joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100548f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0x10066c08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0xf], 0xc3
lea eax, [ebp - 0xf]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xe]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x3493c
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0xe8
mov dword [ebp - 0xc], edx
jmp fcn.101b8c3a

Function at 0x10058810
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jmp fcn.101b9880

Function at 0x10059ca0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x10059ce3
pushal
push eax
xor eax, eax
or eax, dword [ebp - 0xc]
shl eax, 0x10
or eax, 1
mov dword [ebp - 8], eax
pop eax
popal
jmp 0x10059cfb
pushal
push eax
mov eax, 0xc0
shl eax, 8
or eax, dword [ebp - 0xc]
shl eax, 0x10
or eax, 1
mov dword [ebp - 8], eax
pop eax
popal
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10060d08
mov esp, ebp
pop ebp
ret

Function at 0x1005ae10
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064666
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
jmp fcn.101bcb8c

Function at 0x1005c85f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0xc]
jne 0x100a1738
call fcn.10058bf0
push eax
lea esp, [esp + 4]
jmp fcn.10083df3
push edx
lea esp, [esp + 4]
call fcn.10058bf0
pushal
push dword [esp + 4]
lea esp, [esp + 0x24]
jmp fcn.10083df3
jmp 0x1009bfe6

Function at 0x10078d04
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jne 0x1007c094
pushal
lahf
lahf
mov dword [esp], ebx
lea eax, [ebp - 0x104]
pushal
mov word [esp], ax
mov dword [esp + 0x3c], eax
pushfd
lea ecx, [esi - 0x57cf6cbf]
bswap cx
pushfd
mov ecx, dword [ebp + 8]
mov byte [esp], 0x67
lea esp, [esp + 0x44]
call fcn.10057530
bswap ecx
cmp cl, dh
mov ecx, dword [ebp - 0x108]
setns dh
bsr dx, dx
test bh, dh
or ecx, 1
movsx dx, dl
setg dh
mov dword [ebp - 0x108], ecx
pushal
call fcn.100a536e
Function at 0x1007a465
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 8]
movss dword [esp], xmm0
movsx cx, dl
bswap cx
mov ecx, 0x10074918
push edi
mov byte [esp], 0xc6
pushfd
mov byte [esp + 4], ch
lea esp, [esp + 8]
call fcn.100864e4
jmp 0x100836d6
lea ecx, [esi + 0x392225a7]
push 0xe
movsx cx, al
mov ecx, 0x100746ac
jmp 0x1008733a
jmp 0x100a8e5e
pop edx
mov dword [ebp - 0x38], eax
push dword [esp]
push ecx
rdtsc
xchg dl, ah
mov dword [ebp - 0x14], 0
mov byte [esp], 0x3a
rdtsc
movzx ax, dl
jmp 0x100a0c33
pushal
mov word [esp], si
lea esp, [esp + 0x20]
call fcn.10058810
neg dh
shl dl, 2
add edx, 0xa02355bc
and dl, 0x92
add eax, 0x2d4
pushal
movzx edx, dl
jmp 0x1009cd7b

Function at 0x1007a60f
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [ebp + 0x7005725f]
add esp, 4
popal
rcr si, cl
bt esp, 0x19
pop edi
pushal
cmc
mov esi, dword [esp + 0x20]
btr ecx, eax
bt ecx, 0x1e
rcl bh, cl
shld cx, bx, cl
mov ebx, dword [esp + 0x24]
neg ch
bsf ecx, ebx
sets cl
stc
mov ecx, dword [ebp - 4]
jmp fcn.100987df

Function at 0x1007b981
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jo 0x10097449
push 0xde542690
lea esp, [esp + 4]
jne 0x1007c094
bswap cx
lea eax, [ebp - 0x104]
movsx ecx, al
not cl
pushfd
not cx
mov dword [esp], eax
not ch
pushfd
mov ecx, dword [ebp + 8]
jmp loc.100517c3
pushal
push dword [esp + 0x14]
lea esp, [esp + 0x24]
jne 0x1007c094
not eax
pushal
pushfd
lahf
lea eax, [ebp - 0x104]
bswap cx
setle cl
pushal
lea ecx, [edx - 0x5c76f48f]
mov dword [esp + 0x40], eax
movzx cx, dl
pop ecx
mov ecx, dword [ebp + 8]
call fcn.1007f1a0
mov dword [esp], eax
jmp 0x10088d8c

Function at 0x1007bc77
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100a00dd
pushal
call fcn.100adc28
clc
cmp dword [ebp - 0xd8], 0
jp 0x10079ffc
jne 0x1009d02c
cdq
movzx ax, bl
sal ah, cl
bts dx, 1
mov ecx, dword [ebp - 0xb0]
aam 0x68
pushal
add ecx, 0x34
cwde
pop eax
lea edx, [ecx + 0x8f25661]
mov dword [ebp - 0x114], ecx
not ah
mov dx, sp
call fcn.100b208f
clc
cmp dword [ebp - 0xd8], 0
push ebp
pushal
pushal
pushfd
lea esp, [esp + 0x48]
je 0x1008ef9c
jmp 0x1008fdbe
jne 0x1009d02c
ror dx, 2
mov dl, 0xe1
inc dx
movzx cx, al
mov ecx, dword [ebp - 0xb0]
jmp 0x100a2dd8
xadd ah, dl
rol edx, cl
add ecx, 0x34
xchg dh, ah
mov dword [ebp - 0x114], ecx
rdtsc
push esp
xchg al, dl
lea edx, [esp - 0x39e5252b]
mov dword [ebp - 0x34], 0
not dl
mov dword [esp], 4
jmp loc.10051bd0
Function at 0x1007cec9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [edx + ecx + 0x48], 0
cmc
rdtsc
not dx
lea ecx, [edx*8 + 0x337ce58b]
mov eax, 4
push edx
bswap dx
cmc
cmc
imul ecx, eax, 5
cwde
sets al
xchg ah, dh
mov edx, dword [ebp - 0x4c]
cmc
pushfd
rol al, 5
mov dword [edx + ecx + 0x48], 0
rdtsc
mov eax, 4
setnp cl
btr dx, 0xd
imul ecx, eax, 0xb
bswap dx
mov edx, dword [ebp - 0x4c]
pushal
pushfd
mov dword [edx + ecx + 0x48], 0
mov cl, dh
push 0xe1fd0ec1
call fcn.100b1bf9
call fcn.100780b3
stc
cmp eax, 6
pushal
push 0x5b3254df
mov word [esp + 8], ax
lea esp, [esp + 0x48]
je 0x1009ab88
adc cx, 0x2cda
movzx ecx, word [ebp - 0x44]
pushal
bt di, bp
pushfd
cmp ecx, 0x814
push dword [esp + 4]
push dword [esp]
lea esp, [esp + 0x2c]
je 0x1009ab88
cmc
ror dl, cl
mov edx, 4
shr cl, cl
shld eax, edi, cl
xor cl, bh
shl edx, 3
movsx cx, dl
cmp di, 0x96ce
mov eax, dword [ebp - 0x4c]
shr cl, 4
clc
bswap cx
sbb cx, 0xbf42
mov dword [eax + edx + 0x48], 1
not ax
shl eax, cl
bsf cx, si
cdq
mov ecx, 4
lahf
shl ecx, 0
xchg dl, ah
stc
not dl
ror edx, cl
mov edx, dword [ebp - 0x4c]
bswap ax
jmp 0x1007c9da

Function at 0x1007d644
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x20]
movss dword [0x10074aec], xmm0
mov ch, ch
jmp 0x10089e0c
jmp 0x10092df0
pushal
pushfd
lea esp, [esp + 0x28]
movss xmm0, dword [eax + 0x231]
jmp 0x10077b56

Function at 0x1007dead
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x10074c54]
pushfd
pushfd
mov byte [esp + 4], bl
add eax, 0x41743
lea esp, [esp + 0xc]
jae 0x1009509c
push eax
jmp 0x10097d16
jmp fcn.100a7c07
call sub.ntdll.dll_memset
dec ch
dec cl
add esp, 0xc
or cl, bh
neg al
cwde
aaa
lea ecx, [ebp - 0x48]
dec al
adc ah, bl
test bh, 0x37
pushal
mov dword [ebp - 0xe8], ecx
inc cl
xor edx, edx
clc
dec eax
mov dword [ebp - 0x30], edx
daa
daa
test bl, bl
mov eax, dword [ebp - 0xe8]
bswap dx
clc
rcr dl, cl
rcr dh, cl
mov ecx, dword [eax + 4]
sar al, cl
sar dl, cl
rdtsc
mov dword [ebp - 0x108], ecx
aas
mov edx, dword [ebp - 0x108]
lea eax, [ecx + 0x73058042]
mov dword [ebp - 0xf8], edx
add al, 0x8d
mov eax, dword [ebp - 0xf8]
rol dh, cl
ror edx, cl
adc dh, ch
mov dword [esp], ebp
mov dword [ebp - 0x30], eax
rol ax, 3
adc dh, dl
xor ecx, ecx
push ecx
rdtsc
mov dword [ebp - 0x14], ecx
movzx dx, bl
bswap dx
cdq
mov edx, dword [ebp - 0xe8]
setle cl
lahf
movzx ecx, dl
mov eax, dword [edx]
pushal
mov byte [esp + 4], 0x91
lea esp, [esp + 0x44]
ja 0x100819f9
bswap ecx
mov dword [ebp - 0x104], eax
bswap cx
mov ecx, dword [ebp - 0x104]
push esi
lea esp, [esp + 4]
jmp loc.1005b941

Function at 0x1007eeca
Capabilities:
Access peb ldr_data

Disassembly:
pushal
mov dword fs:[0], ecx
rcr cx, 0xd
pushfd
shr cl, 6
mov ecx, dword [esp + 0x30]
bt edx, ebx
mov ecx, dword [ebp - 0x10]
push dword [esp + 0xc]
push ebx
pushfd
test bl, 0x70
xor ecx, ebp
pushfd
mov byte [esp + 4], dh
lea esp, [esp + 0x44]
call fcn.10060d08
push 0x432599d6
push edi
call fcn.1007e10e
Function at 0x1007f379
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], 4
jmp 0x1008974b
pushfd
lea esp, [esp + 8]
addss xmm0, dword [0x10066c1c]
pushfd
pushal
lea esp, [esp + 0x24]
movss dword [ebp - 0x16c], xmm0
lahf
lahf
aas
mov ecx, dword [ebp - 0x54]
shl dh, 6
das
add ecx, 0x90
movzx ax, dl
pushal
cdq
rdtsc
mov dword [ebp - 0x150], ecx
cwde
mov dword [ebp - 0x14], 0
lea edx, [eax + 0x2907067d]
jmp 0x10078418
rdtsc
call fcn.100853ac

Function at 0x10081b0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.10099ff5
movzx ax, bl
mov byte [esp + 4], 0x6f
lea eax, [ebp + 0x3c]
bswap cx
movsx cx, cl
call fcn.100984be

Function at 0x10081b2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
call fcn.1003bcd0
cwde
add esp, 0xc
setnp ah
movsx cx, cl
movsx ax, al
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + 0x4fabeb3]
rdtsc
pushfd
mov dword [ebp - 0xf4], ecx
not dh
not ecx
mov edx, dword [ebp - 0xf4]
pop eax
movsx ax, bl
mov al, bl
mov dword [ebp - 0xe8], edx
bswap edx
mov eax, dword [ebp - 0xe8]
push eax
mov dword [ebp - 0x28], eax
cdq
mov ecx, dword [ebp - 0x28]
pushal
pushal
rdtsc
lea edx, [edx*4 + 0x3981f9f2]
mov dword [ebp - 0xcc], ecx
pop eax
movzx eax, al
rdtsc
mov dword [esp + 0x3c], 4
pop edx
cwde
lea edx, [ebp - 0x104]
pushfd
movzx eax, cl
jmp 0x1008da94

Function at 0x10083db9
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ecx, ecx
mov word [esp], 0xa06e
push 0x94cc2a28
lea esp, [esp + 8]
je fcn.10083df3
mov ch, dh
lea edx, [ebp - 0x90]
mov ch, 0xf9
mov ch, 0xe7
push edx
setbe cl
lea ecx, [ebp - 0x28]
pushal
push dword [esp + 4]
lea esp, [esp + 0x24]
call fcn.10058bf0

Function at 0x100857e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword fs:[0], ecx
sub ch, 0x3e
xor cl, bh
bt ebx, 0x17
add cx, sp
mov ecx, dword [esp + 0x2c]
bts ecx, ebx
mov ecx, dword [ebp - 0x10]
cmc
xor ecx, ebp
mov byte [esp + 0x14], 0x66
jmp 0x100ac72d
Function at 0x10088fff
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc ah, dl
mov eax, dword [ebp - 0xf8]
movsx dx, al
movzx dx, bl
mov dword [ebp - 0x30], eax
btc dx, 0xb
lahf
xor ecx, ecx
lea edx, [edx*8 - 0x517a3aa]
mov dx, 0x38ee
mov dword [ebp - 0x14], ecx
pushfd
movsx ax, dl
movzx dx, al
rdtsc
mov edx, dword [ebp - 0xe8]
lea eax, [esi + 0x38b568bc]
movzx ax, bl
movzx cx, al
pushfd
mov eax, dword [edx]
push 0xa790a410
mov dword [ebp - 0x104], eax
call fcn.100a5007
pushfd
mov byte [esp], 0x5e
call fcn.100a0b4a
mov dword fs:[0], eax
test cl, 0x82
jmp 0x1008ca8a
pushal
pushfd
lea esp, [esp + 0x24]
call fcn.1003ebd0
jmp 0x10081876
bswap cx
mov byte [ebp - 4], 0xe
mov ch, 0xd5
movzx cx, dl
lea ecx, [esp - 0x1974e2bb]
bswap cx
lea ecx, [ebp - 0x43c]
call fcn.100b18b9
mov ecx, 0x10074918
jmp 0x100a0b64
push dword [esp]
lea esp, [esp + 0x44]
call fcn.1003bd30
sbb ecx, 0xa9e787d0
aaa
add esp, 0xc
rdtsc
shld dx, si, cl
mov byte [ebp - 0x1e], 0xeb
rol edx, 4
lahf
or dl, 0xe7
lea ecx, [ebp - 0x1e]
aad 0xb9
mov dword [ebp - 0x38], ecx
adc ax, bx
pushal
lea edx, [ebp - 0x1d]
bt bx, 0xa
mov byte [esp], ch
mov dword [ebp - 0x34], edx
sub dh, dh
aas
mov eax, dword [ebp - 0x30]
rcr cx, 0xc
add eax, 0x97
neg dx
jmp 0x100a5b56
cmp ax, 0xdaba
push 0xc2725125
mov dword [ebp - 4], 0
test al, 0xb3
jmp 0x1008d4bb
bt di, bx
mov dword [ebp - 0x24], ecx
lea esp, [esp + 0x20]
jle 0x10089914
mov dword [ebp - 4], 0
test dh, 0x30
cmc
cmp dword [ebp + 0x1c], 0x10
call fcn.100a3d40
push edx
movzx ecx, al
jmp 0x1009ffc4
cmp dword [ebp + 0x1c], 0x10
push 0x97bbdfa8
pushal
call fcn.10087072
movsx ax, dl
mov dword [ebp - 0x9c], edx
cdq
mov eax, dword [ebp - 0x204]
push 0x379191c3
jmp 0x1009eb45
movzx cx, al
bswap ecx
lea ecx, [ebp - 0xe8]
jmp 0x1007ed5d
call fcn.100889ba
mov dword [ebp - 8], eax
cdq
mov ecx, dword [ebp - 8]
rdtsc
call fcn.1007aa39
lea esp, [esp + 4]
call sub.ntdll.dll_memset
dec ax
add esp, 0xc
lea ecx, [edx + 0x2899d7e6]
daa
bsr eax, esp
lea ecx, [ebp - 0x48]
adc al, 0x55
bts ax, 1
sbb ah, 0xc0
mov dword [ebp - 0xe8], ecx
bts cx, 0xc
xadd ax, cx
xor edx, edx
bswap eax
and cx, 0xb3e
mov dword [ebp - 0x30], edx
cmp bh, 0x33
btc ax, si
mov eax, dword [ebp - 0xe8]
xadd cx, dx
neg ecx
movzx edx, dl
mov ecx, dword [eax + 4]
clc
mov dword [ebp - 0x108], ecx
shl dh, 1
mov edx, dword [ebp - 0x108]
sal eax, cl
bts ax, bx
rcl ah, 1
mov dword [ebp - 0xf8], edx
jmp 0x10077ed7

Function at 0x10089e11
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0x60]
push dword [esp + 0xc]
setge ch
mov ecx, 0xbc187b8f
push 0xac33c89a
mov dword [ebp - 0x94], eax
bswap dx
mov ecx, dword [ebp - 0x7c]
setae dh
lea eax, [esi*2 - 0x1614d2d0]
mov dword [esp + 0x48], ecx
rdtsc
mov edx, dword [ebp - 0x94]
lea esp, [esp + 0x48]
jb 0x100a0272
push edx
pushal
movsx ax, bl
lahf
pop eax
mov eax, dword [ebp - 0x84]
push dword [esp]
mov word [esp + 8], ax
mov dword [esp + 0x1c], eax
jmp fcn.100522e7
push ebx
call fcn.10050895
Function at 0x1008a92f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10092d9b
lea esp, [esp + 0x34]
jne 0x100b0801
pushal
mov byte [esp], bh
mov dword [ebp - 0x250], 0
mov word [esp + 8], sp
mov word [esp], 0x58bd
pushfd
push 0x79e027bc
lea esp, [esp + 0x28]
jmp 0x10097c42
rcl dl, cl
mov edx, dword [ebp - 0x20c]
cmp esp, esp
dec al
movzx ax, cl
mov dword [ebp - 0x1e8], edx
daa
push eax
lea eax, [eax + 0x33f20137]
shld cx, dx, cl
mov eax, dword [ebp - 0x1e8]
jmp 0x100a3d53

Function at 0x1008bc29
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx*4 + 0x3472dd07]
movsx cx, bl
lea edx, [ebp - 0x90]
pushfd
pop ecx
movsx cx, cl
mov dword [esp], edx
movzx cx, bl
lea ecx, [ebp - 0x28]
push 0x8e9e17ec
pushfd
lea esp, [esp + 8]
call fcn.10058bf0
push eax
pushal
lea esp, [esp + 0x24]
jmp fcn.10083df3

Function at 0x1008c9fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
movzx ax, bl
mov dword [ebp - 0x68], 0
mov al, byte [esp]
jmp 0x100aa330
sal ax, 0xf
cmc
push edx
or al, ah
sbb eax, 0x1525ab72
bswap eax
mov eax, dword [ebp - 0x180]
clc
call fcn.1005b77b
lea esp, [esp + 0x20]
call fcn.1003bcd0
aaa
cwde
aas
rcr al, 7
add esp, 0xc
aad 0x93
sar cl, 6
mov ecx, dword [ebp - 0x68]
cdq
add edx, esp
shl ah, cl
mov dword [ebp - 0x180], ecx
rcr ah, 5
rcl ax, cl
mov dword [ebp - 0x70], 0
cwde
cmc
btr dx, si
aad 0x8e
push 4
shld ax, si, cl
stc
lea edx, [ebp - 0x70]
jmp 0x1008f05f
rdtsc
mov dword [esp], 4
cdq
lahf
cwde
lea edx, [ebp - 0x68]
pushfd
cwde
lea eax, [ebp*2 + 0x33c4bae4]
pushfd
mov dword [esp + 4], edx
pushfd
cwde
pop eax
cwde
mov eax, dword [ebp - 0x178]
pushal
mov dword [esp + 0x20], eax
jmp 0x100a3191

Function at 0x10090129
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x20], ecx
pushfd
push esp
mov byte [esp + 4], ch
push dword [esp]
lea esp, [esp + 0x2c]
call fcn.1003bcd0
call fcn.100aad22
lea esp, [esp + 8]
movss xmm0, dword [ebp - 0x20]
pushfd
push esi
lea esp, [esp + 8]
movss dword [0x10074bfc], xmm0
neg ch
btc ecx, 0x13
not cl
add ax, 0x8c94
mov dword [ebp - 8], 0
cmc
aad 0x61
push 4
bt di, bx
rcl ch, 1
push 0x14b6df4
lea eax, [ebp*4 - 0x5bddf5ff]
lea eax, [ebp - 8]
bt cx, 5
mov dword [esp], eax
adc ch, ch
bt si, 0xa
mov ecx, dword [ebp - 0x38]
clc
bt ebx, edx
pushal
add ecx, 8
pushfd
mov word [esp + 0x14], 0x96ca
jmp 0x10087ea3

Function at 0x10090945
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edx - 0x384d2f25]
jmp 0x1008d4ca

Function at 0x10092e8f
Capabilities:
Access peb ldr_data

Disassembly:
mov dword fs:[0], ecx
pushal
mov ecx, edi
setae ch
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x14], bh
mov word [esp + 0xc], 0xb7bd
pushfd
pushfd
lea esp, [esp + 0x30]
jmp fcn.100ad509
Function at 0x10094d5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x82079add
lea esp, [esp + 0x28]
call fcn.10058810
push 0x9d49ff50
sub dx, 0xf8a8
clc
dec edx
add eax, 0x2d4
pushfd
mov dword [ebp - 0x38], eax
not dx
lea eax, [edx*4 - 0x71c86ff8]
cwde
mov dword [ebp - 0x14], 0
pushal
lea eax, [edx*2 + 0x1ff0849d]
cdq
cwde
mov dword [esp + 0x24], 4
jmp 0x1007dd6e
rdtsc
rdtsc
lea edx, [ebp - 0x14]
lea eax, [0xd0c59401]
pop eax
pop eax
movsx eax, dl
mov dword [esp + 0x18], edx
pushfd
cwde
cwde
mov eax, dword [ebp - 0x38]
pushfd
pushfd
push esp
mov dword [esp + 0x24], eax
pushal
push ecx
lea esp, [esp + 0x48]
call fcn.1003bcd0
push 0x52135d13
add esp, 0x10
call fcn.100852cf
mov word [esp], di
jmp 0x10078436

Function at 0x10095ca9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ebp - 0x28]
pushal
lea esp, [esp + 0x44]
call fcn.10058bf0
Function at 0x100976de
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push eax
pushal
lea esp, [esp + 0x44]
movss xmm0, dword [ebp + 8]
pushal
pushfd
pushal
lea esp, [esp + 0x44]
ucomiss xmm0, dword [0x10066c44]
call fcn.100918c5
movsx edx, al
jmp 0x100972b7
not dx
movsx ax, dl
mov edx, dword [ebp - 0x18]
bswap eax
bswap ax
lea ecx, [ebp*2 + 0x169a8497]
xchg cx, ax
mov dword [ebp - 0x58], edx
setl al
movzx ax, bl
movsx ax, bl
mov dword [ebp - 0x1c], 0
xchg ch, ah
push 4
movsx ax, bl
jmp 0x10087401
call fcn.100a1361
bswap cx
setb cl
lea eax, [ebp - 0x1c]
bswap cx
mov ch, ah
bswap ecx
lea ecx, [eax*2 + 0x2389540e]
push eax
lea ecx, [edi - 0x29d572ac]
lea ecx, [edx*8 - 0x3f6d351f]
movsx cx, al
mov ecx, dword [ebp - 0x50]
jmp 0x1008f0bd
bswap ecx
call fcn.100ab088
jmp 0x10079d2d
pushal
mov dword [esp + 4], 0x23ec14ca
jmp 0x100aacd7
jo 0x100af316
lahf
mov ecx, dword [ebp - 0x14]
lea edx, [ecx*8 + 0x64bd839c]
mov dword [ebp - 8], ecx
pushal
rdtsc
not edx
mov edx, dword [ebp - 8]
lahf
pop ecx
pop eax
movzx cx, dl
mov dword [ebp - 0x10], edx
push edi
pushfd
mov dword [esp + 0x1c], 1
cwde
cwde
lea eax, [ebp - 9]
pushfd
lea ecx, [eax + 0x7a9e79a8]
lea ecx, [ebp + 0x22bab800]
jmp 0x10076551
lea esp, [esp + 0x34]
call fcn.10058810
stc
shr ch, 5
add eax, 0x50
pushfd
movsx dx, al
mov dword [ebp - 0x18], eax
mov al, 0x74
cdq
mov eax, dword [ebp - 0x18]
pop ecx
push esi
not cl
mov dword [ebp - 0x14], eax
lea esp, [esp + 4]
jne 0x100792e9
not ch
lahf
lahf
mov ecx, dword [ebp - 0x14]
ja 0x100adad5
pushal
movsx edx, bl
cdq
mov dword [ebp - 8], ecx
mov byte [esp], 0xff
pushfd
pushfd
not dx
mov edx, dword [ebp - 8]
mov al, 0xb1
bswap cx
cwde
cwde
mov dword [ebp - 0x10], edx
bswap cx
pushfd
mov byte [esp + 0x14], 0x46
mov dword [esp + 0x28], 1
cwde
movzx cx, al
lea eax, [ebp - 9]
jmp 0x1008a532
rcr ch, 2
setns cl
mov ecx, dword [ebp - 0x50]
clc
cmc
push esp
add ecx, 1
mov byte [esp], cl
mov dword [ebp - 0x50], ecx
lea esp, [esp + 4]
call fcn.1008a803
mov dword [esp + 0x1c], ecx
call fcn.1007d80f
jbe 0x100b17ab
jmp 0x100b2f4c
movsx ax, bl
lea edx, [0x1e273ad5]
mov dword [ebp - 8], ecx
rdtsc
xchg dx, cx
mov edx, dword [ebp - 8]
push ecx
lea ecx, [esp + 0x176a7db9]
xchg cl, ah
setge al
mov dword [ebp - 0x10], edx
sete ah
mov byte [esp], 0x95
mov dword [esp], 1
push 0xdb52a87
lea eax, [ebp - 9]
lea ecx, [esi*8 - 0x35995cfb]
call fcn.1008fa9c
xchg dl, ah
lahf
lahf
movzx dx, bl
mov ecx, dword [ebp - 0x14]
mov dl, 0xd4
lahf
bswap ax
lahf
mov dword [ebp - 8], ecx
jmp 0x10083754
jbe 0x10051ac4
pushfd
call fcn.1008ac13
lea esp, [esp + 4]
je 0x100a100e
movzx ecx, cl
setle cl
lea ecx, [edi*4 + 0x577bf5d7]
mov ecx, 0x10074918
call fcn.1009d076
pushal
pushfd
pushfd
mov dword [ebp - 0x4c], eax
push edi
mov word [esp], di
mov byte [esp], 0xae
lea esp, [esp + 0x2c]
jmp 0x100a9d38

Function at 0x1009c300
Capabilities:
Execute anti-debugging instructions

Disassembly:
cdq
add ecx, 0xc
cwde
lea eax, [0x7e28366b]
xchg dl, al
mov dword [ebp - 0x178], ecx
lahf
setp ah
pushal
lea eax, [esi - 0x2e20b88f]
mov dword [ebp - 0x68], 0
lahf
mov dword [esp + 0x20], 4
pop eax
lea edx, [ebp - 0x68]
jmp 0x100af7ec
movzx ax, dl
jmp 0x10077285
Function at 0x1009d126
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x6ea18013
lea esp, [esp + 0x2c]
je 0x10095de8
call fcn.10038f80
sbb eax, 0xe12f0369
aad 0xa1
test al, 0x1d
mov eax, dword [ebp - 0x28]
sub cx, si
cmp bh, 0xc6
mov ecx, dword [eax + 0x254]
shld ax, si, 0xb
lahf
add ecx, 0xa4
cdq
pushfd
mov dword [ebp - 0x54], ecx
xchg dh, al
lea edx, [edx*4 + 0x49cb6ac]
pushal
mov dword [ebp - 0x24], 0
lahf
rdtsc
movzx dx, dl
mov dword [esp + 0x20], 4
pushfd
pushal
lea edx, [ebp - 0x24]
cwde
push 0x57134a77
pop eax
not ax
mov dword [esp + 0x40], edx
mov al, byte [esp]
mov eax, dword [ebp - 0x54]
pushfd
mov dword [esp + 0x40], eax
mov byte [esp], 0xcf
pushfd
lea esp, [esp + 0x44]
jmp 0x100abb39
mov dword [esp + 0x28], 0
movzx ecx, al
movsx cx, cl
lea ecx, [edi*8 - 0x6ce6d696]
pushfd
mov dword [esp + 0x28], 1
sets cl
sete ch
mov ecx, dword [ebp - 0x34]
jmp 0x1008127b

Function at 0x1009d674
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x264], 1
pushal
lea esp, [esp + 0x28]
jmp 0x100a2f27

Function at 0x1009f539
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
seto al
mov dword [ebp - 0xb4], ecx
lea esp, [esp + 4]
jg 0x1009f765
lea edx, [eax - 0x3b5c64ef]
movzx dx, dl
push esi
mov dword [ebp - 0xb0], ecx
movzx ax, cl
mov dword [ebp - 0xac], ecx
call fcn.1005242d

Function at 0x100a54bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x3c]
call fcn.1003bcd0
bswap ax
add esp, 0xc
rdtsc
rdtsc
setge ah
mov eax, dword [ebp - 0x1c]
setge cl
xchg dh, cl
call fcn.1007b8de

Function at 0x100a6cbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
pushal
mov dword fs:[0], ecx
movzx ecx, al
setae cl
mov ecx, dword [esp + 0x28]
call fcn.100b198f

Function at 0x100a6cd9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x6a
lea esp, [esp + 0x28]
je 0x10095cb6
call fcn.1008bc29

Function at 0x100a79af
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0xc], 0
lea eax, [eax*8 + 0x42012d7c]
push edi
mov dword [esp + 4], 4
lea eax, [esp + 0x252a56e1]
movzx dx, bl
rdtsc
lea edx, [ebp - 0xc]
pop eax
movzx eax, dl
not ah
lahf
push edx
movsx eax, bl
lea eax, [ebp - 0x27deb99a]
not ax
push edx
mov eax, dword [ebp - 0x28]
pushfd
jmp loc.1005c26b

Function at 0x100a8908
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xfd
lea esp, [esp + 4]
addss xmm0, dword [ebp - 0xc8]
push 0xc08510f0
pushal
push eax
lea esp, [esp + 0x28]
movss dword [ebp - 0xf0], xmm0
shr ah, cl
or cl, dl
clc
mov ecx, dword [ebp - 0x58]
stc
add dl, 0x41
mov dl, 0x79
add ecx, 0x90
bswap ax
not ax
rdtsc
cwde
mov dword [ebp - 0xd0], ecx
rdtsc
mov dword [ebp - 0x14], 0
rdtsc
je 0x100ae1ec
lahf
pushfd
mov dword [esp], 4
xchg dl, ah
lea edx, [ebp - 0x14]
mov ah, cl
push edx
lahf
not al
mov eax, dword [ebp - 0xd0]
pushal
push dword [esp + 4]
mov dword [esp + 0x20], eax
pushal
jmp 0x100b11e6
push 0xc09f7f07
lea esp, [esp + 0x44]
call fcn.1003bcd0
not ch
ror ch, cl
or ecx, ebx
add esp, 0xc
call fcn.1007970b