joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c8b
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
sub esp, 0x24
mov eax, dword [eax + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x18], ecx
cmp ecx, esi
je 0x404d21
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x404d21
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
sub ecx, 4
mov edx, 0xe3835661
dec edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ecx
mov ebx, dword [ecx]
add ebx, esi
mov dl, byte [ebx]
inc ebx
mov byte [ebp - 1], dl
test dl, dl
je 0x404d1d
mov esi, dword [ebp - 8]
mov al, dl
movsx edx, al
sub al, 0x41
mov ecx, edx
or ecx, 0x20
cmp al, 0x19
mov al, byte [ebx]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
inc ebx
test al, al
jne 0x404cea
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], esi
cmp dword [ebp - 8], 0x5ff89c53
mov esi, dword [ebp - 0x10]
je 0x404d28
mov ecx, dword [ebp - 0x14]
test edi, edi
jne 0x404cc8
mov eax, dword [eax]
jmp 0x404ca0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
call eax
push 0x7d0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push ebx
call fcn.0048e32b
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x404de3
mov edi, dword [eax + 0x18]
test edi, edi
je 0x404de3
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, esi
sub eax, 4
mov edx, 0xf4ea3721
dec edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], eax
mov ebx, dword [eax]
add ebx, esi
mov dl, byte [ebx]
inc ebx
mov byte [ebp - 1], dl
test dl, dl
je 0x404ddf
mov esi, dword [ebp - 8]
mov cl, dl
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
mov cl, byte [ebx]
cmova eax, edx
xor eax, esi
imul esi, eax, 0x1000193
inc ebx
test cl, cl
jne 0x404daa
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], esi
cmp dword [ebp - 8], 0xec51513
mov esi, dword [ebp - 0x18]
je 0x404dea
mov eax, dword [ebp - 0x14]
test edi, edi
jne 0x404d88
mov ecx, dword [ecx]
jmp 0x404d60
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
call eax
add eax, 0xfffff8f8
adc edx, 0xffffffff
cmp edx, dword [ebp - 0x1c]
ja 0x404e1c
jb 0x404e18
cmp eax, dword [ebp - 0x20]
jae 0x404e1c
xor al, al
jmp 0x404e1e
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40dfb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push esi
call fcn.00415b2f
test eax, eax
je 0x40dfbd
push esi
mov ebx, 0x811c9dc5
xor edi, edi
call fcn.004206a8
xor edx, edx
mov dword [ebp - 4], 0xa
pop ecx
mov ecx, eax
div dword [ebp - 4]
inc eax
test ecx, ecx
je 0x40dfb4
mov edx, ecx
movzx ecx, word [esi + edi*2]
add edi, eax
imul ebx, ebx, 0x1000193
xor ebx, ecx
cmp edi, edx
jb 0x40dfa2
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
call fcn.00405f59
int3

Function at 0x432490
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4324bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4324bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x450949
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4e86f6
push ebp
mov byte [esp], al
nop
pushal
jmp 0x4556f0

Function at 0x455ae2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call fcn.00450ca0
pushfd
movsx dx, cl
lea edx, [ebp - 0xd0]
push ecx
pushfd
pushfd
lea esp, [esp + 0x10]
jmp fcn.004cef42

Function at 0x458015
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x50]
call fcn.00459a35
jmp 0x4b3e34
inc edi
jmp 0x4c40a5

Function at 0x4587b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edx - 0x32f89891]
mov edi, eax
push edi
pushal
mov byte [esp + 4], 0xfe
lea esp, [esp + 0x28]
jmp 0x4a4dac

Function at 0x4590f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x4c8cac
je 0x4820fa
push eax
push edx
pushal
inc ecx
push dword [esp + 8]
pushfd
add edx, 8
mov byte [esp + 4], dh
cmp ecx, eax
pushfd
lea esp, [esp + 0x34]
jne 0x47a1c9
push 0xe0a6f6c7
push ecx
lea esp, [esp + 8]
jl 0x48d80b
call fcn.004beafd
mov dword [esp + 4], ecx
pushfd
lea ecx, [ebp + 0x5c458777]
lea ecx, [ebx - 0x6c17aa11]
mov ecx, 0x42991f
pushfd
mov byte [esp], ah
jmp 0x4a7b8b
jmp 0x4bbfcb
inc ecx
stc
add edx, 8
cmc
bt di, ax
cmp dl, cl
cmp ecx, eax
call fcn.004b2509
Function at 0x474680
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push dword [esp]
mov dword [esp + 0x20], edi
call fcn.0044df80
stc
sub ebp, 2
pushal
call fcn.0044ebb0
mov dword [esp + 0x40], ecx
lea esp, [esp + 0x40]
jl 0x4e368a
pushfd
push dword [esp]
push dword [esp + 4]
mov dword [esp + 8], edx
pushal
jmp 0x4bee65
pushal
mov ebx, dword [ebx + 0xb65b6]
mov byte [esp + 8], bl
lea ebx, [ebx + 0x5cb680b9]
pushal
xchg dword [esp + 0x40], ebx
push edx
push dword [esp + 0x44]
ret 0x48
mov dword [esp + 0x24], eax
pushfd
mov dword [esp + 0x24], 0x4ea6b4
call fcn.004ef7c2
pushal
jmp 0x4df0c6
mov byte [esp], bl
mov dword [esp + 0x1c], 0x55dcc705
pushal
mov word [esp], 0x37ab
mov dword [esp + 0x38], 0xb759e498
mov byte [esp], 0
push 0xb729b04a
push dword [esp]
lea esp, [esp + 0x40]
jmp 0x44ff64
pushfd
call fcn.004c9bb9
lea esp, [esp + 0x20]
jns 0x4976b5
pushfd
mov ebx, dword [ebx + 0xb65b6]
call fcn.00482ebe
jmp 0x4d1571

Function at 0x474da4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edi*4 - 0x259abe3b]
mov dword [esp + 4], ecx
bswap dx
mov dword [esp], eax
not dl
lea edx, [0xb3752654]
pushal
jmp 0x48578e
lea edx, [ebp - 0xd0]
pushal
jmp 0x4f33e1
push ebx
lea esp, [esp + 0x44]
call fcn.00450ca0
pushal
bswap dx
lea edx, [ebp - 0xd0]
pushal
push dword [esp]
pushfd
lea esp, [esp + 0x48]
jmp fcn.004cef42

Function at 0x475f92
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp + 8], 0
jmp 0x48dd45
test ch, 0x3e
stc
cmp al, bl
push ebp
dec bp
mov ebp, esp
cmp dh, bh
stc
sub esp, 8
jmp 0x45249b
jne 0x4a0b3c
pushfd
mov byte [esp], bl
mov dword [esp], 0
pushal
jmp 0x4a0b2d

Function at 0x47b930
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], dl
jmp 0x47a1ce

Function at 0x47bae5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jbe 0x4ba7cf
pushal
mov dword [esp + 0x1c], 1
push dword [esp + 4]
pushal
mov dword [esp + 0x3c], esi
push 0xc703921
lea esp, [esp + 0x40]
call fcn.004b6c2c
pushal
mov dword [esp + 4], 0x5399f81c
mov edi, eax
pushfd
mov byte [esp + 8], ch
push 0xa27b417d
lea esp, [esp + 0x28]
jmp 0x4a4dac
call 0x4e7f3c

Function at 0x488e4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x4b50e1
pushfd
mov eax, 0x465fc4
push 0xdc6852e2
not dl
movzx ecx, byte [edi + ebx]
mov byte [esp], ah
movsx dx, al
lea edx, [ebx*4 + 0x545a9eb]
movzx dx, al
mov dword [esp + 4], ecx
mov byte [esp], 0x81
mov edx, dword [esp]
jmp 0x4e537c
mov dword [esp], eax
jo 0x4a7ba1
mov dl, cl
lea edx, [ebp - 0xd0]
pushal
lea esp, [esp + 0x20]
call fcn.00450ca0
pushal
pushal
movsx dx, cl
lea edx, [ebp - 0xd0]
pushfd
push 0x7aec9941
pushfd
pushfd
lea esp, [esp + 0x50]
jmp fcn.004cef42

Function at 0x48bebe
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x48e7c0
pushal
pushal
mov dword [esp + 0x3c], 0
push dword [esp]
mov byte [esp + 8], dh
push dword [esp]
lea esp, [esp + 0x44]
call fcn.004c7b62
call fcn.0048e7b7
movsx ax, cl
cwde
clc
mov eax, dword [ebp + 8]
pushal
call fcn.004b1bbf
Function at 0x48e7b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ch
mov dword [ebp + 8], eax
add esp, 4

Function at 0x48e7cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x44]
call fcn.00459a35
aam 0xd
add esp, 0x20
bsf ax, sp
mov eax, edi
cmp ah, 0x42
stc
clc
test bl, bh
and eax, 0xf
cmc
bt dx, sp
cmp al, 0xf
movsx ax, al
mov eax, 0x465fb8
push 0x3802241a
lea esp, [esp + 4]
je 0x4b50e1
movsx ecx, cl
xchg dx, ax
mov eax, 0x465fc4
movsx cx, al
pushal
bswap cx
movzx ecx, byte [edi + ebx]
mov byte [esp + 4], bl
not dl
pushal
mov dword [esp + 0x3c], ecx
setg dh
push 0x28aba601
movsx dx, bl
mov dword [esp + 0x3c], eax
bswap dx
pop edx
pushfd
bswap edx
lea edx, [ebp - 0xd0]
push 0x72c399d6
mov word [esp + 0x14], 0x8028
lea esp, [esp + 0x40]
call fcn.00450ca0
lea edx, [ecx*8 - 0x4ac232e5]
not dl
movzx dx, bl
lea edx, [ebp - 0xd0]
pushal
mov byte [esp], 3
lea esp, [esp + 0x20]
jmp fcn.004cef42

Function at 0x48eca8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0x4923c4
pushal
pushfd
pushal
call fcn.004b9d6b

Function at 0x48ecba
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea eax, [eax + 1]
pushfd
mov dword [esp + 0x2c], eax
jmp 0x4a7b90
mov dword [esp + 4], eax
pop eax
cwde
cwde
mov eax, dword [esp + 4]
pushfd
jmp 0x48cf87

Function at 0x48eda4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
push edx
lea esp, [esp + 0x30]
call fcn.004ec3b0
not bp
mov edi, 0x34b9f709
pop edi
call fcn.0048e24c
Function at 0x48edc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov word [esp], di
push dword [esp]
lea esp, [esp + 0x14]
je 0x4b50e1
not cx
jnp 0x4d9d70
mov eax, 0x465fc4
not dx
movzx ecx, byte [edi + ebx]
movzx dx, al
movsx edx, bl
bswap dx
push esp
mov dword [esp], ecx
pushfd
pop edx
push eax
movzx dx, cl
setge dl
lea edx, [esi - 0x2fab7f50]
lea edx, [ebp - 0xd0]
call fcn.00455ae2
push 0xa5ded2b1
mov eax, 0x465fc4
seto ch
push ebx
movzx ecx, byte [edi + ebx]
movsx dx, dl
pop edx
call fcn.00474da4
mov ecx, 0xbab039a7
int1
call 0x5de69e0d
neg cl
or dword [edx + 0x5b], edi
fstp xword [ebp + 0x519e1e38]
mov ebx, 0xaef7e708
test byte [ebx + 0x2e5c18ae], bh
push ss
movsb byte es:[edi], byte [esi]
fadd st(7), st(0)
mov edx, 0x1a9fc8d5
mov eax, dword [0x440f75b1]
lahf
xor dword [edx], ebx
jb 0x4d9e1f
mov dword [0xb7c6638c], eax
out dx, eax
cmp byte [edi], ah
popal
inc esi
mov dl, 0x99
jns 0x4d9d9c
wait
sti
pop ebp
inc ebp
mov byte [0xe3d6a183], al
jb 0x4d9e44
xor edx, dword [eax - 0x1e]
invalid
sbb dh, byte [edx*2 + 0x3381ef2d]
dec ecx
push esi
sbb al, 6
out dx, eax
xor dword [ebx], 0x61c5649
cmp ah, byte [ebp + eax + 0x2f]
inc eax
dec ebx
das
push ebp
jmp 0x45f1b549
movsb byte es:[edi], byte [esi]
inc ebp
mov ebx, 0x7c08e8f1
sub bh, ah
pop edi
rol byte [edx + 0xa26e1c1], 1
stc
dec edi
pop ss
ja 0x4d9e0d
ret 0x71a
jge 0x4d9ebf
sub eax, 0x6e3d98fc
jae 0x4d9e80
invalid
lahf
add dword [esi], ecx
lodsb al, byte [esi]
leave
popfd
push 0xf6e1579d
mov esp, 0x52f75dcf
test al, 0x51
out dx, eax
arpl word [eax], dx
or dword [edi - 0x2b], 0x7f945567
adc byte [ecx], 0xc9
dec edi
aad 0x67
push ebp
xchg esp, eax
jg 0x4d9e09
adc ecx, ecx
pop eax
int1
inc edi
mul ebp
popfd
sbb dword [edi], esi
push esp
sti
inc ecx
sub dword [edx + ebx*2], ebx
mov bl, 0x96
mov bh, byte [ebx - 0x2b9f08b]
sbb byte [eax], cl
cmp ebp, dword [eax - 0xead7827]
inc esi
xor eax, 0x1a8a1e4e
push ds
mov bl, byte [edx]
jle 0x4d9e6a
push ecx
cmpsd dword [esi], dword es:[edi]
invalid
cmovbe edx, dword [ebx]
js 0x4d9e8e
imul edi, dword [edi - 0x43ae8c5c], 0x5a41c916
jae 0x4d9f12
mov esp, 0x5a41c916
iretd
stc
mov dword [ebx - 0x3f], eax
jg 0x4d9ede
cld
fiadd dword [ebx + 0xe390630]
aaa
sbb al, 0x93
sbb eax, 0xca6ad17b
sub al, 0xf
test dword [eax - 0x6d], ebp
and byte [edx - 0x1cabbb9b], al
stosb byte es:[edi], al
mov dl, 8
cmp eax, 0xffffff8c
cwde
cmp al, 0x88
fimul word [ebx + 0x36775c4c]
jnp 0x4d9eb7
mov dword [ebx + ecx + 0x6d], edx
enter 0x3f5a, 0x49
jp 0x4d9ed7
sahf
cmpsb byte [esi], byte es:[edi]
adc ah, byte cs:[0x78f1cb41]
popal
scasb al, byte es:[edi]
shr byte [ebp - 0x50de87a1], 1
jne 0x4d9eab
mov ah, 0x47
fidiv word [0xa31850bf]
mov edx, 0x410c2318
and dword [eax], edi
push cs
pop esi
Function at 0x495507
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd cl, bl
xchg edx, ecx
jmp 0x48a892
mov word [esp + 4], ax
call fcn.004afdf3
mov ecx, dword [eax + 8]
shl edx, cl
xadd dx, bx
mov edx, dword [eax]
bsr bx, bx
sal bh, cl
bsr bx, ax
mov ebx, dword [eax + 4]
jmp 0x4a1660
mov edx, dword [ebp + 0x14]
pushal
setle bh
pushal
not bh
mov dword [esp + 0x3c], edx
pushfd
setge bl
mov dword [esp + 0x3c], ecx
pushfd
lea ebx, [esp - 0x7c8e3614]
mov ebx, eax
jmp 0x4cc359
lea esp, [esp + 8]
je 0x47f8ef
xchg dx, bx
movsx dx, bl
jmp 0x48fd7f
pushal
push edx
call fcn.004d7e27
lea esp, [esp + 0x48]
call fcn.00459746
mov si, 0x8bfb
pushfd
push esi
movzx si, al
mov dword [esp + 4], ebx
not si
call fcn.00498649
cmp ecx, dword [ebp + 8]
push edx
push edi
lea esp, [esp + 8]
je 0x487a59
pushfd
mov byte [esp], bl
lea esp, [esp + 4]
jge 0x49ec04
pushal
inc edi
bt bp, bp
add eax, 0xc
push dword [esp]
stc
test edi, 0x97d21bcc
pushal
cmp edi, dword [esi + 0x28]
pushfd
push 0x56a95a71
lea esp, [esp + 0x4c]
jb 0x47557a
pushfd
lea esp, [esp + 4]
jmp 0x4d2b54
lodsb al, byte [esi]
pushfd
mov word [esp], bx
lea eax, [eax + 0x2c8a8db0]
jmp 0x48a888
je 0x4cc358
add al, 0x60
inc edi
bt esp, edi
bt ebx, esi
cmp bh, ch
add esp, 0x40
cmp ch, 5
cmp edi, 0x20
pushal
push 0x992fd479
jns 0x4cc320
das
cdq
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp 0x4b9291
call [esp + ebx*4 - 0x4905118]
invalid
pushfd
pushfd
call fcn.0048330e
call fcn.004ecf51
loopne 0x4cc332
insb byte es:[edi], dx
jge 0x4cc34a
invalid

Function at 0x4966d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4e11a5
push dword [esp + 8]
nop
mov byte [esp + 8], ch
mov dword [esp + 0x24], ebp
bswap bp
pushfd
movsx bp, cl
mov ebp, dword [esp + 0x2c]
pushfd
push ecx
lea ebp, [ebp + 1]
call fcn.004826f1

Function at 0x499b82
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4f4584
jmp 0x4a8f1e
lea esp, [esp + 0x30]
call fcn.00454390
rol esi, 0xf
mov esi, dword [ebp - 4]
stc
jmp 0x4ecc40
pushfd
stc
test eax, eax
pushfd
lea esp, [esp + 8]
je 0x4f85aa
movsx ax, cl
mov ecx, dword [ebp + 0x14]
rdtsc
rdtsc
not dx
not al
mov edx, dword [ebp - 8]
movsx ax, cl
push ecx
xchg ecx, eax
jmp 0x477fb7
lea eax, [ecx*2 - 0x68c92a72]
mov ecx, dword [ebp + 8]
lahf
pushal
mov dword [esp + 0x1c], esi
mov byte [esp + 0x14], 0x56
mov dword [esp + 0x18], edx
push 0x2f4d591a
mov eax, edi
mov byte [esp], 0
pushfd
lea esp, [esp + 0x20]
call fcn.00457c47
jmp 0x47f17e
clc
sub ebx, ebx

Function at 0x49a0d2
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
lea esp, [esp + 0x34]
jne 0x4bc355
cmp ah, bl
sbb si, si
adc si, cx
shl si, 0xf
sub eax, edx
pushal
sar eax, 1
bts dx, 9
xchg si, dx
and dl, al
lea esi, [eax + 1]
movzx ax, al
stc
pushal
sub ecx, ecx
cmc
bt bp, dx
mov eax, esi
movsx edx, al
mov edx, 2
stc
ror cl, cl
mul edx
mov cl, byte [esp]
pushfd
pushfd
mov cl, byte [esp]
seto cl
cmp dl, 0xcc
add esp, 0x48
jl 0x479f91
neg ecx
cmc
or ecx, eax
call fcn.004f4bfd
Function at 0x4a162e
Capabilities:
Execute anti-debugging instructions

Disassembly:
not al
push edi
setl al
lea ecx, [ebx - 0x126c9483]
mov edi, dword [ebp + 8]
cdq
bswap ecx
rdtsc
mov ch, dl
mov ecx, ebx
jmp fcn.004dd133
inc ecx
add cl, ah
mov dh, cl
push ebx
or ebx, edi
movsx dx, dl
bsr ecx, esp
mov ebx, dword [ebp + 0xc]
movsx cx, cl
neg dh
push esi
movzx edx, cl
mov esi, dword [eax + 1]
shr dh, cl
clc
rol dl, cl
cmc
sub esi, 0x13a5b738
cmc
not edx
cmc
xor esi, dword [eax + 0x11]
xchg cx, ax
jmp 0x47c031
push dword [esp + 4]
pushfd
lea esp, [esp + 0x38]
je 0x47fb35
pushfd
push 0x7f2e5c52
pushal
mov byte [esp + 8], ch
lea esp, [esp + 0x28]
jmp 0x4ed5b5
pushal
push eax
call fcn.004d1387

Function at 0x4a2b75
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x44], esi
jmp 0x4e94c5
not si
pushfd
mov esi, 0x42e5a5
mov byte [esp], 0xff
call fcn.004c2d47

Function at 0x4a2c57
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi + 1]
push 0xaa70b7
jmp 0x4b2c75
mov dword [esp + 0x34], esi
not si
pushfd
pop esi
mov esi, 0x41ffb4
call fcn.004a44c6
pushfd
push 0xac3279b5
jmp fcn.004f76ef

Function at 0x4a3fc6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
call fcn.004b6c2c
cmc
jmp 0x4c5bb0
test eax, eax
push eax
lea esp, [esp + 4]
jne 0x4923c4
clc
push eax
call fcn.004e85df
sub dword [eax + 0x6f], 0xe8f078a7
jg 0x4c5b57
imul ecx, dword [ecx - 0x1312b747], 0x4d
sub dword [ebp + 0xb6157ef], ecx
daa
mov bl, 0x1d
scasd eax, dword es:[edi]
xchg edx, eax
pop ebx
mov edx, 0xbc433282
in al, dx
and bl, dh
int1
lcall 0xdb7, 0xc093b64c
out dx, eax
insd dword es:[edi], dx
invalid

Function at 0x4a537c
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
stc
add esp, 0x38
clc
stc
jmp 0x4c2952

Function at 0x4a6a06
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.004835fc
jmp 0x4833ca

Function at 0x4ab946
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
jmp 0x4d4fcf
pushfd
lea esp, [esp + 0x30]
je 0x4b50e1
movsx edx, dl
pushfd
seta al
not ah
mov eax, 0x465fc4
push dword [esp]
pushal
movzx ecx, byte [edi + ebx]
not dh
bswap dx
not dx
push 0xb7cc1397
mov dword [esp + 0x28], ecx
not dl
pop edx
mov dword [esp + 0x20], eax
not dl
call fcn.004aa4e8

Function at 0x4ac2fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jl 0x4ed908
pushal
mov edi, dword [ebp + 0x10]
pop ecx
pop ecx
pop ecx
pushfd
lea ecx, [ebp - 0x4d0]
pushfd
pushal
mov dword [esp + 0x38], ecx
mov byte [esp + 8], cl
jmp 0x4d7e2c
mov byte [esp], bl
lea esp, [esp + 0x38]
call fcn.0048d10d
test al, al
clc
bt di, dx
add esp, 4
call fcn.00473261

Function at 0x4aeb20
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx eax, bl
mov eax, 0x465fb8
pushal
lea esp, [esp + 0x28]
je 0x4b50e1
setl al
mov eax, 0x465fc4
pushfd
not edx
movzx ecx, byte [edi + ebx]
push ebp
movzx edx, bl
mov dword [esp + 4], ecx
pop edx
lea edx, [eax + 0x7987e3a6]
push eax
jmp 0x4f00ae
call fcn.0048591e
movsx dx, cl
setle dh
lea edx, [eax + 0x244560cd]
lea edx, [ebp - 0xd0]
jmp 0x4e28e5
Function at 0x4af045
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebp - 0xd0]
pushfd
call fcn.004d7cf1
mov eax, edi
stc
and eax, 0xf
stc
jmp 0x4c979c
jmp 0x4539a5
cmp al, 0xf
mov eax, dword [esp]
mov eax, 0x465fb8
pushfd
jmp 0x4cc268
lea esp, [esp + 8]
je 0x4b50e1
rdtsc
setge al
cdq
push ebx
mov eax, 0x465fc4
xchg dh, ch
pushfd
movzx ecx, byte [edi + ebx]
mov dword [esp], 0xc7e3d92a
mov dh, al
mov dword [esp + 4], ecx
push esi
mov edx, dword [esp + 4]
pushal
mov dword [esp + 0x24], eax
movsx dx, al
jmp 0x4b0671

Function at 0x4b5daa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [ebx + 0xb5d11]
jmp 0x4f5d7e
call fcn.0049c193
push esp
jmp 0x4f3804

Function at 0x4b66ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], 0xd4f4
push ebx
mov ecx, dword [ecx + 0xc0a26]
jmp 0x4cc360

Function at 0x4bb792
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 4], 0x79a9d0d1
push 0xa604c4ff
lea esi, [esi + 0x7afef34a]
call fcn.004f519e
jmp 0x4a0b21

Function at 0x4bee81
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x40], esi
push esp
movsx si, bl
mov esi, dword [esp + 0x48]
pushfd
jmp 0x495502
nop
pushal
pushal
jmp 0x4833cf
Function at 0x4c2307
Capabilities:
Execute anti-debugging instructions

Disassembly:
jae 0x4b2c88
pushal
inc edi
call fcn.004a537c
lea esp, [esp + 0x38]
call fcn.00459a35
jmp 0x49b89e

Function at 0x4c5b47
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x40]
call fcn.00459a35
sal ah, 6
sar al, 1
stc
dec eax
add esp, 0x20
lahf
mov eax, edi
cmp cx, 0x322a
and eax, 0xf
cmc
pushfd
pushfd
cmp al, 0xf
setg ah
mov eax, 0x465fb8
push 0x66f29bfd
lea esp, [esp + 0xc]
je 0x4b50e1
push 0x79fbd1f0
movzx eax, dl
movzx dx, cl
call fcn.004ea604

Function at 0x4cef0e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp bl, 0x9b
add esp, 8
pushal
mov word [esp + 4], 0xe9bc
lea esp, [esp + 0x20]
jmp 0x47a8d5

Function at 0x4d1387
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x47fb2b
lea esp, [esp + 0x28]
jne 0x4ed5b5
inc eax
mov dword [esp], 0xef137df9
cmp byte [eax], cl
jmp 0x47316c

Function at 0x4d3050
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
cmp edi, 0x20
jmp 0x4e94d7
pushfd
push 0x4fd78f94
lea esp, [esp + 0x34]
call fcn.00459a35
pushfd
pushal
push dword [esp + 0xc]
inc edi
pushfd
pushfd
clc
test bl, 0xa6
add esp, 0x44
cmc
clc
jmp 0x4cee8a
pushal
lea esp, [esp + 0x20]
jl 0x4ed908
pushfd
lea edi, [0x2511de88]
xchg cx, di
mov edi, dword [ebp + 0x10]
mov byte [esp], bh
lea ecx, [ebp - 0x4d0]
mov byte [esp], 0x5a
pushfd
pushal
mov dword [esp + 0x24], ecx
jmp 0x4baf8d

Function at 0x4d6161
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [edx*2 + 0x1bf65fa6]
bswap di
mov edx, dword [eax + 8]
jmp 0x4d615b
mov dword [esp + 0x40], 0x4d03fa
call fcn.004947f3
push 0x466138
pushal
mov byte [esp], 0x11
pushal
push 0xa7d47e3f
mov dword [esp + 0x40], edi
push dword [esp]
jmp 0x4c9080
pushfd
call fcn.004b59c5
xchg di, dx
movzx edi, dl
movzx dx, bl
xchg di, cx
mov edi, eax
bswap eax
mov ecx, dword [esi + 0x30]
rdtsc
rdtsc
mov eax, dword [ecx]
bswap dx
setle dh
lea edx, [ebx + 0x6c9bacce]
setae dh
mov edx, dword [eax + 0xc]
pushfd
mov dword [esp], 0x4537b0
jmp 0x4c9780
jmp 0x4c7b67

Function at 0x4d7cf1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
call fcn.00450ca0
setno dh
movzx dx, cl
lea edx, [ebp - 0xd0]
pushfd
push esi
lea esp, [esp + 8]
jmp fcn.004cef42
jmp 0x48bfdb