joyce8/EMBER2024-capa huggingface dataset:
Function at 0x373958e
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bl
test sp, di
mov bl, byte [eax + 1]
jmp 0x3736ded

Function at 0x373959b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
add edx, 0x10001f04
pushfd
not al
mov eax, dword [ebp - 0x9c]
push dword [esp]
mov dword [edx + 1], eax
lahf
movzx ax, bl
aas
aam 0xd3
mov eax, dword [ebp - 0xc]
stc
cmc
mov dword [edx + 6], eax
bt eax, 0x1b
lahf
mov edx, dword [ebp - 0xac]
aam 0xe0
aam 0x8d
cwde
cmp edi, esp
add edx, 0x10001f1a
shr ah, 6
lea eax, [ebx + 0x33175bbf]
bt esi, edx
ror ah, 6
mov eax, dword [ebp - 0xb8]
test di, bp
sub eax, edx
bt cx, 3
sub eax, 5
mov byte [esp + 4], al
push 0x5ad444b2
mov word [esp + 0x18], 0x7e64
mov dword [edx + 1], eax
pushfd
jmp 0x37389a3

Function at 0x373967c
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
push 0xaca518e0
mov ecx, dword [eax + 0x30]
test cx, 0xb196
bt ecx, edi
pushfd
cmp al, 0xd3
xor edx, edx
movsx dx, dl
inc dh
not dl
and dx, bx
mov dx, word [ecx + 0x14]
test cl, dh
cmp edx, 0x6c
mov word [esp + 8], 0x8241
call fcn.03735762

Function at 0x373977e
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, 0x6c6c
pushfd
pushfd
call fcn.037342e3

Function at 0x3739863
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
mov dword [ebp - 0x12c], 1
mov byte [esp], dl
lea esp, [esp + 0x5c]
jmp 0x3734995

Function at 0x3739961
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x373a703
lea esp, [esp + 0x10]
jne 0x3736760
sbb ah, 0x88
bswap cx
mov eax, dword [ebp - 0x104]
btc cx, si
or cl, dh
cmc
movsx cx, bl
mov ecx, dword [eax + 0x30]
call fcn.037320f3
push dword [ebp - 0xc8]
pop dword [esp + 0x44]
push esp
pushfd
pushfd
push dword [esp + 0x50]
ret 0x54

Function at 0x3739a1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
jne 0x37341da

Function at 0x3739c84
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x1c88985c
mov byte [esp], bh
lea esp, [esp + 8]
je 0x37336ab
aad 0x32
mov eax, dword [ebp - 0x44]
clc
sub ecx, ecx
stc
bt ax, 9
sal cl, cl
mov cl, byte [eax + 7]
pushfd
test si, 0x4563
bt ebp, ecx
bt edi, 0xa
cmp ecx, 0x44
pushfd
mov dword [esp], 0x927f70a6
push 0x2d1068a5
lea esp, [esp + 0xc]
jne 0x37341da
bt di, bx
xor edx, edx
rol dl, 3
shr dl, 5
adc dl, 0x40
seta dl
mov dl, byte [ecx + 7]
mov byte [esp], bl
bt esi, 1
pushfd
cmp edx, 0x64
jmp 0x3739d1f
jmp 0x373365d

Function at 0x3739d55
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x3734148
pushfd
cmp dword [ebp - 0x118], 0
mov word [esp], di
mov byte [esp], dl
call fcn.037372ed
push dword [esp + 4]
mov byte [esp], bl
mov dword [ebp - 0x108], eax
pushfd
pushal
mov word [esp], sp
push esi
lea esp, [esp + 0x34]
jmp 0x3738c4d
Function at 0x3739de3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [edx + 1], eax
and al, 0xcb
shr ah, cl
rcr eax, cl
movzx ax, dl
mov eax, dword [ebp - 0xc]
pushfd
mov word [esp], bp
mov dword [edx + 6], eax
movsx eax, al
cwde
mov edx, dword [ebp - 0xac]
sar ax, 4
shrd ax, cx, 5
not eax
lahf
add edx, 0x10001f1a
call fcn.03733634
cmp ch, 0x1d
not ax
rcr ah, 5
mov eax, dword [ebp - 0x9c]
pushfd
clc
jmp 0x3738f79
cmc
mov dword [edx + 1], eax
clc
bsf dx, dx
mov edx, dword [ebp - 0xac]
aaa
movsx eax, cl
movzx eax, dl
sub al, 3
add edx, 0x10001f04
jmp 0x37391dc

Function at 0x3739e2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
test cl, 0x3a
mov dl, byte [ecx + 4]
call fcn.037335f6
pushal
pushal
push dword [esp]
lea esp, [esp + 0x44]
jne 0x3736760
bt cx, si
bswap ax
cmc
mov eax, dword [ebp - 0x104]
call fcn.03739eea
mov byte [esp], 0xbf
pushfd
sub edx, edx
jmp 0x3732dca

Function at 0x3739e7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
lea esp, [esp + 0x50]
jb 0x373c13f
cmc
mov ecx, dword [ebp - 0xf8]
clc
cmc
add ecx, dword [ebp - 0xf0]
push 0xba4673f1
cmp dword [ebp - 0x108], ecx
push 0x62acabd4
lea esp, [esp + 8]
jb 0x3739730
jmp 0x37332a8

Function at 0x3739f0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x34], 0
push 0xd12dbbe2
mov dword [esp + 0x34], 0x3736d2e
call fcn.03737a2f

Function at 0x3739f25
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jbe 0x3736df2
jmp 0x373c94a
pushfd
pushfd
mov dword [esp], fcn.028a11d2
neg dl
pop eax
test al, bl
bswap edx
sub eax, 0x100010d7
rcl bh, cl
and ebx, edi
dec bh
mov dword [ebp - 0xac], eax
call fcn.0373571f

Function at 0x373a09a
Capabilities:
Execute anti-debugging instructions

Disassembly:
test edx, edx
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jne 0x3739ec8
rdtsc
rdtsc
bswap ax
mov eax, dword [ebp - 0x100]
pushal
pushfd
mov byte [esp + 4], 0x3c
mov ecx, dword [eax + 0x18]
movzx dx, bl
movsx dx, bl
bswap dx
mov dword [ebp - 0xf8], ecx
bswap dx
pushfd
lea eax, [ecx*4 + 0x78b2cd3f]
mov edx, dword [ebp - 0x100]
lahf
lea eax, [edi + 0x683f8bd3]
lahf
setl ah
mov eax, dword [edx + 0x20]
pushfd
call fcn.03737f08

Function at 0x373a0f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x3736760
xchg ah, cl
bswap ecx
mov eax, dword [ebp - 0x104]
pushal
add cx, 0xe7cf
btc ecx, edi
sbb cl, 0xbf
mov ecx, dword [eax + 0x30]
push 0xf788fbaf
jmp 0x37379b7

Function at 0x373a128
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x3c]
je 0x3735eea
bswap dx
or dx, 0x9aca
not dl
mov edx, dword [ebp - 0x44]
clc
jmp 0x3733429

Function at 0x373a1a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cx
pushfd
bswap cx
mov ecx, dword [eax + edx*4]
jmp 0x373b507
cmc
call fcn.0373307e

Function at 0x373a1fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
lea esp, [esp + 8]
jne 0x3739ec8
Function at 0x373a377
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0373a17a
push 0xf9e6917d
push dword [esp + 0xc]
lea esp, [esp + 0x28]
je 0x37341da
btc eax, 0xb
adc dx, dx
xor dh, ah
push 0xb0a08c6e
mov edx, dword [ebp - 0xac]
push edi
add edx, 0x10001efc
daa
mov eax, dword [ebp - 0x7c]
pushfd
jmp 0x373a887
lea esp, [esp + 0x48]
je 0x373a7bd
shl al, cl
aas
shrd ax, bx, cl
lahf
mov eax, dword [ebp - 0x44]
pushfd
cmp bl, bh
push edx
push 0xa66b1351
xor ecx, ecx
rol cl, cl
stc
neg cl
mov cl, byte [eax + 1]
pushal
cmp ecx, 0x53
mov byte [esp], ch
call fcn.03734a2a
mov dword [esp], 0x3737aad
jmp 0x3735d61
mov word [esp], 0xf073
jmp 0x3737dc6
mov dword [eax], edx
bsf ax, ax
mov edx, dword [ebp - 0xac]
bswap ax
setp ah
shld ax, bx, cl
btr ax, si
add edx, 0x10001f34
stc
setle ah
mov eax, dword [ebp - 0xdc]
call fcn.0373a5aa

Function at 0x373a58f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0373871f
push 0xd7114132
lea esp, [esp + 4]
je 0x37341da
pushal
stc
call fcn.037360a7

Function at 0x373a64f
Capabilities:
Execute anti-debugging instructions

Disassembly:
aas
neg cx
mov eax, dword [ebp - 0x100]
mov cx, 0x752
mov ecx, dword [eax + 0x30]
clc
cmc
xor edx, edx
btr dx, sp
rol dl, 2
not dx
add dh, 0x64
mov dx, word [ecx + 0xc]
pushfd
clc
cmc
jmp 0x373c417
lea esp, [esp + 0xc]
jne 0x3739ec8
jmp 0x3739fc7
cmp edx, 0x64
mov byte [esp], 0xd9
lea esp, [esp + 4]
jo 0x373b606
pushfd
push dword [esp]
lea esp, [esp + 8]
je 0x3739951
aam 0x8f
clc
mov eax, dword [ebp - 0x100]
sbb cx, sp
bswap ecx
and ch, bh
pushfd
mov ecx, dword [eax + 0x30]
bt bx, 6
stc
sub edx, edx
cmc
clc
rcr dh, 3
mov dx, word [ecx + 0xc]
mov byte [esp], 0x8b
stc
cmp edx, 0x44
call fcn.03739c60
Function at 0x373a6ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, ecx
movsx bx, cl
neg bx
add eax, edx
bts bx, di
movzx bx, dl
rcr bh, 2
btr ebx, 4
mov eax, dword [eax]
cmc
mov ebx, eax
bt ax, di
cmc
test al, ch
test ebx, ebx
pushfd
mov byte [esp], dh
lea esp, [esp + 8]
je 0x37343aa
clc
cmp bh, bh
stc
and ebx, 0x80000000
push 0x3337e9ba
call fcn.03737a54
sbb ax, 0x7a76
jmp 0x3732617

Function at 0x373a782
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x73
push edx
mov word [esp], bx
lea esp, [esp + 0x10]
je 0x373a7bd
daa
cmc
mov eax, dword [ebp - 0x44]
cmp di, 0x479a
xor ecx, ecx
test dx, 0x2e7f
mov cl, byte [eax + 1]
test esp, 0x7c9de436
cmc
cmp ecx, 0x53
pushal
lea esp, [esp + 0x20]
jne 0x37341da

Function at 0x373a81a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0373c23d
cmp edx, 0x54
mov dword [esp], 0x42f6fb6
push ecx
lea esp, [esp + 0x48]
jne 0x3739ec8
clc
btc eax, esp
cmp al, 0x9d
mov eax, dword [ebp - 0x100]
add cl, al
mov ecx, dword [eax + 0x30]
push ebx
bt cx, bp
cmp bh, cl
pushal
xor edx, edx
and dl, bh
mov dx, word [ecx + 4]
test sp, sp
push 0xf1ff8706
cmp edx, 0x64
call fcn.03737ae2
call fcn.03738a3a
pushfd
push dword [esp]
pushal
pushfd
pop dword [esp + 0x24]
call fcn.0373b8a8
mov dword [esp + 4], 0x40
mov byte [esp], bl
pushal
pushfd
push dword [esp]
mov dword [esp + 0x28], 0x3000
jmp 0x3736da2
lea ecx, [ecx + 0x169c1889]
setge dl
movzx cx, dl
mov ecx, dword [ebp - 0xfc]
setns dh
mov edx, dword [ecx]
call fcn.03736a81
push 0x8524411c
mov dword [ebp - 0x58], eax
jmp 0x3736f54

Function at 0x373ab0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x3737b07
mov bl, ah
stc
setp bl
cmp al, ah
mov bl, byte [eax + 9]
cmp dl, 0xa3
stc
test bl, bl
call fcn.0373b688

Function at 0x373ac6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0xa0]
shr edx, cl
mov edx, dword [ebp - 0xd8]
call fcn.03731ef2

Function at 0x373ac9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmp edx, 0x45
push dword [esp]
pushal
jmp 0x373c3c7
sub edx, edx
sbb dl, dh
not dl
sar dl, cl
mov dl, byte [ecx + 2]
jmp 0x3736be8
call fcn.03739a1c
rol ch, 2
mov ecx, dword [ebp - 0xa0]
cmc
add ecx, 1
bsr dx, di
rol edx, cl
bsf dx, si
and dh, 0xfd
mov dword [ebp - 0xa0], ecx
sets dh
neg dx
pushal
shrd dx, bp, cl
mov edx, dword [ebp - 0xa0]
cmp cl, al
cmp edx, dword [ebp - 0x10]
pushfd
jmp 0x373c4e0

Function at 0x373ad1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov byte [esp + 4], ah
lea esp, [esp + 0x24]
je 0x3738690
stc
movzx dx, cl
movzx edx, dl
mov edx, dword [ebp - 0x44]
pushal
pushal
cmc
sub eax, eax
neg al
not al
stc
shl al, cl
mov al, byte [edx + 3]
clc
bt sp, ax
cmp eax, 0x52
push eax
lea esp, [esp + 0x44]
jne 0x37341da
rcr cx, cl
mov ecx, dword [ebp - 0x44]
call fcn.03739e2f
bt si, di
sal al, 1
mov eax, dword [ebp - 4]
call fcn.0373c5a9
Function at 0x373aebb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
stc
test eax, eax
mov word [esp], bx
lea esp, [esp + 8]
je 0x37341da
cwde
bts dx, 7
inc dl
das
mov edx, dword [ebp - 0xac]
xor al, ah
daa
test bp, 0xe745
add edx, 0x10001efc
rcl al, cl
cmc
aam 0x79
pushal
mov eax, dword [ebp - 0x7c]
push ebx
pushfd
mov dword [eax], edx
bts ax, cx
aad 0xfe
shld ax, ax, 5
cwde
mov edx, dword [ebp - 0xac]
bt dx, 9
aaa
das
cmp bl, 0x7a
add edx, 0x10001f34
movsx eax, dl
mov eax, dword [ebp - 0xdc]
bt bx, 0xb
mov byte [esp + 4], 0xc9
pushfd
sub eax, edx
cmp al, ch
cmc
bt bp, 7
sub eax, 5
stc
stc
call fcn.03739de3

Function at 0x373b23b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov byte [esp + 4], ah
mov byte [esp], al
mov dword [ecx], edx
pushfd
mov byte [esp], 0x45
mov byte [esp + 0x10], bh
lea esp, [esp + 0x48]
jmp 0x373c1ca

Function at 0x373b2be
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmp bl, 0x4c
pushal
lea esp, [esp + 0x40]
jne 0x3737b07
push esp
lea esp, [esp + 0x28]
je 0x3738fc6
jmp 0x3738fb7

Function at 0x373b4ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 8], eax
mov byte [esp + 8], bh
push ebx
push 0x382b49aa
lea esp, [esp + 0x34]
jmp 0x37379fa

Function at 0x373b4e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x373bb73
pushal
cmp eax, dword [ebp - 0xf8]
jmp 0x3732000

Function at 0x373b524
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [ecx + 6]
stc
cmp edx, 0x6e
call fcn.03736960

Function at 0x373b5ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x3739947
lea esp, [esp + 0xc]
jne 0x3739ec8
not ch
mov eax, esp
cwde
mov eax, dword [ebp - 0x100]
call fcn.0373859d
jmp 0x3736f27

Function at 0x373b633
Capabilities:
Execute anti-debugging instructions

Disassembly:
and bh, al
mov ebx, dword [eax + 2]
jmp 0x3736486
add eax, edx
sar bh, 1
mov bl, byte [esp]
jmp 0x373b2ab

Function at 0x373b688
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.03732a05
lea esp, [esp + 0x4c]
je 0x3735b9f
dec ah
sal dl, 4
aas
bswap edx
mov eax, dword [ebp - 0xfc]
shr cl, 7
setg dh
mov cl, 0xf2
mov dword [ebp - 0x100], eax
setg ch
mov ecx, dword [ebp - 0x100]
or dh, 0x70
xor dl, 0xc8
mov edx, dword [ecx + 0x34]
cmc
clc
and edx, 4
cmp sp, dx
test edx, edx
call fcn.03736a06

Function at 0x373bd02
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jne 0x3736760
pushfd
sub edx, edx
sub dl, cl
movsx dx, cl
sub dl, 0xf4
rcl dl, cl
mov dx, word [ecx + 0x12]
pushfd
test ah, 0xed
push dword [esp]
cmp edx, 0x44
jmp 0x37321b6

Function at 0x373be54
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0x8305
pushfd
lea esp, [esp + 0xc]
je 0x37341da
test dh, dh
cmp ch, 0xaa
cmp dword [ebp - 0x90], 0
pushfd
pushfd
lea esp, [esp + 8]
je 0x37341da
push edx
cmp cl, ch
stc
cmp dword [ebp - 0x7c], 0
jmp 0x373415e
Function at 0x373bf4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
call fcn.03734e8e
lea esp, [esp + 0x34]
jne 0x37341da
and edx, edx
shl dl, 1
mov edx, dword [ebp - 0x44]
jmp 0x373558f

Function at 0x373c12f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xb6
pushal
lea esp, [esp + 0x34]
jb 0x3739730

Function at 0x373c352
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.03739b7f
lea esp, [esp + 0x50]
je 0x37336ab
movsx ax, bl
mov eax, dword [ebp - 0x44]
push edx
sub ecx, ecx
pushal
rol cl, cl
mov cl, byte [eax + 7]
cmc
cmp ecx, 0x44
pushal
lea esp, [esp + 0x44]
jne 0x37341da
not dh
mov edx, dword [ebp - 0x44]
cmp dl, 0xa2
cmp si, 0x9c3
clc
pushfd
xor eax, eax
or al, 0x4d
mov al, byte [edx + 8]
push 0x2cc9cc00
cmp eax, 0x6c
pushal
call fcn.0373b610
call fcn.0373a827
pushfd
test eax, eax
push dword [esp]
mov byte [esp + 4], 0xb6
lea esp, [esp + 8]
jbe 0x37358d0
je 0x373c37d
push 0x485d3c08
mov dword [ebp - 0x70], 1
lea esp, [esp + 4]
pushfd
push dword [esp]
call fcn.0373c91a

Function at 0x373c4b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0x37341da
lea ecx, [ebx - 0x2636bb60]
not ecx
rcr ch, cl
sub cl, dl
mov ecx, dword [ebp - 0x44]
pushal
call fcn.037325b4
Function at 0x373c4d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
add eax, 1
pushfd
pushal
call fcn.0373b4ce
lea esp, [esp + 0x20]
je 0x3734d56
bt dx, sp
pushfd
cmp al, bl
cmp bl, 0x4c
pushfd
mov byte [esp + 4], 0xf5
call fcn.03739cc4
not al
bswap eax
neg al
mov eax, dword [ebp - 8]
cmp di, si
jmp 0x3736306
pushal
mov byte [esp], 0x3d
mov dword [esp + 0x1c], ecx
push 0xb279833c
pushal
mov dword [esp + 0x3c], 0x373b5b3
call fcn.03739ec0
call fcn.0373a8cc
jmp 0x37385d6
stc
mov edx, dword [ebp - 8]
sbb ah, 0xe5
and eax, ebp
lea ecx, [edx - 0x670e5b95]
mov eax, dword [ebp - 0x64]
bswap cx
mov ecx, dword [eax + edx*4]
test bh, 0xde
sub ecx, 0x80000000
xchg dh, al
rdtsc
mov edx, dword [ebp - 8]
pushfd
movzx ax, cl
mov eax, dword [ebp - 0x64]
mov byte [esp], bl
mov dword [eax + edx*4], ecx
rdtsc
call fcn.03735488
call fcn.037326df
lea esp, [esp + 0x10]
jne 0x3739ec8
movsx dx, bl
mov eax, esi
call fcn.0373bc4b
push 0x9188fe9d
mov dword [eax + edx*4], ecx
push 0x6314810
pushfd
lea esp, [esp + 0xc]
jmp 0x3736e3d
pushfd
lea esp, [esp + 0x10]
je 0x3734d56
call fcn.037330ed
call fcn.0373c67d
sar cl, 6
bt bp, 0xa
sal cx, cl
mov ecx, dword [eax + edx*4]
pushal
test dl, 0x6a
stc
and ecx, 0x80000000
stc
bt edi, 0xa
cmp ecx, 0x80000000
pushal
pushfd
push dword [esp + 8]
lea esp, [esp + 0x48]
je 0x3737eb1
bts eax, esp
mov edx, dword [ebp - 8]
btr eax, 5
movzx ax, cl
mov eax, dword [ebp - 0x64]
sets ch
movsx cx, dl
shrd cx, dx, cl
mov ecx, dword [ebp - 0xbc]
push 0xc2af448
add ecx, dword [eax + edx*4]
aaa
das
mov dword [ebp - 0x60], ecx
xadd dx, ax
dec cl
shrd dx, cx, 7
shrd ax, si, 0xe
mov edx, dword [ebp - 0x60]
cmc
bsr ecx, eax
add edx, 2
lea ecx, [edi + 0x7930c383]
mov dword [ebp - 0x98], edx
lea eax, [eax*8 + 0x39414821]
mov byte [esp], 0x10
lea eax, [0x7a6e480d]
mov eax, dword [ebp - 0x98]
pop ecx
setne ch
movzx cx, cl
mov cx, 0xf1c8
push eax
movsx cx, al
movsx ecx, bl
movsx cx, dl
mov ecx, dword [ebp - 0xb4]
jmp 0x373759d

Function at 0x373c735
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xefa8c939
push dword [esp + 0x10]
call fcn.037354b9
mov cl, byte [esp]
pop ecx
movzx ecx, bl
mov dword [esp + 0x24], eax
push 0x1c17e2df
not cl
lea ecx, [ebp*8 + 0x7c946bc2]
mov word [esp + 0xc], 0xe146
mov ecx, dword [ebp - 0xb4]
jmp 0x3735b48
push dword [esp]
lea esp, [esp + 0x24]
je 0x3737eb1
sal ch, 7
rdtsc
daa
mov edx, dword [ebp - 8]
bts ax, bx
aam 0x37
mov eax, dword [ebp - 0x64]
rcl ch, cl
movsx cx, bl
neg ecx
sets ch
mov ecx, dword [ebp - 0xbc]
pushfd
push 0xf852a4b7
clc
pushal
add ecx, dword [eax + edx*4]
cwde
mov dword [ebp - 0x60], ecx
bt eax, esp
cdq
cmp ch, 0xf8
mov edx, dword [ebp - 0x60]
bswap cx
add edx, 2
lahf
mov dword [ebp - 0x98], edx
lahf
pushfd
mov eax, dword [ebp - 0x98]
jmp 0x3736105
Function at 0x373c798
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
neg dl
dec dl
shrd dx, si, cl
mov dx, word [ecx + 0xe]
pushfd
test di, 0x1b28
push esi
cmp edx, 0x6c
mov byte [esp], 0xd8
mov word [esp], 0xf530
mov dword [esp + 0xc], ebx
mov byte [esp], 0xec
lea esp, [esp + 0x10]
je 0x373c803
btc eax, ebp
mov eax, dword [ebp - 0x100]
pushal
pop ecx
mov ecx, dword [eax + 0x30]
bt edx, edx
push 0x3db6e0a2
stc
sub edx, edx
bts dx, si
mov dx, word [ecx + 0xe]
stc
cmp edx, 0x4c
pushal
mov word [esp], 0xdd5c
pushfd
lea esp, [esp + 0x44]
jne 0x3739ec8

Function at 0x373c993
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.028a2480
call fcn.0373a81a
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
pop ds
rol dword [ebx], 1
xor al, 0x76
push ebp
test byte [ecx], dh
xchg edi, eax
pop esp
adc eax, 0xaf34ddb3
invalid

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x403690
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x44b00c]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
mov ebx, ecx
call fcn.00403590
add esp, 0x10
test eax, eax
jne 0x4036d1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0043827f
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jns 0x4036f4
call edi
cmp dword [eax], 9
jne 0x4036f4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0043827f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x13]
push 2
push 1
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jns 0x403717
call edi
cmp dword [eax], 4
lea eax, [esp + 0x13]
je 0x4036f8
test esi, esi
mov ecx, dword [esp + 0x14]
setg al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043827f
mov esp, ebp
pop ebp
ret
Function at 0x403c10
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x44b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x40c], eax
push edi
mov edi, edx
movzx eax, word [esi]
cmp eax, 2
je 0x403c43
cmp eax, 0x17
jne 0x403cbf
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push 0x401
mov dword [ebx], eax
lea eax, [ebp - 0x408]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x408]
push 2
push 0
push 0
push 0x401
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x403cbf
lea edx, [ebp - 0x408]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x403c90
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
sub edx, esi
push edx
push eax
call fcn.0041c980
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043827f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043827f
mov esp, ebp
pop ebp
ret