joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453668
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46cbb0]
cmp dword [eax + 0x30], 0
je 0x453712
cmp dword [ebx + 0x94], 0
jne 0x45370c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4535f8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45370c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4536d2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45370c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041380c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4536e1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454274
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4542a9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f90
jmp 0x4542b6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ef4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455308
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455349
mov eax, esi
call fcn.0043bab4
test al, al
je 0x455349
mov eax, dword [ebx + 0x84]
call fcn.0043b7b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455349
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b7b0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x458a10
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x458a3e
mov eax, ebx
call fcn.004594c4
cmp dword [ebx + 0x40], 0
je 0x458a37
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x458aaf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x458aa1
cmp dword [ebx + 8], 0
je 0x458a60
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x458a72
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x458aa1
cmp dword [ebx + 8], 0
je 0x458a53
cmp eax, 3
je 0x458a85
dec eax
jne 0x458a53
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x458a53
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x458a53
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x458acd
cmp dword [ebx + 0x14], 0xcc
je 0x458acd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00458ad8
pop ebx
ret
Function at 0x401154
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
xor esi, esi
call edi
add byte [esi + 0x4228d0], 0x6d
call edi
add byte [esi + 0x4228d0], 0xaa
call edi
xor byte [esi + 0x4228d0], 0x6c
call edi
add byte [esi + 0x4228d0], 0xf5
call edi
add byte [esi + 0x4228d0], 0xcb
call edi
add byte [esi + 0x4228d0], 0x8b
call edi
add byte [esi + 0x4228d0], 0xea
call edi
xor byte [esi + 0x4228d0], 9
call edi
add byte [esi + 0x4228d0], 0x7a
call edi
add byte [esi + 0x4228d0], 0x8e
call edi
xor byte [esi + 0x4228d0], 0xe5
call edi
add byte [esi + 0x4228d0], 0xd6
call edi
add byte [esi + 0x4228d0], 0x51
call edi
add byte [esi + 0x4228d0], 0xf1
call edi
add byte [esi + 0x4228d0], 0xf4
call edi
add byte [esi + 0x4228d0], 0x27
call edi
xor byte [esi + 0x4228d0], 0xca
call edi
add byte [esi + 0x4228d0], 0x53
call edi
add byte [esi + 0x4228d0], 0x94
call edi
add byte [esi + 0x4228d0], 0xfe
call edi
add byte [esi + 0x4228d0], 0xa0
call edi
add byte [esi + 0x4228d0], 0xaa
call edi
add byte [esi + 0x4228d0], 0x60
call edi
add byte [esi + 0x4228d0], 0x58
call edi
add byte [esi + 0x4228d0], 0xd6
call edi
xor byte [esi + 0x4228d0], 0xa8
call edi
add byte [esi + 0x4228d0], 0x20
call edi
add byte [esi + 0x4228d0], 0x39
call edi
add byte [esi + 0x4228d0], 0x36
call edi
add byte [esi + 0x4228d0], 0x13
call edi
add byte [esi + 0x4228d0], 0xa2
call edi
xor byte [esi + 0x4228d0], 0xd1
call edi
xor byte [esi + 0x4228d0], 0x3b
call edi
xor byte [esi + 0x4228d0], 0x47
call edi
add byte [esi + 0x4228d0], 8
call edi
add byte [esi + 0x4228d0], 0x50
call edi
xor byte [esi + 0x4228d0], 0xc4
call edi
add byte [esi + 0x4228d0], 0x12
call edi
add byte [esi + 0x4228d0], 0x97
call edi
xor byte [esi + 0x4228d0], 0xe
call edi
add byte [esi + 0x4228d0], 0xd4
call edi
xor byte [esi + 0x4228d0], 0x8a
call edi
add byte [esi + 0x4228d0], 0x35
call edi
xor byte [esi + 0x4228d0], 0x6f
call edi
add byte [esi + 0x4228d0], 0x9d
call edi
xor byte [esi + 0x4228d0], 0x45
call edi
add byte [esi + 0x4228d0], 0x6d
call edi
add byte [esi + 0x4228d0], 0xb5
call edi
add byte [esi + 0x4228d0], 0xc1
inc esi
cmp esi, 0x23000
jb 0x40115e
pop edi
pop esi
ret
Function at 0x418a50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418a7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418a7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
mov ecx, 0x5c30826
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1e7f5e40
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4034b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
call sub.kernel32.dll_GetFileType
cmp eax, 2
jne 0x403505
push 0
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
mov dword [ebp - 8], eax
test eax, eax
jne 0x40356b
call sub.kernel32.dll_GetLastError
mov dword [0x41a280], eax
call fcn.00403454
jmp 0x40356b
push 0
lea edi, [ebp - 0xc]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
mov dword [ebp - 8], eax
test eax, eax
jne 0x403542
call sub.kernel32.dll_GetLastError
mov dword [0x41a280], eax
cmp eax, 0x6d
jne 0x40353b
mov dword [0x41a280], 0
jmp 0x40356b
call fcn.00403454
jmp 0x40356b
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40356b
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x403505
mov eax, dword [ebp - 0x10]
leave
ret 0xc

Function at 0x403574
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 0
lea edi, [ebp - 0xc]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
mov dword [ebp - 8], eax
test eax, eax
jne 0x4035b4
call sub.kernel32.dll_GetLastError
mov dword [0x41a280], eax
call fcn.00403454
jmp 0x4035dd
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4035dd
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x403588
mov eax, dword [ebp - 0x10]
leave
ret 0xc
Function at 0x7ff8e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7ff902
pop word [esp]
push word [esp + 1]
jle 0x7ff9b1
mov dword [esp], edx
jmp 0x7ff948
mov dword [esp], edx
push ebx
jmp 0x7ff9b8
mov dword [esp], edx
mov dword [esp], edx
push ebx
call fcn.007ff932
push word [esp + 1]
jmp 0x7ffa83
pop dword [esp]
pushfd
mov word [esp + 3], di
mov dword [esp + 8], ebp
call fcn.007ff9f4
mov ebp, dword [esp + 0x2c]
xchg edx, esi
mov ah, ch
bsf ecx, edi
jmp 0x7ffb1e
lea esi, [esp]
push cx
add esp, 0
jmp 0x7ffafc
pop cx
lea edx, [edx + ebx]
jmp 0x7ffb05
jae 0x7ffac7
pop cx
lea edx, [edx + ebx]
jmp 0x7ffacc
sub esp, 0xc0
jmp 0x7ffb60
js 0x7ffab9
jns 0x7ffab9
sub esp, 1
bswap ebx
xchg ebx, eax
mov ax, sp
lea esp, [esp + 1]
jmp 0x7ffb74
mov edi, esp
mov ax, si
mov bx, 0xa658
setp dl
mov ecx, ebp
call 0x7ffb22
fld dword [edi + 0xf662414]
mov esp, 0x664066da
btc ebx, ecx
xchg dword [esp], edx
bsf bx, dx
inc ax
btc bx, cx
lea edx, [edx - 0x3b]
mov ah, 0x6c
jmp 0x7ffbe0
ror ah, 7
mov ebx, eax
sub esp, 4
call fcn.007ffbc1
mov dh, 0xd5
setp al
jmp 0x7ffc1d
mov edx, dword [esp]
jmp 0x7ffd9f
ror ebp, 0
bsf edx, eax
jp 0x7ffc07
mov edx, dword [esp]
inc bl
mov eax, dword [esp]
jmp 0x7ffda4
mov ebx, dword [esp]
jmp 0x7ffc8a
rol ebp, 0
jmp 0x7ffcb9
mov bl, dh
sub ax, 0xbcf5
lea eax, [edi*4]
not bx
jmp 0x7ffd37
lea ebx, [esi*4]
mov ebx, dword [esp]
sub ebp, 0x4b9b2a30
lea eax, [ebx + edi]
mov bl, 0x90
setp dh
jmp 0x7ffc5f
js 0x7ffc68
mov bl, dh
sub ax, 0xbcf5
call fcn.007ffce0
loope 0x7ffce8
lea esp, [esp + 2]
xchg dword [esp + 0x2c], edi
setg al
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x7ffcf5
in al, dx
sbb ah, byte [esi - 1]
je 0x7ffd12
pop ds
mov byte [esp + 0x2b], al
jmp 0x7ffcc8
xchg dx, bx
rdtsc
stc
lea edi, [edi - 0x2c]
mov edx, dword [esp]
mov bl, 0xea
jmp 0x7ffd4d
xchg bl, dl
push dword [esp + 0x2c]
ret 0x30
cld
xchg edx, eax
cmc
add al, 0xb5
push edx
leave
pop ecx
cmp bl, cl
or ebp, eax
or esp, dword [edx - reloc.IPHLPAPI.DLL_GetInterfaceInfo]
fmul dword [edi]
mov word [ebp - 1], ss
invalid
not eax
neg ax
jl 0x7ffc80
lea ebx, [esi*4]
jmp 0x7ffc5a
mov ebx, dword [esp]
lea edx, [ebx + edi]
jmp 0x7ffddd
cmc
lea edx, [ebx*4]
xchg dword [esp + 0x2c], edi
dec bx
bts edx, edx
setne dl
jmp 0x7ffd08
inc bl
mov eax, dword [esp]
sub ebp, 0x53163f41
jmp 0x7ffd20
ror ebp, 0
jmp 0x7ffef9
xchg bl, ah
inc eax
lea ebx, [edx + edx]
jmp 0x7ffe03
lea ebx, [edx + edx]
jmp 0x7ffe03
jge 0x7ffde6
xchg bl, ah
inc eax
jmp 0x7ffe19

Function at 0x7ff984
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jp 0x7ff9bd
push word [esp + 1]
pop dword [esp]
pushfd
jmp 0x7ffa42
mov word [esp + 3], di
mov dword [esp + 8], ebp
jmp 0x7ffa90
Function at 0x7ff9f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
invalid
jmp 0x7ffa1d
mov dword [esp], edx
push dword [esp + 2]
je 0x7ff9de
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 8], esi
jmp 0x7ffa29
lea esp, [esp + 2]
and al, 2
lea esp, [esp + 2]
mov dword [esp + 8], esi
call fcn.007ffa63
cld
jge 0x7ffa1e
je 0x7ff9ba
xor esi, ecx
dec esi
fdivr qword [ebx - 0x1ca368aa]
jae 0x7ffa54
in eax, 0x5d
cmpsb byte [esi], byte es:[edi]
shl dword [esi - 0x77], 1
jl 0x7ffa6a
add ecx, dword [ecx - reloc.IPHLPAPI.DLL_GetInterfaceInfo]
inc ebx
and al, 2

Function at 0x7ffa63
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07f0df4
jmp 0x7ffaab
push di
mov byte [esp + 2], bh
lea esp, [esp + 2]
mov dword [esp + 8], edi
jmp 0x7ffa65
jmp 0x7ffa4d
lea esp, [esp + 8]
pushfd
jmp 0x7ff8e6
mov si, word [esp]
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov esi, eax
jmp 0x7ffa95
Function at 0x7ffb22
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7ff902
pop word [esp]
push word [esp + 1]
jle 0x7ff9b1
mov dword [esp], edx
jmp 0x7ff948
mov dword [esp], edx
push ebx
jmp 0x7ff9b8
mov dword [esp], edx
mov dword [esp], edx
push ebx
call fcn.007ff932
push word [esp + 1]
jmp 0x7ffa83
pop dword [esp]
pushfd
mov word [esp + 3], di
mov dword [esp + 8], ebp
call fcn.007ff9f4
mov ebp, dword [esp + 0x2c]
xchg edx, esi
mov ah, ch
bsf ecx, edi
jmp 0x7ffb1e
lea esi, [esp]
push cx
add esp, 0
jmp 0x7ffafc
pop cx
lea edx, [edx + ebx]
jmp 0x7ffb05
jae 0x7ffac7
pop cx
lea edx, [edx + ebx]
jmp 0x7ffacc
sub esp, 0xc0
jmp 0x7ffb60
js 0x7ffab9
jns 0x7ffab9
sub esp, 1
bswap ebx
xchg ebx, eax
mov ax, sp
lea esp, [esp + 1]
jmp 0x7ffb74
mov edi, esp
mov ax, si
mov bx, 0xa658
setp dl
mov ecx, ebp
call 0x7ffb22
fld dword [edi + 0xf662414]
mov esp, 0x664066da
btc ebx, ecx
xchg dword [esp], edx
bsf bx, dx
inc ax
btc bx, cx
lea edx, [edx - 0x3b]
mov ah, 0x6c
jmp 0x7ffbe0
ror ah, 7
mov ebx, eax
sub esp, 4
call fcn.007ffbc1
mov dh, 0xd5
setp al
jmp 0x7ffc1d
mov edx, dword [esp]
jmp 0x7ffd9f
ror ebp, 0
bsf edx, eax
jp 0x7ffc07
mov edx, dword [esp]
inc bl
mov eax, dword [esp]
jmp 0x7ffda4
mov ebx, dword [esp]
jmp 0x7ffc8a
rol ebp, 0
jmp 0x7ffcb9
mov bl, dh
sub ax, 0xbcf5
lea eax, [edi*4]
not bx
jmp 0x7ffd37
lea ebx, [esi*4]
mov ebx, dword [esp]
sub ebp, 0x4b9b2a30
lea eax, [ebx + edi]
mov bl, 0x90
setp dh
jmp 0x7ffc5f
js 0x7ffc68
mov bl, dh
sub ax, 0xbcf5
call fcn.007ffce0
loope 0x7ffce8
lea esp, [esp + 2]
xchg dword [esp + 0x2c], edi
setg al
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x7ffcf5
in al, dx
sbb ah, byte [esi - 1]
je 0x7ffd12
pop ds
mov byte [esp + 0x2b], al
jmp 0x7ffcc8
xchg dx, bx
rdtsc
stc
lea edi, [edi - 0x2c]
mov edx, dword [esp]
mov bl, 0xea
jmp 0x7ffd4d
xchg bl, dl
push dword [esp + 0x2c]
ret 0x30
cld
xchg edx, eax
cmc
add al, 0xb5
push edx
leave
pop ecx
cmp bl, cl
or ebp, eax
or esp, dword [edx - reloc.IPHLPAPI.DLL_GetInterfaceInfo]
fmul dword [edi]
mov word [ebp - 1], ss
invalid
not eax
neg ax
jl 0x7ffc80
lea ebx, [esi*4]
jmp 0x7ffc5a
mov ebx, dword [esp]
lea edx, [ebx + edi]
jmp 0x7ffddd
cmc
lea edx, [ebx*4]
xchg dword [esp + 0x2c], edi
dec bx
bts edx, edx
setne dl
jmp 0x7ffd08
inc bl
mov eax, dword [esp]
sub ebp, 0x53163f41
jmp 0x7ffd20
ror ebp, 0
jmp 0x7ffef9
xchg bl, ah
inc eax
lea ebx, [edx + edx]
jmp 0x7ffe03
lea ebx, [edx + edx]
jmp 0x7ffe03
jge 0x7ffde6
xchg bl, ah
inc eax
jmp 0x7ffe19
Function at 0x800c67
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 3]
mov word [esp + 1], dx
jmp 0x800caf
ror dl, 0
jmp 0x800c95
bsf ax, cx
jne 0x800cd5
shr al, cl
dec eax
sub esp, 0xf
add esp, 1
pop dword [esp + 1]
jmp 0x800cda
pushal
lea eax, [edx*4]
btr ax, sp
js 0x800c73
jns 0x800c73
sub esp, 0xf
add esp, 1
pop dword [esp + 1]
jmp 0x800cda
shr al, cl
dec eax
jmp 0x800cbf
mov ax, bx
lea esp, [esp + 2]
jmp 0x800d23
jmp 0x800d50
mov ah, 0x3e
mov eax, dword [esp]
lea eax, [edi*4]
jmp 0x800def
lea esp, [esp + 0x2c]
inc dl
lea eax, [esi + edi]
dec al
ja 0x800d09
rcr ax, cl
neg ax
mov eax, 0x69258197
mov ah, 0x3e
mov eax, dword [esp]
jmp 0x800d10
rcr ax, cl
neg ax
mov eax, 0x69258197
jmp 0x800d0b
dec eax
jmp 0x800e77
stc
call fcn.00800d7e
adc al, 0x8d
wait
aad 0xff
invalid
rol dl, 0
or ah, 0xb9
jg 0x800db9
stc
jmp 0x800e28
lea eax, [edi*4]
mov ah, byte [esp]
add ax, di
jmp 0x8012de
mov ah, byte [esp]
lea eax, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x801025
mov ah, byte [esp]
lea eax, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x801025
ror dl, 0
mov ax, 0xbdf2
bsf eax, eax
jns 0x800e5c
js 0x800e46
mov edx, 0x3d5750ef
neg dl
jmp 0x800ee9
mov dx, word [esp]
call fcn.00800ecf
pop dword [esp]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x800f0d
not bl
lea eax, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov edx, 0xf638a1e2
setnp dl
jmp 0x800f56
lea esp, [esp + 2]
jmp 0x800f61
mov dx, word [esp]
bswap edx
call fcn.00800f33
lea esp, [esp + 8]
neg bl
rol ah, 0
jge 0x800ff0
jl 0x800fb0
cmp byte [0xfe69f0c], 0x92
rcl byte [ecx - 0x7a], 4
and al, 0x89
sbb al, 0x24
mov dh, cl
push dx
jmp 0x800f3e
not bl
sub al, cl
jle 0x800fcf
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x800fb9
cmc
rdtsc
mov ax, word [esp]
jmp 0x800ff7
bswap eax
dec edx
shr dh, cl
jmp 0x800ff9
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
bswap eax
dec edx
shr dh, cl
mov eax, 0x4d77a815
bsr dx, di
jmp 0x801000
cmc
rdtsc
mov ax, word [esp]
jmp 0x800f9a
mov eax, 0x4d77a815
jmp 0x800fdf
rol bl, 0
not dl
sub esp, 8
jmp 0x80121a
dec dl
lea eax, [ecx + edi]
setle ah
mov eax, dword [esp]
call fcn.00800f93
xor eax, ecx
jmp 0x800da3

Function at 0x800d71
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esi*4]
pushal
pop edx
lea esp, [esp + 0x44]
inc bl
jmp 0x800b54

Function at 0x800ecf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
jne 0x800f08
btr edx, ecx
pop dword [esp]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x800f0d
btr edx, ecx
jmp 0x800ef2

Function at 0x800f33
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + ebp]
lea edx, [eax + edx]
ror bl, 0
jmp 0x800f77
setb al
push ecx
xchg byte [esp], al
mov dword [esp], ebx

Function at 0x800f93
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr dl, 0
jb 0x800e85
mov edx, 0x3d5750ef
neg dl
mov dx, word [esp]
jmp 0x800eed
xchg dx, ax
mov ax, word [esp]
mov dx, cx
mov ah, bh
dec ebp
jmp 0x800e9b
mov dword [esp], ebx
lea eax, [ecx + ecx]
mov byte [esp], dl
mov al, dl
add cl, dl
jmp 0x800ec0
mov word [esp + 1], bx
jmp 0x800f24
Function at 0x870244
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x10], edi
pushal
jmp 0x8702dd
cmp eax, edi
jmp 0x8702a0
push 0x4c0
jmp 0x8702ae
lea esp, [esp + 4]
jne 0x7f679c
clc
clc
jmp 0x87028a
push 8
cmc
call 0x8702b7
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
xor eax, 0x7ff880
jmp 0x8705b8
lea esp, [esp + 0x20]
cmp dword [eax], edi
jmp 0x870522
mov dword [0x7ff7e8], eax
jmp 0x7f679c
jbe 0x7f6756
ja 0x7f681d
pushal
lea esp, [esp + 0x20]
call dword [0x7ff894]
push bx
lea esp, [esp + 2]
jmp 0x8702f5

Function at 0x8702b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x10], edi
pushal
jmp 0x8702dd
cmp eax, edi
jmp 0x8702a0
push 0x4c0
jmp 0x8702ae
lea esp, [esp + 4]
jne 0x7f679c
clc
clc
jmp 0x87028a
push 8
cmc
call 0x8702b7
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
xor eax, 0x7ff880
jmp 0x8705b8
lea esp, [esp + 0x20]
cmp dword [eax], edi
jmp 0x870522
mov dword [0x7ff7e8], eax
jmp 0x7f679c
jbe 0x7f6756
ja 0x7f681d
pushal
lea esp, [esp + 0x20]
call dword [0x7ff894]
push bx
lea esp, [esp + 2]
jmp 0x8702f5

Function at 0x8bf42b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8bf45c
xchg byte [esp], al
push dword [esp + 2]
sbb cl, dl
mov eax, esi
lea edi, [ebx + 0xe7]
xchg ebx, esi
jmp 0x8bf4b3
lea esp, [esp + 8]
mov ecx, eax
xchg bx, dx
neg dl
setle bl
adc cl, dl
jmp 0x8bf494

Function at 0x8bf7af
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ax
bsf esi, eax
mov ah, byte [esp + 2]
push word [esp + 4]
xchg dword [esp], eax
pop si
jmp 0x8bf7cc
neg edi
xchg di, ax
jmp 0x8bf793
neg al
mov byte [esp], dh
mov ax, dx
lea esp, [esp]
mov dl, bl
rol bl, 6
jmp 0x8bf802
or al, cl
add esp, 8
bsr eax, eax
shl al, 5
xchg bl, ch
bswap ebx
jmp 0x8bf7b6
bsf cx, sp
mov eax, dword [esp]
push di
mov bl, 0xc
mov bp, 0x13f9
shr esi, cl
jmp 0x8bf98d
dec bl
pop bx
mov ch, bh
lea edx, [ebp + 0x93]
pushal
bswap eax
jmp 0x8bf898
rdtsc
lea esp, [esp + 0xa]
xchg bh, dl
lea esi, [esi - 0xb0]
mov eax, dword [esp + 0x12]
xchg dword [esp + 0xa], ebx
jmp 0x8bf86a
lea esp, [esp + 0x1a]
mov byte [esp + 9], bl
bsf eax, edx
mov byte [esp + 0x11], dl
btc edi, ebx
jmp 0x8bf8e2
lea esi, [eax*4]
neg si
rdtsc
xchg dword [esp + 9], edi
sub esp, 0x10
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x8bf880
mov edi, ebx
mov bh, byte [esp + 0x15]
lea eax, [ecx + esi]
mov byte [esp + 0xb], al
bswap eax
call fcn.008bf91d
ret
neg si
mov dl, byte [esp + 1]
lea ecx, [esi*4]
rdtsc
mov dword [esp + 8], edx
xchg bl, cl
jmp 0x8bf8cc
rol bl, cl
setne ch
push dword [esp + 3]
not bh
rdtsc
cmc
jmp 0x8bf8b1
mov byte [esp + 2], dh
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
setb dh
mov cx, word [esp + 7]
xchg ecx, ebx
bswap edi
jmp 0x8bf90d
cmc
clc
push edx
rcr ax, 7
mov al, 0xef
push dword [esp + 6]
jmp 0x8bf93e

Function at 0x8bfa11
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
setbe cl
call fcn.008bf383
bts cx, ax
mov bh, byte [esp]
dec ax
rdtsc
setge ch
add esp, 0
jmp 0x8bf64a
pop word [esp]
setg ah
add eax, edi
lea esp, [esp]
xchg ebp, ecx
xchg byte [esp], dl
jmp 0x8bf6c6
rdtsc
jmp 0x8bf854