joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8596
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ecx
mov eax, 0x124254
mov ecx, 0x256
pop ecx
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xd07701ff
xor esi, eax
xor esi, 0x4a409c8c
popal
nop dword [eax]
pushal
mov ecx, 0x4a4cef1c
xor ecx, 0xb0ee77f2
mov eax, 0x883fa0ac
xor eax, 0x82f95559
mov edx, 0x26491991
xor edx, 0x87128dd1
mov ebx, 0x3c02473c
xor ebx, 0xb54c1974
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x51bf99f5
xor esi, eax
xor esi, 0xcb096c2d
popal
nop dword [eax]
pushal
mov ecx, 0x7fee09d8
xor ecx, 0x34d2a606
mov eax, 0x95b7956e
xor eax, 0x4a9c2fef
mov edx, 0xc3e60227
xor edx, 0x605985d2
mov ebx, 0x153e220a
xor ebx, 0x8e87f28b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x436c8ebe
xor esi, eax
xor esi, 0xa4517e2b
popal
nop dword [eax]
pushal
mov ecx, 0x59361bc3
xor ecx, 0xd27fedfb
mov eax, 0x6ef36e7c
xor eax, 0x5f72d4b4
mov edx, 0xa8fe5e1f
xor edx, 0x457e193f
mov ebx, 0xbec7e9bf
xor ebx, 0x73ac85f8
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x28912078
xor esi, eax
xor esi, 0x8969da23
popal
nop dword [eax]
pushal
mov ecx, 0x3e4e7a39
xor ecx, 0xb7984aba
mov eax, 0x541805da
xor eax, 0xcd61d65a
mov edx, 0x82467293
xor edx, 0x372b103d
mov ebx, 0x9803c6be
xor ebx, 0x4ce862f6
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xc6323699
xor esi, eax
xor esi, 0x62b1ee89
popal
nop dword [eax]
pushal
mov ecx, 0x17968c37
xor ecx, 0x90e05e67
mov eax, 0x4a1dbfff
xor eax, 0xe6914238
mov edx, 0x6bb795a2
xor edx, 0xe50d9f0b
mov ebx, 0x81812143
xor ebx, 0x3665bbc3
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xafaf8dfc
xor esi, eax
xor esi, 0x4c23119c
popal
nop dword [eax]
pushal
mov ecx, 0xc56ce3d5
xor ecx, 0x7a517e55
mov eax, 0x2f4254e8
xor eax, 0x901b09f6
mov edx, 0x44ffa7a1
xor edx, 0xbe4979d9
mov ebx, 0x5abcfa59
xor ebx, 0xd406cc92
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x88f7a31a
xor esi, eax
xor esi, 0x3ddc4333
popal
nop dword [eax]
pushal
mov ecx, 0x9eb4f9b8
xor ecx, 0x53999433
mov eax, 0x87e306b
xor eax, 0xa4f1b415
mov edx, 0x1e3b864e
xor edx, 0xd32c59b6
mov ebx, 0x6f9fdbef
xor ebx, 0xb92b622f
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x6e0fffd0
xor esi, eax
xor esi, 0xe759d208
popal
nop dword [eax]
pushal
mov ecx, 0x83cd5288
xor ecx, 0x38b1eec1
mov eax, 0xb207fb53
xor eax, 0x4e7b7a62
Function at 0x4b1ac3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ecx
mov eax, 0x124254
mov ecx, 0x256
pop ecx
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xd07701ff
xor esi, eax
xor esi, 0x4a409c8c
popal
nop dword [eax]
pushal
mov ecx, 0x4a4cef1c
xor ecx, 0xb0ee77f2
mov eax, 0x883fa0ac
xor eax, 0x82f95559
mov edx, 0x26491991
xor edx, 0x87128dd1
mov ebx, 0x3c02473c
xor ebx, 0xb54c1974
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x51bf99f5
xor esi, eax
xor esi, 0xcb096c2d
popal
nop dword [eax]
pushal
mov ecx, 0x7fee09d8
xor ecx, 0x34d2a606
mov eax, 0x95b7956e
xor eax, 0x4a9c2fef
mov edx, 0xc3e60227
xor edx, 0x605985d2
mov ebx, 0x153e220a
xor ebx, 0x8e87f28b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x436c8ebe
xor esi, eax
xor esi, 0xa4517e2b
popal
nop dword [eax]
pushal
mov ecx, 0x59361bc3
xor ecx, 0xd27fedfb
mov eax, 0x6ef36e7c
xor eax, 0x5f72d4b4
mov edx, 0xa8fe5e1f
xor edx, 0x457e193f
mov ebx, 0xbec7e9bf
xor ebx, 0x73ac85f8
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x28912078
xor esi, eax
xor esi, 0x8969da23
popal
nop dword [eax]
pushal
mov ecx, 0x3e4e7a39
xor ecx, 0xb7984aba
mov eax, 0x541805da
xor eax, 0xcd61d65a
mov edx, 0x82467293
xor edx, 0x372b103d
Function at 0x4b8715
Capabilities:
Execute anti-debugging instructions

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4ba99b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ecx
mov eax, 0x124254
mov ecx, 0x256
pop ecx
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xd07701ff
xor esi, eax
xor esi, 0x4a409c8c
popal
nop dword [eax]
pushal
mov ecx, 0x4a4cef1c
xor ecx, 0xb0ee77f2
mov eax, 0x883fa0ac
xor eax, 0x82f95559
mov edx, 0x26491991
xor edx, 0x87128dd1
mov ebx, 0x3c02473c
xor ebx, 0xb54c1974
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x51bf99f5
xor esi, eax
xor esi, 0xcb096c2d
popal
nop dword [eax]
pushal
mov ecx, 0x7fee09d8
xor ecx, 0x34d2a606
mov eax, 0x95b7956e
xor eax, 0x4a9c2fef
mov edx, 0xc3e60227
xor edx, 0x605985d2
mov ebx, 0x153e220a
xor ebx, 0x8e87f28b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x436c8ebe
xor esi, eax
xor esi, 0xa4517e2b
popal
nop dword [eax]
pushal
mov ecx, 0x59361bc3
xor ecx, 0xd27fedfb
mov eax, 0x6ef36e7c
xor eax, 0x5f72d4b4
mov edx, 0xa8fe5e1f
xor edx, 0x457e193f
mov ebx, 0xbec7e9bf
xor ebx, 0x73ac85f8
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x28912078
xor esi, eax
xor esi, 0x8969da23
popal
nop dword [eax]
pushal
mov ecx, 0x3e4e7a39
xor ecx, 0xb7984aba
mov eax, 0x541805da
xor eax, 0xcd61d65a
mov edx, 0x82467293
xor edx, 0x372b103d
mov ebx, 0x9803c6be
xor ebx, 0x4ce862f6
mul byte [edx - 0x18]
dec esp
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xc6323699
xor esi, eax
xor esi, 0x62b1ee89
popal
nop dword [eax]
pushal
mov ecx, 0x17968c37
xor ecx, 0x90e05e67
mov eax, 0x4a1dbfff
xor eax, 0xe6914238
mov edx, 0x6bb795a2
xor edx, 0xe50d9f0b
mov ebx, 0x81812143
xor ebx, 0x3665bbc3
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xafaf8dfc
xor esi, eax
xor esi, 0x4c23119c
popal
nop dword [eax]
pushal
mov ecx, 0xc56ce3d5
xor ecx, 0x7a517e55
mov eax, 0x2f4254e8
xor eax, 0x901b09f6
mov edx, 0x44ffa7a1
xor edx, 0xbe4979d9
mov ebx, 0x5abcfa59
xor ebx, 0xd406cc92
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x88f7a31a
xor esi, eax
xor esi, 0x3ddc4333
popal
nop dword [eax]
pushal
mov ecx, 0x9eb4f9b8
xor ecx, 0x53999433
mov eax, 0x87e306b
xor eax, 0xa4f1b415
mov edx, 0x1e3b864e
xor edx, 0xd32c59b6
mov ebx, 0x6f9fdbef

Function at 0x4c0445
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc esp
cmp byte [ecx], al
xor dword [ebp - 9], 0xa20f9090
Function at 0x4c218d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ecx
mov eax, 0x124254
mov ecx, 0x256
pop ecx
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xd07701ff
xor esi, eax
xor esi, 0x4a409c8c
popal
nop dword [eax]
pushal
mov ecx, 0x4a4cef1c
xor ecx, 0xb0ee77f2
mov eax, 0x883fa0ac
xor eax, 0x82f95559
mov edx, 0x26491991
xor edx, 0x87128dd1
mov ebx, 0x3c02473c
xor ebx, 0xb54c1974
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x51bf99f5
xor esi, eax
xor esi, 0xcb096c2d
popal
nop dword [eax]
pushal
mov ecx, 0x7fee09d8
xor ecx, 0x34d2a606
mov eax, 0x95b7956e
xor eax, 0x4a9c2fef
mov edx, 0xc3e60227
xor edx, 0x605985d2
mov ebx, 0x153e220a
xor ebx, 0x8e87f28b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x436c8ebe
xor esi, eax
xor esi, 0xa4517e2b
popal
nop dword [eax]
pushal
mov ecx, 0x59361bc3
xor ecx, 0xd27fedfb
mov eax, 0x6ef36e7c
xor eax, 0x5f72d4b4
mov edx, 0xa8fe5e1f
xor edx, 0x457e193f
sbb dword [esi + 0x45], edi
mov ebx, 0xbec7e9bf
xor ebx, 0x73ac85f8
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x28912078
xor esi, eax
xor esi, 0x8969da23
popal
nop dword [eax]
pushal
mov ecx, 0x3e4e7a39
xor ecx, 0xb7984aba
mov eax, 0x541805da
xor eax, 0xcd61d65a
mov edx, 0x82467293
xor edx, 0x372b103d
mov ebx, 0x9803c6be
xor ebx, 0x4ce862f6
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xc6323699
xor esi, eax
xor esi, 0x62b1ee89
popal
nop dword [eax]
pushal
mov ecx, 0x17968c37
xor ecx, 0x90e05e67
mov eax, 0x4a1dbfff
xor eax, 0xe6914238
mov edx, 0x6bb795a2
xor edx, 0xe50d9f0b
mov ebx, 0x81812143
xor ebx, 0x3665bbc3
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xafaf8dfc
xor esi, eax
xor esi, 0x4c23119c
popal
nop dword [eax]
pushal
mov ecx, 0xc56ce3d5
xor ecx, 0x7a517e55
mov eax, 0x2f4254e8
xor eax, 0x901b09f6
mov edx, 0x44ffa7a1
xor edx, 0xbe4979d9
mov ebx, 0x5abcfa59
xor ebx, 0xd406cc92
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x88f7a31a
xor esi, eax
xor esi, 0x3ddc4333
popal
nop dword [eax]
pushal
mov ecx, 0x9eb4f9b8
xor ecx, 0x53999433
mov eax, 0x87e306b
xor eax, 0xa4f1b415
mov edx, 0x1e3b864e
xor edx, 0xd32c59b6
mov ebx, 0x6f9fdbef
xor ebx, 0xb92b622f
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x6e0fffd0
xor esi, eax
xor esi, 0xe759d208
popal
nop dword [eax]
pushal
mov ecx, 0x83cd5288
xor ecx, 0x38b1eec1
mov eax, 0xb207fb53
xor eax, 0x4e7b7a62
mov edx, 0xc7c54e0c
xor edx, 0x7ca9e88d
mov ebx, 0xf5f3bac5
xor ebx, 0x92673e65
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x4756f65e
xor esi, eax
xor esi, 0xc0a0c6de
popal

Function at 0x4c9d0e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
in al, dx
btc ax, 0x92
or al, 0xd1
mov edx, dword [ebp + 0x10]
rcr al, cl
sub cx, bx
Function at 0x4c9f3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
and edi, dword [ecx + 0x36342202]
push ebp
mov ebp, esp
test di, 0x4f82
cmc
sub esp, 0xc
cmp dword [ebp + 8], 0
jmp 0x53ea29
je 0x536b38
mov eax, dword [ebp + 0x10]
cmp eax, 1
jmp 0x60787f
sub eax, eax
jmp 0x68df82
je 0x536b38
cmp dword [ebp + 0x14], 0
jmp 0x4e9b38
mov edi, edx
or ecx, 0xffffffff
sub eax, eax
cmc
repne scasb al, byte es:[edi]
not esi
dec esi
not ecx
dec ecx
mov esi, eax
mov esi, ecx
je 0x4c3129
cmp byte [edx], 0x2d
je 0x4c3129
push esi
jmp 0x4ac53e
int1
outsb dx, byte [esi]
lodsb al, byte [esi]
inc ebp
invalid
Function at 0x4cc2e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc dword [eax], ebp
push ebp
jp 0x4cc351
cmp ecx, edi
sub edx, 0xffffffe5
jmp 0x62499a
cld
call dword [eax - 0x6f6f6f70]
nop
nop
nop
jmp 0x662874
add byte [edi - 0x3642f037], 0x8b
into
shr edi, cl
shr ch, 0x40
mov ecx, dword [ebp + 8]
cmp esp, ebp
test bl, 0x7a
or dword [ecx], edi
movsx ecx, cx
lea eax, [eax + edx*4 + 0x44]
bswap ecx
xchg dl, ch
movzx edx, si
mov edx, 0x80000000
mov ch, 6
mov dword [esi + 4], edx
jmp 0x676f0e
cmp edx, eax
jmp 0x66782c
neg dx
mov dword [ebp + 8], eax
btr edx, 0xc2
stc
bts dx, bp
cdq
idiv edi
bts edi, edx
xlatb
pop edi
stc
test edx, edx
jmp 0x4d68c9
shl dword [esi - 0x48], 0xb6
inc ebp
mov eax, dword [ebx + 0x2c]
clc
mov dword [esp + 0x1c], ecx
jmp 0x4dc2f3
mov dword [ebp - 4], esi
jmp 0x655910
cmp word [ebp + 0x10], 0x1d
jmp 0x63328f
jne 0x63b714
mov eax, ecx
stc
cmp ebx, 0x174f58a5
mov ecx, 0x190
btc edx, 0xb9
sbb dx, 0x46ad
cdq
clc
cmp dh, 0xf8
idiv ecx
jmp 0x4a7007
jne 0x50ecf5
cmp di, 2
jne 0x50ecf5
mov eax, esi
jmp 0x4eb7c6
inc edx
bswap ecx
setg cl
push 0xffffffffffffffff
movsx ecx, bx
push edx
mov ecx, 0x87200ee
lea ecx, [esp + 0x16c]
jmp 0x4d16f1
sti
stc
cmc
cmp cx, 0x62fc
test edx, edx
jmp 0x652aa2
jmp 0x661362
add byte [esi], ch

Function at 0x4cd0b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x4a1867
add ebx, dword [eax + 0x62f6f381]
call 0x1f5979be
add byte [eax], 0
add byte [eax], al
push ecx
push esp
adc al, 0
push 0
push 0
call eax
mov esi, eax
test sp, cx
test esi, esi
je 0x61250c
push 0x10175cc0
mov ch, 0xc4
movsx ecx, dx
mov ecx, edx
mov ecx, 0x101918fc
jmp 0x50a916
jmp 0x4f4dea
dec ebp
add edx, 0x1f
dec ebx
cmc
stc
sub esp, 0xffffffb3
sub ebx, 0x33
dec esi
test dl, 0x3f
sub esi, 0xd
dec ebp
jmp 0x660948
call fcn.00677f83
test eax, eax
jmp 0x63100c
fimul dword [ecx + 0xcc2ffec]
add byte [edi + 0x50], dl
jmp 0x4de5c7
push esp
push edi
jmp 0x4a1806
mov esi, 0xc7bc0fc0

Function at 0x4d1db1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
jmp 0x60bbc0
mov eax, dword [esp + 0x14]
not ecx
movsx ecx, di
push 0x1c
mov cl, ah
not ch
push 1
movsx ecx, bp
mov ecx, dword [eax + 0x28]
jmp 0x4cc4ac
push ecx
jmp 0x625c27
add al, ch
out dx, eax
in eax, dx
inc dword [ebx - 0xa07f73c]
cmp si, 0x133b
test eax, eax
jmp 0x4dc06a
cmp eax, esp
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x28]
rcr bx, 0x22
sub ebx, ebx
mov ebx, dword [edi]
stc
mov dword [edi + 4], ecx
mov cx, dx
rcr ch, 0x87
bts cx, cx
mov ecx, ebp
cmp di, ax
stc
push eax
cmc
sub ecx, ebx
jmp 0x6295ea
mov ebx, dword [edi + 8]
test esi, 0x48df06e1
cmp cl, dh
add ebx, ecx
jmp 0x4a37ab

Function at 0x4d434b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4d6ccf
mov dword [ecx], 0x1016155c
jmp 0x52c99a
jmp fcn.0050d6e5
Function at 0x4db351
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov esi, dword [eax + 0x16b4]
jmp 0x66106e
push 0xffffffffffffffff
push 0x100df1a8
sub dx, bp
neg dl
btc edx, 0
mov eax, dword fs:[0]
mov edx, esp
xadd dh, dh
push eax
sub dh, dh
mov dword fs:[0], esp
cbw
btc ax, si
sub esp, 0x54
mov dx, 0x2a99
cmovae eax, esp
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
jmp 0x61e13a
add byte [eax], al
setb dh
mov edx, dword [esp + 0x20]
jmp 0x538835
loop 0x4e9345
add al, 0
cmp ebx, 7
jmp 0x655a45
mov byte [esi + edi], cl
mov esi, 0x67133686
cmovns ecx, edx
xchg si, si
mov ecx, dword [eax + 0x14]
mov esi, 0x1fb27948
jmp 0x471a5a
mov dword [eax + 0x14], esi
jmp 0x4f4d9e
mov ecx, dword [eax + 0x16b4]
cmp ecx, 0xe
jle 0x6533e4
add edx, 0xfffffffd
clc
mov esi, edx
mov bl, 0x67
shl esi, cl
add ecx, esp
rcl bl, 0xb3
mov ecx, dword [eax + 8]
add bl, 0xce
and bl, 0x5e
or word [eax + 0x16b0], si
stc
mov esi, dword [eax + 0x14]
mov bl, byte [eax + 0x16b0]
mov byte [ecx + esi], bl
mov esi, dword [eax + 0x14]
btr edi, ecx
mov edi, dword [eax + 8]
sub ecx, ecx
not cl
mov cl, byte [eax + 0x16b1]
inc esi
jmp 0x4fc24c
jmp 0x5056fd
dec edx
test esp, 0x46122e53
and edx, ebx
test cx, 0x39dd
cmp edx, ecx
jmp 0x4e934f
inc esp
and al, 0x34
stc
sub ch, 0x36
sal dl, 0x35
mov edx, 1
btr bx, 0xb6
mov ecx, esi
setns bl
xchg ebx, ebx
test di, 0x74c9
sub eax, esi
rcr bh, cl
bsf bx, cx
btc bx, 0xc8
mov ebx, edi
test edx, eax
cmc
shl edx, cl
mov ecx, eax
sar ebx, cl
movzx ecx, bp
mov ecx, dword [esi*4 + 0x10164f00]
jmp 0x61bc22
lea edx, [ecx + 7]
sal cl, cl
bsf ecx, ecx
shr edx, 3
neg cx
lea ecx, [edx + ebx - 1]
test esi, 0x7add6cec
mov dword [esp + 0x24], ecx
mov dl, byte [ecx]
shrd ecx, edx, 0xa9
xchg cx, cx
mov ecx, dword [ebp + 0x7c]
stc
mov byte [esp + 0x2c], dl
xor dx, cx
sar dx, cl
ror edx, 0xeb
mov edx, 0xff
test esi, 0x2c5206e7
cmc
test ecx, 0x10000
mov cl, 0x69
bswap ecx
mov ecx, esi
jmp fcn.004962db
retf 0x4c8d
lds eax, [edx + 0x4689ffe6]
xor bh, bh
xlatb
push 6
mov dword [esi + 0x34], eax
call edi
mov edi, dword [0x100e15c4]
jmp fcn.004d2187

Function at 0x4e1131
Capabilities:
Execute anti-debugging instructions

Disassembly:
not byte [eax - 0x7c36cc70]
rol dword [ecx], 0x81
stc
adc eax, dword [ecx + 0x77]
push ebp
mov eax, 0x53100e13
jmp 0x632b6e
aad 0x66
mov ebp, ebp
mov dword [esp + 0x2c], edi
movsx ebp, dx
mov ebp, 0x3e851218
lea ebp, [edi + 0x20]
jmp 0x4bcabb

Function at 0x4e24f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
shrd si, di, 0x47
mov esi, dword [ecx + 4]
test bl, 0xc0
cmp esi, ebx
test esi, esi
push edi
jmp 0x61244a
cmp edi, 0xffffffff
lea eax, [eax - 2]
stc
test bp, dx
neg eax
jmp 0x4b9ae7
Function at 0x4e4ddb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ds
rol dword [ebx + 7], 0x61
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xa3b748b1
xor esi, eax
xor esi, 0x589be1c0
popal
nop dword [eax]
pushal
mov ecx, 0xd807f6a
xor ecx, 0x6e49f563
mov eax, 0x232e8fe3
xor eax, 0x6cba194e
mov edx, 0x21aaee6e
xor edx, 0xbe1e6eee
mov ebx, 0x37684121
xor ebx, 0xec4cdb9b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x4d2593cd
xor esi, eax
xor esi, 0x20a3177
popal
nop dword [eax]
pushal
mov ecx, 0xb6fb0698
xor ecx, 0x3044d718
mov eax, 0xccb85798
xor eax, 0x460229d1
mov edx, 0xfae6c77b
xor edx, 0x5bbf7fb4
mov ebx, 0x10a41a2a
xor ebx, 0xc9eed38b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x4338a735
xor esi, eax
xor esi, 0x1b46f1b5
popal
nop dword [eax]
pushal
mov ecx, 0x9490c3ee
xor ecx, 0x49755e6e
mov eax, 0xe5e8e0a7
mov edx, dword [esp + 0xc]
jmp 0x51791c
mov ecx, dword [esp + 4]
test edx, edx
jmp 0x6034b5
dec eax
test bh, bh
cmc
test eax, eax
jmp 0x4c29ed
add byte [edi], cl
lea edx, [eax + eax]
add byte [eax], al
mov dword [esp + 0x20], ebp
cmp ebp, esi
mov dword [esp + 0x1c], eax
rcl ah, 0x78
xor ax, 0x1de7
cmovns eax, edi
mov eax, dword [esp + 0x38]
clc
add ebx, 4
jmp 0x602b07
loope 0x60344a
ljmp 0x2b2c:0xe3c166ff

Function at 0x4e500b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
cdq
sbb byte [eax], al
mov eax, dword [esi + 0x13c]
test bp, 0x3c50
cmc
cmp ecx, edi
lea esp, [esp + 0x18]
test cl, bl
sub eax, edi
test edi, 0x4f696a46
mov dword [esi + 0x84], ebx
stc
mov dword [esi + 0x88], edi
xor di, cx
mov edi, dword [esp + 0x418]
mov esp, 0x41824
add byte [ecx + 0x13c86], cl
add cl, ch
dec ebx
ficom dword [esi]
invalid
sal edx, 0x83
loopne 0x4e6a13
dec dword [edi]
push ebp
stosd dword es:[edi], eax
outsb dx, byte [esi]
clc
add esp, 0x14
test esi, esi
jmp 0x4e6a0d

Function at 0x4e8ba5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [eax], eax
add byte [ebx + 0x35013106], bh
add byte [ebx], dh
shr cl, 0x5e
sub al, 6
add byte [edx - 0x17], dl
or eax, 0x900018d7
nop
nop
nop
nop
nop
nop
jmp 0x4e8ba5
push esi
mov esi, ecx
jmp 0x63bbcf
add eax, dword [eax]
add cl, ch
inc eax
out 0xff, al
push edi
jmp 0x496727
Function at 0x4eea62
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
call edi
mov esi, dword [esi + 8]
jmp 0x5066eb
push esi
mov esi, ecx
xor eax, eax
push edi
sal di, 0xfb
and edi, 0x6d122dbc
xor di, 0x345
mov ecx, dword [esi + 4]
mov edi, dword [0x100e10ec]
test dh, dh
cmp bx, 0x1c30
cmp ecx, dword [esi + 8]
jmp 0x53f3e0
test esi, esi
je 0x6993b7
push dword [esp + 0xc]
jmp 0x61111b
je 0x4eb4ab
push dword [esp + 0xc]
jmp 0x4eb4a8
mov byte [0x9000028c], al
nop
cbw
nop
bt eax, 0x5c
or ah, 0x39
rdtsc
test esi, eax
cmp eax, ecx
jmp 0x61887c
jne 0x61112b
nop
pop es
invalid
mov ebx, 0x1d86f056
enter 0xffffffffffffe091, 0x45
nop
jne 0x6993c9
wait
inc edx
cli
and al, 0x82
int 0x38
sbb bl, byte [ecx + edi]
test al, 0x39
xchg ebp, eax
push edx
push es
getsec
jg 0x699353
pop ecx
cmp ch, byte [ebx - 0x5d]
nop
dec ebp
mov eax, dword [0xd4f3ee83]
pop esp
add eax, 0xa528294f
insb byte es:[edi], dx
dec esi
int 0xd7
aad 0x2a
adc bh, ch
inc esi
aam 0xc8
ficomp dword [edx - 0x34]
pop ebp
jns 0x6993ce
xor eax, ecx
salc
inc edx
jo 0x6993bf
imul edi, dword [eax + 0x1eefe1a7], 0x89b5622d
mov al, byte [0xff69fb8c]
xchg ebp, eax
ja 0x6993b9
pop esp
sbb esp, dword [ecx - 0x7105b4a4]
sub ah, 0x67
loopne 0x6993b7
mov es, word [eax - 0x51f9814]
in al, dx
loopne 0x6993b7
mov eax, 0x7b62b238
pop ebx
mov dl, 0x62
jnp 0x69941e
pop ds
mov dh, 0xe1
mov eax, dword [0x965ef395]
pop esi
xchg esi, eax
xchg edi, eax
stosb byte es:[edi], al
jp 0x699357
mov byte [esi + edx*4 - 0x9af76ea], al
test byte [esi - 0x9af76ea], dl
fidiv dword [edi + 0x298e19d]
and bh, byte [eax]
or dword [ebp - 0xd], ecx
xchg esi, eax
sbb bl, dh
mov dword [edi + 0x140f9e5a], edi
pop ebp
inc ecx
add ch, bl
lds ebx, [ebp + 0x78]
dec eax
pop edx
invalid
dec edx
into
cmp ecx, edi
mov esp, 0x6bb45a1c
les esp, [ecx + edi*2 + 0x4a2c83db]
scasb al, byte es:[edi]
mov edx, 0x6b39c512
cmc
mov bl, byte [eax - 0x61064c5a]
cld
cmp ah, byte [edi]
movsb byte es:[edi], byte [esi]
bound edi, qword [ebx - 0x79]
sbb eax, 0xc27d10bc
push edi
hlt
Function at 0x4f2e54
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec ebp
or edx, dword [eax]
jmp 0x65f28d
shl esi, 0xd5
stc
sub ecx, ecx
mov cl, byte [ebp]
btc esi, esi
sar esi, 0x5e
mov esi, ecx
bt cx, 0xc3
mov ecx, eax
cmc
shl esi, cl
cmp bx, 0x6066
clc
stc
add eax, 8
stc
test edx, 0x12074c84
jmp 0x520a86
mov eax, dword fs:[0]
cmp edx, ebx
push 0xffffffffffffffff
stc
push 0x100e0270
test ax, sp
push eax
test ebp, 0x2bd27618
bswap ax
rcl eax, 2
mov dword fs:[0], esp
sar eax, 0x38
sal ah, 0x29
shld ax, bx, 0x8e
sub esp, 0x4c
bts ax, bp
push ebx
bts bx, di
btc eax, 0x9e
stc
push ebp
push esi
mov esi, ecx
test ebx, 0x76db605d
bt ebx, esp
mov ebx, dword [esp + 0x6c]
btc eax, 0xb7
bts ax, si
push edi
bt ax, 0x75
mov eax, dword [esi + 0x5c]
mov eax, dword [eax - 8]
test eax, eax
jmp 0x51bc51
jne 0x65153a
lea edi, [esi + 0x60]
movsx eax, si
cdq
mov ax, di
push 0xf
cwd
movsx edx, sp
cbw
je 0x65153a
cmp ebx, 0xfffffffe
jmp 0x4f63bf
or edx, esi
jmp 0x606e6b
call dword [eax - 0x666f0ab6]
test esp, 0x3b6637f4
aad 0x83
les ebp, [edx + eax*8]
or byte [eax], al
leave
jmp 0x4d2e2e
inc esi
or byte [esi + 0xf], ah
mov ebp, 0xfc420ff8
mov eax, dword [esi]
add edi, ebx
mov edi, ebx
rol cl, 0x24
rcl cl, 0xf8
mov cl, byte [eax]
stc
seta ah
shl ecx, 0x18
bswap eax
movzx eax, dx
xchg al, ah
mov dword [edx + 8], ecx
jmp 0x4efc12

Function at 0x4f37cb
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
salc
out dx, eax
and byte [0x9a39aaa9], dh
sar byte [ebx], 0xd1
jmp 0x510aa3
mov dword [ebx], 8
jmp 0x4e4e22
jmp 0x664644
jmp 0x60538c
je 0x4d1025
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x1c], ebp
movzx ebp, bx
mov dword [ebx + 0x20], edx
shl ebp, 0x8a
xor dl, al
inc dx
mov edx, dword [esp + 0x14]
bt bp, ax
inc bp
mov ebp, dword [esi]
mov dword [esi + 4], edx
clc
rcl edx, 0xb6
mov edx, edi
jmp 0x663d60
jne 0x5f90e6
mov esi, dword [esp + 0x24]
movzx ecx, ax
mov cx, 0x3bb5
mov ecx, esi
call fcn.005d1f22
cmp dword [esp + 0xe0], eax
jmp 0x4c6d1e
mov al, byte [esp + 0xe8]
bts si, sp
dec esi
mov esi, dword [esp + 0xd4]
test al, 0x20
jmp 0x648ac8
jmp 0x64a6b7
test byte [esp + 0xe8], 1
je 0x634bc4
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
movzx edx, si
mov edx, dword [esp + 0x38]
jmp 0x4bb5db
jge 0x64a707
mov eax, edi
add dl, 0x7b
not edx
sub eax, ecx
and cx, 0x2e25
cmp bp, bp
mov ecx, dword [esp + 0x2c]
cdq
xchg edi, edi
xor edi, 0x17c69
sub eax, edx
sar eax, 1
mov dword [ecx], eax
sub cl, 0xb0
ror edi, 0xc4
shrd ecx, ebp, 0x2b
mov edi, dword [esi + 0xd4]
cmp edi, ebp
bswap cx
mov dword [esp + 0x30], edi
xadd cl, cl
cmovno cx, bx
xor ecx, 0x52c13f90
mov ecx, dword [esi + 0xd8]
test eax, edi
cmp ax, ax
cmp ecx, ebx
jmp 0x4cc908
and al, 0x14
jmp 0x667158
fdivp st(7)
mov ecx, eax
sar al, 0xe8
mov eax, dword [esp + 0x38]
sub edi, ecx
btc cx, 0x1a
movzx ecx, bx
rcl ch, 0x51
add edi, eax
jmp 0x446fa9
jne 0x667179
mov edx, dword [esp + 0x20]
test bp, sp
cbw
sbb bp, dx
mov ebp, dword [edx + 0x40]
sal cx, cl
btr ecx, ecx
shl ah, cl
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x20]
adc cx, 0xaeb
mov ecx, dword [eax + 0x6c]
test ebp, esi
test ecx, ecx
jmp 0x5d02ff