5c8f
lea esp, [esp]
mov byte [esp], ch
xchg byte [esp], cl
bswap eax
mov edx, dword [esp]
mov eax, 0x58412010
jmp 0x6c5cb4
cmc
pop dword [esp + 2]
xchg bh, cl
mov esi, dword [esp + 0xe]
xchg ah, bl
jmp 0x6c5d9a
lea esp, [esp]
bswap edi
sub esp, 0x16
xchg dword [esp + 1], esi
inc al
bswap edx
jmp 0x6c5cf3
mov cx, sp
add esp, 0
inc esi
bswap ebx
neg ah
btc ecx, edi
jmp 0x6c5d09
xchg word [esp + 0x1a], bp
mov word [esp + 0x1a], bx
mov ax, dx
jmp 0x6c5d77
inc edx
mov ch, byte [esp]
mov dh, byte [esp + 0x15]
push edx
xchg dword [esp + 0x17], edi
bswap edi
jmp 0x6c5d33
xchg dh, al
pop dword [esp + 0xe]
mov esi, dword [esp + 4]
setns ah
bsf ax, si
mov ah, byte [esp + 4]
jmp 0x6c5d49
bsf di, si
bsf di, si
pop cx
lea ecx, [esp + edi]
sub esp, 0x18
mov cl, 0x12
jmp 0x6c5ded
mov word [esp + 5], di
lea ebp, [edx + edx]
neg ah
sub esp, 0xa
push dword [esp + 8]
jmp 0x6c5d60
pop cx
mov edx, dword [esp]
lea ecx, [ebp*4]
lea edx, [esi + 0x1d]
xchg edx, ebx
lea esp, [esp + 2]
jmp 0x6c5cde
lea eax, reloc.KERNEL32.dll_GetVolumeInformationA
mov cx, word [esp + 4]
lea ebp, [ebx + ebx]
mov dx, di
add esi, ebp
shl bp, cl
jmp 0x6c5db2
add esp, 0x34
push esp
mov dword [esp], ebp
add esp, 3
xchg dword [esp], eax
pop word [esp]
jmp 0x6c5ea8
lea eax, [ebp - 0x3f]
jmp 0x6c5dd5
mov ax, word [esp]
cpuid
not di
shr edi, 0x11
lea ebp, [eax + 0x79]
jmp 0x6c5e39
lea esi, [ebp - 0xd7]
shl si, cl
rdtsc
xchg byte [esp + 8], dl
xchg ah, bl
popal
jmp 0x6c5e0f
not ah
inc ebp
add cx, 0x1006
setl ch
call fcn.006c5e8b
push ecx
rcl byte [ebx - 0x36]
xchg esp, eax
xchg ch, dl
stc
neg bx
pop cx
xchg ecx, edx
pushal
jmp 0x6c5e25
setae dh
mov ch, byte [esp + 1]
pop si
mov ebp, 0x8a206584
mov edi, eax
sub esp, 2
jmp 0x6c5e4f