joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50aa20
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x50aa62
mov dx, 0xc6ec
lea esi, [edx + esi]
mov ecx, dword [esp + 0x17]
pushal
jmp 0x50aa4c
mov ecx, 0xe42ba7dc
popal
pop edx
lea ebp, reloc.USER32.dll_CreateWindowExW
jmp 0x50aa9a
not ch
dec cl
lea ecx, reloc.USER32.dll_CreateWindowExW
xchg byte [esp + 5], al
inc esi
mov esi, dword [esp + 0xd]
jmp 0x50aa22
mov word [esp + 6], si
bsf esi, ecx
mov bl, cl
xchg di, bp
cld
ror bp, 7
jmp 0x50ab0b
cld
mov dword [esp + 1], eax
neg bl
mov word [esp + 7], bx
mov ebp, dword [esp + 8]
jmp 0x50aaf3
mov bl, bh
inc edi
mov byte [esp + 7], bh
pop ecx
mov dx, 0xae9f
mov byte [esp + 0xa], bl
jmp 0x50aacb
add esp, 2
push word [esp + 6]
neg si
shl bh, 0
mov eax, dword [esp + 0xa]
jmp 0x50ab49
xchg dword [esp + 0xd], ebp
cld
add esp, 4
bswap edx
push word [esp + 4]
setb ch
jmp 0x50aae1
xchg dword [esp + 2], eax
mov al, 0x40
bts di, dx
xchg dx, di
mov word [esp + 5], sp
lea ebx, [esi + edi]
jmp 0x50ab76
bsr di, bp
xchg cl, ah
add esp, 3
stc
mov dx, word [esp + 1]
clc
jmp 0x50ab1f
xchg ch, cl
mov dword [esp + 4], edi
mov bl, byte [esp + 4]
lea ebx, [ecx + esi]
pop dword [esp + 1]
bsr ax, sp
jmp 0x50ab8c
xchg byte [esp + 4], cl
bts edi, eax
mov dword [esp + 6], ebp
rdtsc
xchg word [esp + 7], cx
rdtsc
jmp 0x50ab5b
mov word [esp + 4], bp
pushfd
bts edi, esi
rol bp, cl
clc
mov dword [esp + 3], esi
jmp 0x50ac3d
pop word [esp]
call fcn.0050ac01
scasb al, byte es:[edi]
lodsb al, byte ds:[esi]
retf
ror esi, 0xf
lea eax, [eax + edx]
mov word [esp + 8], dx
lea ecx, [ebp*4]
xchg ah, dl
std
jmp 0x50abbe
stc
push word [esp + 3]
rdtsc
lea eax, [eax + esi]
cpuid
mov esi, dword [esp + 9]
jmp 0x50abd4

Function at 0x50ad16
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, dl
jmp 0x50ad42
sub esp, 0x13
xchg byte [esp + 0x14], ch
sub esp, 0x17
shl bh, 0
push word [esp + 0x1c]
jmp 0x50ada1
mov al, byte [esp + 1]
xchg bx, ax
xchg cx, ax
mov esi, 0xcf9e6a64
mov byte [esp + 3], bl
push dword [esp + 3]
jmp 0x50ad1a
pop dword [esp + 0xe]
mov si, 0xa5f6
rol edi, cl
mov dx, si
mov byte [esp + 7], bh
cpuid
jmp 0x50adca
inc cl
popal
bswap edx
mov eax, 0xc7530d83
push dword [esp + 0xc]
shr ebx, 2
jmp 0x50ad79
mov ecx, 0xc7a18d36
sub esp, 0x11
bswap ecx
mov dword [esp + 0x19], ecx
jmp 0x50ae14
clc
bsr edi, ebx
add esp, 0x10
sub esp, 0x10
xchg dx, di
jmp 0x50adb4
lea ebx, [esp + 0x57]
mov bp, word [esp + 0x2b]
rdtsc
mov byte [esp + 8], al
jmp 0x50b1c5
mov bx, di
mov word [esp + 0x19], bp
mov ah, 0x9b
mov cl, 4
push dword [esp + 0x23]
xchg ecx, eax
jmp 0x50adfe
push word [esp + 0x1b]
push word [esp]
push di
inc ax
lea esp, [esp + 8]
cld
jmp 0x50b143
mov eax, 0x50b5e76d
lea ebx, [edi*4]
cld
push word [esp + 0x1d]
not si
xchg byte [esp + 0x38], bl
jmp 0x50b0f5
xchg ch, dh
rdtsc
push esp
pop cx
call fcn.0050b12d
lea ebp, reloc.USER32.dll_CreateWindowExW
std
xchg ah, ch
call fcn.0050b19e
jmp 0x69ebb0d1
sub esp, 0x10
rdtsc
mov byte [esp + 0xf], dl
lea ebx, [ecx*4]
xchg byte [esp + 0xc], ah
pop ebx
jmp 0x50b112
Function at 0x50cd48
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
lea ecx, [ebx - 0xf7]
mov dh, dl
pop dword [esp + 3]
xchg dword [esp + 6], edi
pop cx
jmp 0x50cd52
xchg word [esp + 0x27], cx
lea esi, [esi + edi]
jmp 0x50cd2a
popal
xchg dword [esp + 4], ebx
lea ebp, reloc.USER32.dll_CreateWindowExW
mov ah, 0x8b
neg eax
mov edi, dword [esp + 0x10]
jmp 0x50cd9d
bswap esi
pushfd
stc
lea ecx, [ecx + ebx]
bsr ebx, edi
lea ebx, reloc.USER32.dll_CreateWindowExW
jmp 0x50cd87

Function at 0x50d704
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
mov ecx, dword [esp]
mov dl, byte [esp + 1]
mov word [esp + 2], sp
bt di, bp
jmp 0x50d5f8
setg ch
mov cx, word [esp + 4]
pop word [esp]
xchg word [esp], dx
xchg di, ax
lea ebx, [ecx + esi]
jmp 0x50d59e
bswap edi
add dh, al
mov dword [esp + 0x17], edx
dec dh
bts esi, ebx
mov ch, byte [esp]
jmp 0x50d60c
mov word [esp + 1], sp
sub esp, 0x18
setb cl
dec dx
rdtsc
setle ah
jmp 0x50d5d3
rol ebp, cl
cpuid
lea edx, [ebx + ebp]
xchg al, ch
pop dx
mov eax, 0xb324d694
jmp 0x50d66d
lea esp, [esp + 0x18]
popal
push ebx
call fcn.0050d657
dec ebp
outsd dx, dword [esi]
jbe 0x50d692
push edi
imul ebp, dword [esi + 0x64], 0xb500776f
lea edi, [ebp*4]
mov bh, 0xf6
and esi, 0x3f06efa5
xchg byte [esp + 2], ah
pop dword [esp]
lea edi, [esi*4]
jmp 0x50d5bc
mov byte [esp + 4], bl
sub esp, 0x10
lea esp, [esp + 0x18]
jmp 0x50d6e4
xchg word [esp + 3], dx
not ebx
dec eax
mov dword [esp + 6], eax
lea esp, [esp + 3]
jmp 0x50d61e
xchg dword [esp + 4], eax
mov byte [esp + 3], dh
mov al, byte [esp + 2]
xchg dword [esp + 1], edx
push esp
and al, 1
neg edx
xor ecx, 0x6375fbeb
jmp 0x50d635
lea esi, [edx*4]
btc dx, si
mov esi, 0x21fdc4dc
bswap ecx
rdtsc
mov word [esp], sp
jmp 0x50d685
popfd
push 0xab5a789d
jmp 0x50d710
push dword [esp + 2]
pop dword [esp]
pop word [esp]
lea esp, [esp + 1]
call fcn.0050d7f0
dec esi
fnstcw word [eax]
sbb edi, dword [edx - 0x5b094fc6]
mov edx, 0xa4f6b03a
std
push dword [esp + 3]
jmp 0x50d6b4
add dword [esp], reloc.USER32.dll_CreateWindowExW
push di
push word [esp + 1]
jmp 0x50d6ec
Function at 0x50fe2e
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.0050f057
push eax
jmp 0x50f052
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x50fc8d
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x50fd4b
jmp 0x50fda4

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x6790a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16d000]
mov dword [edi + 0x223824], 0xa5f6bad7
push edi
jmp 0x6790ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6790d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6790c0
mov eax, 1
add ebx, ebx
jne 0x6790e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6790f4
jne 0x679113
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x679113
dec eax
add ebx, ebx
jne 0x679100
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6790d8
add ebx, ebx
jne 0x67910f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x679165
xor ecx, ecx
sub eax, 3
jb 0x67912b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x67919a
sar eax, 1
mov ebp, eax
jmp 0x679136
add ebx, ebx
jne 0x679136
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x679104
inc ecx
add ebx, ebx
jne 0x679144
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x679104
add ebx, ebx
jne 0x679151
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x679146
jne 0x679162
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x679146
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x679184
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x679176
jmp 0x6790c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x679184
add edi, ecx
jmp 0x6790c6
pop esi
mov edi, esi
mov ecx, 0xa81e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6791a2
cmp byte [edi], 0x28
jne 0x6791a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6791a7
lea edi, [esi + 0x276000]
mov eax, dword [edi]
or eax, eax
je 0x67921f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2852dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x285444]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6791d4
mov ecx, edi
jns 0x679203
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x285448]
or eax, eax
je 0x679219
mov dword [ebx], eax
add ebx, 4
jmp 0x6791f1
call dword [esi + 0x285458]
mov ebp, dword [esi + 0x28544c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x25f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x679253
sub esp, 0xffffff80
jmp 0x4d9889
Function at 0x40113b
Capabilities:
Parse pe header

Disassembly:
jmp 0x4047ce
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40480e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40480e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40480e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40480e
cmp dword [ecx + 0x74], 0xe
jbe 0x40480e
cmp dword [ecx + 0xe8], 0
je 0x40480e
mov al, 1
ret
xor al, al
ret

Function at 0x401244
Capabilities:
Terminate process

Disassembly:
jmp 0x403391
push 0x14
push 0x426f70
call fcn.004010c8
push 1
call fcn.004010c3
pop ecx
test al, al
je 0x4032a9
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00401267
mov byte [ebp - 0x24], al
mov eax, dword [0x429234]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4032a9
test eax, eax
jne 0x4031c7
mov dword [0x429234], ecx
push 0x407618
push 0x40730c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4031aa
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403299
push 0x407208
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x429234], 2
jmp 0x4031cc
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00401069
pop ecx
call fcn.0040110e
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4031fd
push esi
call fcn.00401127
pop ecx
test al, al
je 0x4031fd
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.00401190
mov esi, eax
cmp dword [esi], edi
je 0x40321b
push esi
call fcn.00401127
pop ecx
test al, al
je 0x40321b
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push edi
push dword [esi]
call fcn.004011e0
add esp, 0xc
mov esi, eax
call fcn.0040113b
test al, al
je 0x4032b0
test bl, bl
jne 0x40324e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.0040119f
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x403299
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0040120d
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004011fe
jmp 0x40313d
Function at 0x640895
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x640811
lea edx, [ebp + 0xc4]
pop dx
bswap eax
jmp 0x6409ac
jmp 0x6409cd
call fcn.0064090f
lea ecx, [ebp + 0x50]
setae dl
not edx
jmp 0x6409f0
bswap edx
mov al, byte [esp]
push di
lea esp, [esp + 2]
jmp 0x6409b1
ja fcn.00640a37
lea edx, [edx + 0x67]
jmp 0x64103c
cmp esi, ecx
jb 0x6409da
jae 0x6409da
and esp, dword [edx + reloc.KERNEL32.dll_GetSystemTimeAsFileTime]
out 0x77, eax
adc ah, cl
adc dword [edi + reloc.KERNEL32.dll_GetSystemTimeAsFileTime], ebx
lahf
cmc
in al, 0x17
jne 0x64095d
je 0x6409cd
jle 0x640a11
xchg edx, eax
cmc
add al, 0xcd
dec eax
leave
pop ecx
cmp bl, cl
and eax, ebp
or esi, dword [esi - reloc.KERNEL32.dll_GetSystemTimeAsFileTime]
pushfd
mov ax, word [esp]
bt dx, di
jns 0x641096
js 0x641096
or byte [esi + 0x68967b1c], cl
lahf
out 0x11, al
nop
adc eax, dword [eax - 0x2d]
inc eax
shr eax, cl
push dword [esp + 4]
mov eax, ebp
stc
jmp 0x6410b7
jne 0x6410cd
xchg ch, dl
clc
jmp 0x6410d0
xchg ch, dl
clc
jmp 0x6410e6
lea edx, [ebp + 0x40]
sub esp, 0x11
jmp 0x64111f
pop dword [esp]
bswap ecx
lea ecx, [ebx + ebp]
lea esp, [esp + 1]
jmp 0x641128
jo 0x6410f2
pop dword [esp]
bswap ecx
jmp 0x64115f
sub edx, eax
not cl
mov cx, 0xb19f
sub esp, 0xd
jp 0x641149
rcr cx, cl
jmp 0x641168
jmp 0x64117e
lea ecx, [ebx + ebp]
lea esp, [esp + 1]
jmp 0x641128
lea esp, [esp + 1]
jmp 0x641185
rcr cx, cl
lea esp, [esp + 1]
lea ecx, [esi - 0x80]
clc
jmp 0x6413cf
call fcn.00641262
pop es
xchg byte [ebx + esi*2], dl
mov gs, word [ebx - 0x4d]
cmp ebp, dword [ebx - reloc.KERNEL32.dll_GetSystemTimeAsFileTime]
sbb al, 0xb2
aad 0x24
mov dword [reloc.KERNEL32.dll_GetSystemTimeAsFileTime], eax
dec dh
mov dx, bp
jge 0x64118f
jl 0x64118f
mov eax, dword [esp]
mov edx, 0xf44e978a
mov dx, 0x8b3c
rdtsc
bswap eax
jmp 0x641481
lea esp, [esp + 4]
sub cl, 0xac
inc ax
jbe 0x6413db
ja 0x64141c
rdtsc
bswap eax
jmp 0x641481
lea eax, [edx + esi]
jmp 0x6414b8
mov eax, dword [esp]
mov edx, 0xf44e978a
mov dx, 0x8b3c
call fcn.00641458
popal
out 0x74, al
adc ebp, esi
imul edx, dword [edi - reloc.KERNEL32.dll_GetSystemTimeAsFileTime], 0x448ad732
and al, 2
neg eax
jmp 0x6413f1
xor cl, 0x7e
xchg edx, eax
mov ax, dx
xchg edx, eax
not dx
jmp 0x641404
sub esp, 8
lea esp, [esp + 7]
mov ah, byte [esp]
lea esp, [esp + 1]
jmp 0x6414fc
ror cl, 0
jle 0x6414a2
sub esp, 8
jmp 0x6414c6
lea esp, [esp + 7]
mov ah, byte [esp]
lea esp, [esp + 1]
jmp 0x6414fc
rdtsc
btc ax, ax
jmp 0x64155c
and ecx, 0x3c
lea eax, [eax*4]
rcr dx, 0xe
jbe 0x6414d3
ja 0x6415d5
xor al, 0xbb
sub ecx, dword [esi - 0x43]
pop esi
push ds
imul ecx, dword [eax + reloc.KERNEL32.dll_GetSystemTimeAsFileTime], 0x66ffffff
inc edx
jge 0x64147c
not ax
xor dl, bh
mov al, byte [esp + 2]
neg eax
jmp 0x6413f1
call fcn.00641569
mov dword [ecx + ebp], eax
pushfd
pop cx
xchg edx, eax
lea eax, [eax + esi]
jmp 0x64159d
pushal
mov cl, byte [esp]
mov dword [esp + 0x14], esi
sub esp, 0x14
jmp 0x641583
jb 0x641532
jae 0x641532
lea esp, [esp + 2]
add esi, 4
call fcn.00641544
rdtsc
btc ax, ax
jmp 0x64155c
Function at 0x64090f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6408f1
mov eax, dword [esp]
jmp 0x6408f7
mov dl, 0xa0
lea esp, [esp + 2]
ror cl, 0
bts edx, edx
jne 0x6408bf
lea edx, [esi + edi]
jmp 0x6408c1
lea edx, [esi + edi]
mov eax, dword [esp]
and ecx, 0x3c
mov dx, 0x637a
lea eax, [ebp*4]
jmp 0x640941
mov edx, ebx
jmp 0x6408d9
shr edx, 0x10
bsr dx, sp
jmp 0x64092b
jmp 0x640913
mov eax, dword [ecx + ebp]
mov cx, 0x429d
lea ecx, [ebx*4]
jmp 0x640973
lea eax, [ebx*4]
mov dx, 0x490d
sub esi, 4
bsf eax, esp
jp 0x640929
shr edx, 0x10
bsr dx, sp
jmp 0x64092b
mov dword [esi], eax
mov ah, byte [esp]
mov dx, sp
mov edx, 0xbee663d
bsr ecx, edx
jmp 0x640a0b

Function at 0x641c98
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, ecx
not edx
lea eax, [esi*4]
jmp 0x641c14
mov eax, ecx
not edx
lea eax, [esi*4]
cmc
not edi
dec bx
js 0x641c2f
jns 0x641c17
add eax, dword [edx + ebx - reloc.KERNEL32.dll_GetSystemTimeAsFileTime]
xor dword [ecx - reloc.KERNEL32.dll_GetSystemTimeAsFileTime], esp
xor ah, byte [eax - 0x4c25cd39]
stosb byte es:[edi], al
cmc
jmp 0x641bf8
setg al
neg eax
btr ebx, edx
jmp 0x641c3f
setg al
neg eax
btr ebx, edx
mov bl, dh
jmp 0x641c82
mov bl, dh
rdtsc
sub edi, 0xc40c436
rdtsc
mov edx, 0xbeb810c0
rcl dh, 7
js 0x641bec
jns 0x641bd6
rdtsc
jmp 0x641c49
not dx
lea esp, [esp + 4]
jmp 0x641c66

Function at 0x641dcd
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov edx, esp
call 0x641d91
mov al, bl
not dx
mov edx, esp
jmp 0x641e26
sub al, 0x7a
bsr edx, ecx
jg 0x641e00
not dh
jmp 0x641e0a
jmp 0x641de8
not dh
push bp
jmp 0x641e4d
push bp
add esp, 1
not dh
lea esp, [esp + 1]
jmp 0x641e37
mov dx, 0x38a8
mov dx, 0x2b01
mov dx, word [esp]
clc
jle 0x641dfe
jg 0x641dfe
rol al, 0
mov edx, eax
bsf dx, sp
jle 0x641ee4
jg 0x641e9d
aam 0x47
out dx, al
stc
fadd dword [ebx - 0x2909fe3c]
add esp, 1
not dh
lea esp, [esp + 1]
jmp 0x641e37
jmp 0x641dc5
push esi
stc
lea edx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
jmp 0x641ea6
bswap edx
shl dx, cl
jae 0x641e6d
push esi
jmp 0x641ebc
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x641eeb
lea esp, [esp + 4]
neg al
not edx
lea edx, [edx - 0xdf]
neg dl
jmp 0x641f09
stc
lea edx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
jmp 0x641ea6
mov dx, word [esp]
lea edx, [ecx + edx]
setb dh
bt edx, ebp
mov dh, 0xff
jmp 0x642005
sub esp, 0x1a
lea esp, [esp + 2]
lea esp, [esp + 0x18]
not al
jmp 0x641e83
jne 0x641ec5
mov dx, word [esp]
lea edx, [ecx + edx]
call fcn.00641f18
xor ah, byte [esi - 0x46]
mov dx, 0x2c9b
mov dx, word [esp]
neg dh
jl 0x641e68
stc
mov edx, esp
jmp 0x641dc8
Function at 0x641f18
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x2c9b
mov dx, word [esp]
mov dx, 0xd23f
pushal
mov byte [esp + 0xe], dh
jmp 0x641fa2
mov edx, dword [esp]
sub edx, 0x9f6fb528
call fcn.00641f41
mov dh, 0xff
jmp 0x642005
xchg dword [esp + 0x20], ecx
setno dh
xchg dl, dh
bswap edx
inc dx
lea ecx, [ecx - 0x24]
jmp 0x641f60
sub esp, 4
mov dword [esp + 0xb], esp
pop dx
jmp 0x641feb
lea edx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
jmp 0x641fb7
sub cl, al
inc al
jae 0x642087
rdtsc
xchg dl, al
jmp 0x642059
pop dx
add esp, 2
lea edx, [esi*4]
jmp 0x641fd5
add al, 0x9a
sub esp, 0x1a
jae 0x641fcd
lea edx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
sub esp, 4
mov dword [esp + 0xb], esp
pop dx
pop dx
jmp 0x641fed
rdtsc
call 0x64201f
dec dx
jmp 0x642063
xchg dl, al
dec edi
mov eax, 0xcfe08c2a
mov ah, 0x3d
jmp 0x642035
lea eax, [eax + esi]
ror ah, cl
setb ah
mov edx, edi
jmp 0x6420a1
mov ah, byte [esp]
jmp 0x64208b
rdtsc
jmp 0x642057
not bl
setle ah
mov ax, 0xbda4
lea eax, [esi*4]
jmp 0x642116
sub bl, 0xee
mov eax, 0xb4c4de82
shl dh, 5
jl 0x64206f
mov ah, byte [esp]
jmp 0x64208b
ror bl, 0
jmp 0x6420d0
mov edx, 0x5e8f8884
mov edx, esp
neg ax
jae 0x6420e6
jb 0x6420e6

Function at 0x641f31
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov edx, esp
call 0x641d91
mov al, bl
not dx
mov edx, esp
jmp 0x641e26
sub al, 0x7a
bsr edx, ecx
jg 0x641e00
not dh
jmp 0x641e0a
jmp 0x641de8
not dh
push bp
jmp 0x641e4d
push bp
add esp, 1
not dh
lea esp, [esp + 1]
jmp 0x641e37
mov dx, 0x38a8
mov dx, 0x2b01
mov dx, word [esp]
clc
jle 0x641dfe
jg 0x641dfe
rol al, 0
mov edx, eax
bsf dx, sp
jle 0x641ee4
jg 0x641e9d
aam 0x47
out dx, al
stc
fadd dword [ebx - 0x2909fe3c]
add esp, 1
not dh
lea esp, [esp + 1]
jmp 0x641e37
jmp 0x641dc5
push esi
stc
lea edx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
jmp 0x641ea6
bswap edx
shl dx, cl
jae 0x641e6d
push esi
jmp 0x641ebc
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x641eeb
lea esp, [esp + 4]
neg al
not edx
lea edx, [edx - 0xdf]
neg dl
jmp 0x641f09
stc
lea edx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
jmp 0x641ea6
mov dx, word [esp]
lea edx, [ecx + edx]
setb dh
bt edx, ebp
mov dh, 0xff
jmp 0x642005
sub esp, 0x1a
lea esp, [esp + 2]
lea esp, [esp + 0x18]
not al
jmp 0x641e83
jne 0x641ec5
mov dx, word [esp]
lea edx, [ecx + edx]
call fcn.00641f18
xor ah, byte [esi - 0x46]
mov dx, 0x2c9b
mov dx, word [esp]
neg dh
jl 0x641e68
stc
mov edx, esp
jmp 0x641dc8

Function at 0x64610e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x77a6ddcf
mov edx, 0xcbdc76c6
dec dl
jmp 0x6460a6
jno 0x646094
mov edx, edi
lea esp, [esp + 1]
jmp 0x64605c
add bl, cl
jne 0x6460c0
stc
jmp 0x6460aa
mov edx, edi
lea esp, [esp + 1]
mov eax, 0x77a6ddcf
mov edx, 0xcbdc76c6
dec dl
rdtsc
jmp 0x64607c
mov dh, bh
mov ax, bp
lea eax, [edx*4]
call fcn.006460e3
push ebp
les esi, [edi + 0x5e]
test eax, 0x66f78af9
mov eax, ebp
stc
mov dh, bh
mov ax, bp
lea eax, [edx*4]
jmp 0x646154
mov eax, ecx
sub esp, 0x1d
jmp 0x646072
Function at 0x64656a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x2cd1735
jmp 0x646601
mov ax, word [esp + 3]
bswap eax
jmp 0x6465a2
xchg dword [esp + 4], ecx
call fcn.0064658c
jmp 0x64668d
mov eax, dword [esp]
dec eax
jmp 0x646640
jmp 0x643c91
lea eax, [edx + edi]
mov ax, bx
bswap eax
stc
jbe 0x6465e0
ja 0x646616
fistp word [edi - 0x31]
stosb byte es:[edi], al
pop ecx
cdq
xor ch, byte [0x48de58b]
aas
jle 0x6465ba
jg 0x643c91
xchg ah, al
mov eax, dword [esp]
mov ah, byte [esp]
mov edx, dword [edx + reloc.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp]
jmp 0x6465b0

Function at 0x64692e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x6f
lea eax, [esi*4]
jmp 0x646952
lea esp, [esp + 4]
popal
mov dword [eax], edx
jmp 0x646918

Function at 0x646a5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 2]
jmp 0x646aae
add bl, cl
not edx
mov edx, 0x2b4e2607
call fcn.00646a98

Function at 0x646a98
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
jmp 0x646abc
mov al, bl
stc
jmp 0x646b0a

Function at 0x64702c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esi
jmp 0x6471f8
lea esp, [esp + 0xc]
push dword [esp + 4]
mov dword [esp + 7], edx
jmp 0x64706e
sub esp, 8
jno 0x64708a
push dword [esp + 4]
mov dword [esp + 7], edx
lea esp, [esp + 0xc]