joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031d0
Capabilities:
Get socket status
Read file on windows

Disassembly:
mov eax, 0x1948
call fcn.00404a70
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1958]
push edi
mov ebp, ecx
mov eax, dword [esi + 0x20]
push eax
call sub.wsock32.dll_htonl
mov ecx, dword [esi + 0x24]
mov edi, eax
push ecx
call sub.wsock32.dll_htonl
cmp edi, 1
push 0x40715c
jne 0x40321b
push 0x4071fc
call dword [sym.imp.msvcrt.dll_fopen]
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
jmp 0x40322f
push 0x4071f0
call dword [sym.imp.msvcrt.dll_fopen]
add esp, 8
mov dword [esp + 0x10], eax
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4033e4
push 0x28
call sub.wsock32.dll_htonl
push esi
push 0x28
lea edx, [esp + 0x30]
push 1
push edx
mov dword [esp + 0x34], eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
xor esi, esi
mov dword [esp + 0x50], ebx
mov dword [esp + 0x20], esi
push pe_nt_image_headers32
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call sub.wsock32.dll_htonl
mov edi, eax
push 1
mov dword [esp + 0x18], edi
call sub.wsock32.dll_htonl
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], ebx
xor ecx, ecx
xor edx, edx
mov dl, byte [esp + ecx + 0x1c]
add eax, edx
inc ecx
cmp ecx, 8
jb 0x40328d
xor ecx, ecx
xor edx, edx
mov dl, byte [esp + ecx + 0x24]
add eax, edx
inc ecx
cmp ecx, 0x30
jb 0x40329d
push eax
call sub.wsock32.dll_htonl
mov edx, dword [ebp]
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x158], edi
mov dword [esp + 0x164], esi
mov ecx, 0xc
lea esi, [esp + 0x24]
lea edi, [esp + 0x168]
mov dword [esp + 0x160], eax
push ebx
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x15c]
push pe_nt_image_headers32
push eax
mov ecx, ebp
call dword [edx + 8]
cmp eax, 0x40
je 0x403305
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x4033db
mov edx, dword [ebp + 8]
cmp byte [edx + 0x2e], bl
je 0x4033d6
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x5c], eax
push ebx
lea edx, [esp + 0x5c]
push ebx
inc eax
push edx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x68], 1
call sub.wsock32.dll_select
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x54]
push eax
push ecx
call sub.wsock32.dll___WSAFDIsSet
test eax, eax
je 0x403381
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x559]
mov byte [esp + 0x558], bl
rep stosd dword es:[edi], eax
mov edx, dword [ebp]
push ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x55c]
push 0x400
push eax
mov ecx, ebp
call dword [edx + 4]
test eax, eax
jle 0x4033d6
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x958]
push ecx
push 0x1000
push 1
push edx
call dword [sym.imp.msvcrt.dll_fread]
mov esi, eax
add esp, 0x10
cmp esi, ebx
jle 0x4033ba
mov eax, dword [ebp]
push ebx
lea ecx, [esp + 0x95c]
push esi
push ecx
mov ecx, ebp
call dword [eax + 8]
cmp eax, esi
jne 0x4033d6
cmp esi, 0x1000
jne 0x4033d6
push 0xa
call dword [sym.imp.kernel32.dll_Sleep]
mov edx, dword [ebp + 8]
cmp byte [edx + 0x2e], bl
jne 0x403311
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1948
ret 8
Function at 0x404aca
Capabilities:
Terminate process

Disassembly:
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x407380], 0xffffffff
or dword [0x407384], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x407374]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x407370]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40737c], eax
call fcn.00404c2b
cmp dword [0x407290], ebx
jne 0x404b22
push 0x404c28
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00404c16
push 0x407014
push 0x407010
call sub.msvcrt.dll__initterm
mov eax, dword [0x40736c]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x407368]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
push 0x40700c
push 0x407000
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x404bb5
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x404b89
cmp al, 0x22
jne 0x404b7b
cmp byte [esi], 0x22
jne 0x404b92
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x404b9c
cmp al, 0x20
jbe 0x404b8e
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x404bc0
movzx eax, word [ebp - 0x2c]
jmp 0x404bc3
cmp byte [esi], 0x20
jbe 0x404b92
inc esi
mov dword [ebp - 0x74], esi
jmp 0x404bb5
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x433006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4053c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40542a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403cb4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a24
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405414
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405431
lea eax, [ebp - 0x10]
call fcn.00403a44
ret

Function at 0x4095fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409635
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403b34
jmp 0x40963e
mov eax, ebx
mov edx, esi
call fcn.00403a98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409648
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409669
mov al, byte [esp]
jmp 0x40966b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409cf0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409b68
mov eax, dword [0x4134f8]
cmp byte [eax], 0
je 0x409d6c
mov eax, dword [0x41341c]
call fcn.004029a0
call fcn.0040271c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406fb0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409db4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409da2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4133f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.00404914
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40aa50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40aab4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403cb4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406ac4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aabb
lea eax, [ebp - 0xc]
call fcn.00403a44
ret

Function at 0x412260
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x4121e8
call fcn.00405624
xor eax, eax
push ebp
push 0x41235e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004028dc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00406e94
mov edx, dword [ebp - 0x14]
mov eax, 0x41487c
mov ecx, 0x412378
call fcn.00403d2c
xor ebx, ebx
jmp 0x4122cc
mov eax, dword [0x41487c]
call fcn.00403ee0
push eax
call sub.kernel32.dll_DeleteFileA
cmp ebx, 2
jg 0x4122da
mov eax, dword [0x41487c]
call fcn.00406e34
test al, al
jne 0x4122b7
mov eax, 0x414878
call fcn.00403a44
xor eax, eax
push ebp
push 0x41231f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41487c]
call fcn.00406e34
test al, al
jne 0x412315
lea eax, [ebp - 0x1c]
call fcn.00412058
mov edx, dword [ebp - 0x1c]
mov eax, 0x414878
call fcn.00403a98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x412333
mov edx, dword [0x41487c]
mov eax, dword [0x414878]
call fcn.00412128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412365
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403a68
ret
Function at 0x58e350
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x58e375
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x58e380
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x58e375
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x58e3c8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x58e3be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x58e3ca
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x58e3b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x9b110a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
push dword [esp + 2]
jae 0x9b1128
mov dword [esp + 4], esi
pushal
jmp 0x9b112a
mov byte [esp + 0xa], ch
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x9b1150

Function at 0x9b1120
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
call fcn.009b110a
jmp 0x9b1166
pushfd
jmp 0x9b101f
mov dword [esp + 4], esi
pushal
mov byte [esp + 0xa], ch
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x9b1150

Function at 0x9b1633
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax + 0xe458]
bsr edx, esp
not cx
mov cx, word [esp]
jmp 0x9b1919
xchg dword [esp], ecx
rdtsc
rdtsc
mov esi, edi
and cx, 0x133a
push dword [esp]
ret 4
lea ecx, [ecx + 0x64]
mov ebx, dword [esp]
lea edx, [esp - 0x59a5]
rdtsc
inc ah
neg edx
jmp 0x9b169e
xchg dword [esp], ecx
add dl, cl
xor dl, dh
rcl esi, cl
mov bh, byte [esp]
mov esi, ebp
jmp 0x9b16dc
Function at 0x9dad48
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
lea esp, [esp + 2]
jmp 0x9dad81
mov dword [esp + 0xc], esi
push eax
mov dword [esp], edx
push dword [esp]
mov dword [esp + 0x10], edi
jmp 0x9dad93
mov dword [esp + 0xc], ebp
push sp
mov word [esp], si
push word [esp]
jl 0x9dad4f
jge 0x9dad6b

Function at 0xbdcdad
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + ebx]
sub esp, 0
not bp
rcl si, cl
stc
not bh
jmp 0xbdcd48
xchg ebp, edx
bswap ebx
std
add esp, 5
mov bl, byte [esp + 1]
mov di, word [esp + 2]
jmp 0xbdcce1
rdtsc
neg si
cpuid
mov word [esp + 1], si
bsr bp, sp
xchg word [esp + 3], dx
jmp 0xbdccf7
lea esp, [esp + 0x22]
xchg esi, eax
lea edi, [esp - 0xdb]
mov eax, dword [esp]
jmp 0xbdcd71
clc
mov cx, 0x6600
mov bx, word [esp + 2]
pushal
rdtsc
rol ax, 6
jmp 0xbdcd32
setb dh
mov edx, dword [esp]
xchg bx, si
call fcn.00bdcd5b
pop ebp
sub esp, 0x1e
mov ebx, 0x15cde22
mov eax, dword [esp + 8]
pop di
jmp 0xbdce17
xchg cl, bh
std
lea ecx, [edi*4]
rol esi, 0x19
mov ecx, 0xbea394ac
jmp 0xbdcd1b
cld
mov esi, dword [esp + 0x18]
neg edi
xchg edx, eax
lea edx, [esp + edi]
push dword [esp + 4]
jmp 0xbdcdfd
mov word [esp + 0x1f], sp
rdtsc
xchg di, bx
mov bh, bl
push dword [esp + 6]
lea esp, [esp + 8]
jmp 0xbdcdc4
mov si, 0x838
mov di, word [esp + 0x1b]
mov byte [esp + 0xf], dh
lea esp, [esp + 9]
jmp 0xbdce4c
pop word [esp + 1]
mov word [esp + 0x15], di
cld
push ebx
bt di, di
btr cx, sp
jmp 0xbdcde7
xchg edi, esi
mov cx, 0x80c3
shr ax, cl
xchg si, di
xchg byte [esp + 7], dh
mov bx, word [esp + 1]
jmp 0xbdce5a
lea esp, [esp + 0x11]
mov dl, 0x93
std
rdtsc
cmc
neg esi
jmp 0xbdce2d
pop word [esp + 1]
xchg dword [esp], esi
lea eax, [edx*4]
mov bx, word [esp + 5]
pushfd
lea esp, [esp + 3]
jmp 0xbdceb3
cld
not bx
pop bp
pop cx
cpuid
mov ebx, dword [esp]
jmp 0xbdce85
mov dword [esp + 3], edi
bsf edi, edi
pop eax
mov al, bl
lea ebx, [ebx - 0x868d]
neg si
jmp 0xbdce9b
Function at 0xbdec05
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, si
adc cl, dh
lea esi, [ecx - 0x2eddf5c1]
popal
add esp, 2
jmp 0xbdec12
bswap ebp
mov ah, byte [esp + 8]
mov bx, word [esp + 0xc]
jmp 0xbdebef
xchg byte [esp + 8], bl
rcr esi, 1
pop word [esp + 3]
mov byte [esp + 5], bl
jmp 0xbdee77
mov dh, byte [esp + 0xe]
lea esp, [esp]
push word [esp + 0x10]
bswap ebp
cmc
jmp 0xbdec85
xchg word [esp + 8], bx
lea edi, [edx*4]
pop bp
push dword [esp + 6]
push word [esp]
mov bh, 0x3d
jmp 0xbdec3f
mov ecx, dword [esp + 0x11]
lea esp, [esp + 0x10]
pop word [esp]
xchg si, dx
jmp 0xbdecc0
mov ah, byte [esp + 0xc]
mov si, word [esp + 0xb]
mov dl, 0xa1
std
mov word [esp + 1], sp
mov dx, 0x76b4
jmp 0xbdec6f
push word [esp + 2]
not bl
mov dword [esp + 7], esi
xchg dx, bp
mov byte [esp + 0xc], ah
xchg word [esp + 1], si
jmp 0xbdec55
mov byte [esp], dl
btr ebp, eax
mov esi, dword [esp]
dec di
add esp, 1
xchg byte [esp], dh
jmp 0xbdecff
mov word [esp + 1], dx
pop di
mov edx, dword [esp + 4]
neg di
mov dh, 0x89
lea esi, [esp - 0x6ada]
jmp 0xbdeca7
xchg byte [esp], dl
rdtsc
lea edx, [esi + 0x261b0541]
cpuid
cpuid
lea esi, [edx - 0xda8a]
jmp 0xbded4a
mov cx, word [esp + 6]
std
setg ch
not esi
lea edi, [eax*4]
sub esp, 6
jmp 0xbdece6
mov cl, byte [esp]
rcl esi, 9
lea esp, [esp]
mov cx, 0xf9f5
xchg ch, bl
jmp 0xbded71
mov dl, 0x6c
bsr edx, eax
lea esp, [esp]
bswap edi
xchg dx, bp
mov cl, 0x64
jmp 0xbded34
cld
lea edi, [ecx*4]
lea edi, [ebx + 0x9bd6]
cpuid
jmp 0xbdee2d
rdtsc
mov edi, dword [esp]
mov bh, ah
clc
mov ebx, 0x79d0f1ac
lea esp, [esp]
jmp 0xbded5b
bswap ebp
xchg bx, si
pop ebp
xchg dword [esp + 2], ebp
cld
mov byte [esp], dl
jmp 0xbded1d
mov byte [esp + 2], cl
mov bx, di
mov ecx, ebx
pushal
lea esp, [esp + 0x43]
jmp 0xbdee00
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
stc
fdiv dword [ebp + 0x244c8851]
adc byte [esi - 0x79], ah
retf
mov ch, 0x51
mov byte [esp + 0x10], cl
xchg bx, cx
push dword [esp + 0x1e]
pop si
mov al, ch
jmp 0xbdedab
lea ecx, [edi - 0xe0]
mov dl, byte [esp]
mov edx, 0x13cdc982
xchg ecx, edx
neg ebx
mov al, dh
jmp 0xbdee12
std
call fcn.00bdee5d
mov edi, 0x2bb94a2f
adc al, 0x90
push es
popal
nop
pop ss
lea ebx, [edi + ebp*2]
jbe 0xbdedbb
mov edx, 0xa72b5725
cpuid
bswap ebx
dec bx
and eax, 0xfa72b57
mov byte [0x4b66cb0f], al
rdtsc
mov al, byte [esp]
jmp 0xbdedd4
bts ebx, edi
mov bp, 0x85a9
cpuid
clc
bswap edi
rcr di, cl
jmp 0xbdedea
pushal
xchg byte [esp + 1], bl
sbb di, di
xchg byte [esp + 0x19], dl
lea esi, [esi*4]
bswap edi
jmp 0xbdedc1
setnp bh
lea ebp, [0x44a44bd0]
clc
pop word [esp + 5]
xchg dx, ax
clc
jmp 0xbded98

Function at 0xbdf311
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x43]
mov dh, 0x2d
neg ax
setnp dh
jmp 0xbdf354
rdtsc
mov bh, cl
pushal
mov ebx, edi
xchg ecx, ebp
neg edi
jmp 0xbdf33e
mov ecx, eax
mov esi, dword [esp]
setle dl
dec edx
lea ecx, [edx + esi]
lea edx, [eax*4]
jmp 0xbdf31f
Function at 0xbdf424
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec dh
mov di, cx
xchg ebp, eax
neg cl
cld
push ecx
jmp 0xbdf404
dec al
mov ch, 0xc
setp bl
xchg word [esp + 0xa], ax
setne al
neg si
jmp 0xbdf3c4
mov byte [esp + 6], bl
mov ecx, edi
sub esp, 0x16
lea esp, [esp + 0x51]
cpuid
jmp 0xbdf450
xchg byte [esp + 0x10], al
bswap ebx
cmc
mov bx, dx
sub esp, 0xf
push dword [esp + 3]
jmp 0xbdf3ee
cpuid
rdtsc
pop word [esp + 0x1c]
cpuid
mov ecx, dword [esp + 1]
jmp 0xbdf3da
xchg dl, ah
lea eax, [ecx + edx]
pushal
mov bl, byte [esp + 0x1e]
bsf cx, si
mov si, 0x2dfb
jmp 0xbdf47d
bsr bp, sp
rdtsc
lea edx, [edx + 0x385e]
mov eax, dword [esp]
mov dh, byte [esp]
mov ch, byte [esp]
jmp 0xbdf435
mov byte [esp + 0x1b], bh
mov byte [esp + 0x17], cl
lea ecx, [esi + 0xdeefef4]
jmp 0xbdf4bf
pop bx
rdtsc
mov eax, dword [esp + 0x1d]
mov dx, 0xc833
cmp ebp, 0x27cd85d5
xchg word [esp + 5], di
jmp 0xbdf467

Function at 0xbdfa7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror ch, cl
sub esp, 2
btc eax, ecx
not dl
pop ebx
lea ebp, [esp + ebx]
jmp 0xbdf06e
bt si, cx
not edx
lea ebp, [eax + 0xcd99]
pop edi
lea esi, [ebx - 0xf3]
or bh, cl
jmp 0xbdf000
dec bp
pop bx
mov eax, 0xc64322d9
cpuid
mov ebp, 0xbf4fb1e4
mov cx, word [esp + 0x2c]
jmp 0xbdf016
lea esp, [esp + 3]
sete al
xchg byte [esp], bh
mov al, dh
call fcn.00bdf084
jp 0xbdf0c0
les esi, [edi + 0x5e]
pop dx
push dword [esp + 0x11]
setne al
mov ch, al
lea ecx, [ecx + 0xc762]
add esp, 0x28
jmp 0xbdf058
add ax, 0xda9
btr di, sp
lea esp, [esp + 1]
pushal
xchg si, bx
mov esi, dword [esp + 0x25]
jmp 0xbdf041
and al, 0xe9
and eax, dword [ecx]
add byte [eax], al
or al, 0x9f
out 0x11, al
xchg word [esp + 2], di
push dword [esp + 5]
rdtsc
xchg ebx, edx
xchg word [esp + 0xf], dx
rdtsc
jmp 0xbdf09e
mov bl, byte [esp + 1]
pop word [esp + 8]
cld
add esp, 0x22
mov bh, byte [esp + 8]
lea esp, [esp + 2]
jmp 0xbdf3ab
pushfd
xchg byte [esp + 0x1c], dl
mov word [esp + 0x14], bx
setne ah
jmp 0xbdf612

Function at 0xbe0a77
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
cmc
std
clc
clc
push eax
jmp 0xbe0a5c
bsf ax, dx
cld
mov eax, 0xbf50424f
sets al
bsf eax, eax
lea esp, [esp + 3]
jmp 0xbe0a4d

Function at 0xbe0cd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi + esi]
xchg si, dx
dec esi
add esp, 1
lea esp, [esp]
pop si
jmp 0xbe0cef
lea edx, [eax + edi]
jmp 0xbe0cb8
mov si, 0xed77
cmc
sub esp, 2
lea edx, [ebx + 0x230f]
jmp 0xbe0d9b
add esp, 0
or edx, 0x4e997596
lea eax, [ebp + ebp]
setl ah
mov esi, 0x3eb0257c
rdtsc
jmp 0xbe0cd9
pushal
xchg word [esp + 0x10], ax
not dh
pop eax
push dword [esp + 0x13]
pop dword [esp + 2]
jmp 0xbe0d28
mov byte [esp], ah
mov edx, 0x22983a4f
xchg dh, dl
mov ax, 0xed4c
mov dl, dh
lea eax, [ebx - 0x9eaf]
jmp 0xbe0d3e
mov edx, 0x9ab862e5
mov ah, byte [esp]
or dh, 0xe
cld
inc eax
mov eax, 0x21a984fd
jmp 0xbe0d6f
Function at 0xbe1278
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
pop word [esp + 0x10]
shl al, 3
mov esi, dword [esp + 8]
xchg esi, edx
inc eax
jmp 0xbe1282
rdtsc
mov si, 0x23ac
inc dl
jmp 0xbe1260
shr si, 0xa
mov byte [esp + 0x13], ch
xchg word [esp + 0x13], dx
xchg dword [esp + 8], edx
not si
mov word [esp], cx
jmp 0xbe13ff
mov ah, byte [esp + 0xd]
bswap edx
xchg word [esp + 3], dx
rdtsc
call fcn.00be12df
rcl edx, 1
mov edx, dword [esp + 5]
call fcn.00be146c
push ebx
aad 0x45
sub al, 0xdf
pop edx
les esi, [edi + 0x5e]
test eax, 0x74fffcc8
and al, 2
mov eax, dword [esp + 0xb]
xchg si, dx
pop word [esp + 5]
xchg esi, edx
jmp 0xbe1411

Function at 0xbe1937
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 2]
mov edx, ebx
mov eax, edi
lea eax, [ebx + esi]
mov edx, 0x88b050ad
jmp 0xbe1883

Function at 0xbe1b62
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
push word [esp + 4]
push word [esp + 3]
jmp 0xbe1b9a
lea esp, [esp + 2]
mov dword [esp + 8], edx
and al, 8
call fcn.00be1b84
jo 0xbe1ba0
add dh, cl
or al, 0x6e
call 0x5ea63531
test dword [eax - 0xa3a429e], edi

Function at 0xbe1b84
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
call fcn.00bdf139
push dword [esp + 3]
pushfd
push word [esp + 0xb]
lea esp, [esp + 2]
jmp 0xbe1c6d
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esp
call fcn.00be1c2f
push eax
jmp 0xbdf134

Function at 0xbe1bd2
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 6]
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp + 8], esi
jmp 0xbe1c0c
push ecx
call fcn.00be1bf6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xbe1c55
push edx
jmp 0xbe1c90
mov eax, dword [eax + 0x1c]
jmp 0xbe1c3f
mov edx, eax
mov eax, dword [edx]
pop edx
mov eax, dword [eax + 8]
jmp 0xbe1c7a

Function at 0xbe1bf6
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0xbe1c12

Function at 0xbe1c2f
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
mov word [esp + 7], bp
lea esp, [esp + 0x1d]
call fcn.00be1bd2
mov word [esp + 1], dx
mov word [esp], di
mov dword [esp + 0xc], ebp
pushal
jmp 0xbe1be8