joyce8/EMBER2024-capa huggingface dataset:
Function at 0x778a69
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0xc019
pop word [esp + 1]
mov word [esp], di
clc
jl 0x778c72
jge 0x778bf5
ljmp 0x5ac:0x6899fe68
mov ax, cx
jmp 0x778a46
call fcn.00778ab1
sub esp, 0x1a
jge 0x778aca
jl 0x778aca
mov ax, di
lea esp, [esp + 2]
jmp 0x778c79
mov ax, di
lea esp, [esp + 2]
lea esp, [esp + 4]
dec cl
jmp 0x778b4d

Function at 0x778b33
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x71c3e8a3
jmp 0x778cd0
mov dh, 0x38
mov eax, 0xbe6a0b00
add esp, 1
mov byte [esp], dh
btc edx, ebx
mov ax, 0x600d
jmp 0x778b5c
lea eax, [edi*4]
bswap edx
mov edx, 0x5ae39c70
add esp, 5
jmp 0x778bc4
push dword [esp]
jmp 0x778b1a
lea esp, [esp + 2]
sub cl, 0x5b
bswap eax
or eax, eax
jle 0x778bac
bts edx, edi
cmp ax, 0xa0dc
bswap edx
jmp 0x778bae
add esp, 1
mov byte [esp], dh
btc edx, ebx
jmp 0x778b08
bts edx, edi
cmp ax, 0xa0dc
bswap edx
jmp 0x778b92
rdtsc
neg edx
lea eax, [edx + esi]
neg dh
js 0x778bd3
lea edx, [eax - 0x7a11ec9f]
jmp 0x778c20
jmp 0x778b83
rdtsc
neg edx
jmp 0x778b96
je 0x778af8
mov dh, 0x38
mov eax, 0xbe6a0b00
jmp 0x778b78
jmp 0x778c1a
not dx
mov al, ah
lea edx, [eax + edi]
xchg dh, dl
inc edx
mov eax, 0x202fb934
jmp 0x778c44
jle 0x778bd5
not dx
mov al, ah
jmp 0x778c5b
lea edx, [eax - 0x7a11ec9f]
xor cl, 0x19
lea edx, [ebp*4]
inc dh
jmp 0x778bfe
rol cl, 0
rdtsc
mov eax, ebx
mov edx, esp
lea edx, [eax + edx]
jmp 0x778ca6
lea eax, [ebx + edi]
lea eax, [ecx + 0x6b]
jmp 0x778c2e
lea edx, [eax + edi]
xchg dh, dl
inc edx
jmp 0x778be0
add esp, 5
jmp 0x778cf8
add esp, 5
lea esp, [esp + 3]
jmp 0x77801f
mov edx, ecx
mov al, ah
mov al, byte [esp]
bswap eax
call 0x778c84
shl edx, 2
xchg al, ah
pushal
add al, dh
ja 0x778c86
jbe 0x778c8f
sub ch, byte [edi + 0x58a95a3f]
inc edx
std
int3
lea esp, [esp + 3]
jmp 0x77801f
Function at 0x7a0aa9
Capabilities:
Encrypt data using aes

Disassembly:
shr eax, 0x10
sub esp, 0x16
lea esi, [edx + esi]
pop si
jmp 0x7a0ab6
and eax, esi
setbe bl
inc di
jmp 0x7a0cd6
inc esi
not edi
mov eax, edx
jmp 0x7a0a6a
xor edx, eax
lea ebp, [ebp + 0x5f61b2c7]
mov dword [ecx + 0xc], edx
jmp 0x7a0a8f
lea esp, [esp + 0x24]
mov esi, 0xff
xchg bl, bh
bt edi, esp
pushal
jmp 0x7a0a77
mov eax, dword [eax*4 + 0x785a1c]
lea esp, [esp + 0x20]
xor eax, 0x1000000
mov bl, 0x48
jmp 0x7a112c
shr edi, 8
and edi, esi
cmc
lea ebp, [ecx + 0x33]
jmp 0x7a1115
lea ebp, [edx*4]
inc bl
jmp 0x7a1403
neg bl
mov edi, edx
push esp
jmp 0x7a1106
lea ecx, [ecx*4]
lea ecx, [ecx + 0x785a1c]
mov edi, dword [ecx]
pop ecx
and ebp, ecx
jmp 0x7a13b9
sub esp, 2
push word [esp + 1]
pop word [esp]
lea esp, [esp + 2]
popal
jmp 0x7a1344
xor eax, edi
call 0x7a1371
push ss
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
and dword [edi - 0xd], ebp
arpl word [esi], ax
cmc
aaa
jbe 0x7a13ff
mov al, byte [0x4598be3]
mov ebx, dword [ecx + 4]
and eax, 0xff000000
jmp 0x7a1389
mov bl, 0x5e
lea esp, [esp + 4]
and edi, 0xff0000
rol ebp, 0x1b
bts ebp, ebx
jmp 0x7a13a0
xor dword [eax], esi
xor ebp, dword [edx]
push ecx
pushal
mov dword [esp + 0x18], edi
clc
jmp 0x7a135e

Function at 0x7a167d
Capabilities:
Encrypt data using aes

Disassembly:
pop ebp
push edx
jmp 0x7a1685
add esp, 1
lea esp, [esp + 3]
jmp 0x7a16d2
lea esp, [esp + 0x5c]
mov ebp, 0xff00
pushal
lea esp, [esp + 0x11]
push dword [esp + 3]
jmp 0x7a1722
mov edi, dword [edi*4 + 0x785a1c]
bsr bp, bp
and ebp, ecx
pushal
mov dword [esp + 0x1b], eax
jmp 0x7a16b4
bswap edi
bts edi, edi
neg edi
jmp 0x7a1731
xor eax, edi
xor edi, esi
bsf di, ax
lea esp, [esp + 0x28]
xor eax, dword [ecx]
jmp 0x7a16e6
pop word [esp]
lea esp, [esp + 1]
and edi, ebp
sub esp, 0x18
jmp 0x7a16fe
lea edi, [ecx + 0x10]
cmc
clc
sub esp, 0x14
jmp 0x7a1761
xor ebx, eax
stc
cmc
call 0x7a176b
int 0x89
or al, 0x24
jmp 0x7a19d2
push ebx
mov ebx, ecx
lea ebx, [ebx + 0x18]
jmp 0x7a1994
mov dword [ebx], eax
pop ebx
call fcn.007a19b7
cmp eax, 0xc43552bc
sub eax, 0x7819890d
mov ebp, dword [edi - 0x58]
retf
pop word [esp + 9]
xor eax, ebx
mov dword [ecx + 0x14], ebx
cmc
jmp 0x7a1988
mov dword [edi], eax
mov eax, dword [ecx + 8]
sub esp, 0
sub esp, 0x1a
pop dword [esp + 2]
jmp 0x7a19aa

Function at 0x7a455a
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0xc
jmp 0x7a45a3
lea ebx, [esi*4]
not dh
pushal
jmp 0x7a45fa
lea esp, [esp + 0xc]
movzx ebx, byte [esi + 0x11]
or di, 0xfdbc
mov ebx, dword [ebx*4 + 0x785a1c]
jmp 0x7a457d
mov dword [ebx], ecx
pop ebx
lea esp, [esp + 0x24]
mov ecx, 0xff
jmp 0x77cacb
push ebx
mov ebx, ebp
lea ebx, [ebx - 4]
jmp 0x7a45c9
Function at 0x7a4e13
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x78661c]
sub esp, 0x16
jmp 0x7a5132
mov ebx, dword [ebx*4 + 0x785a1c]
call fcn.007a5070
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x786a1c]
lea edx, [ecx - 0x3b7a745d]
jmp 0x7a5108
mov edx, dword [esi + 8]
sub esp, 0
push edx
mov dword [esi + 4], edi
jmp 0x7a5118
bsr di, cx
mov ebx, dword [ebx*4 + 0x785a1c]
not edi
btr edi, edx
jmp 0x7a519e
mov dword [esp + 3], eax
mov bx, 0xa0f7
lea esp, [esp + 2]
lea esp, [esp + 0x14]
movzx ebx, byte [esi + 6]
jmp 0x7a50a7
mov edi, dword [edi*4 + 0x785a1c]
and edi, ecx
call fcn.007a5161
and ebx, ecx
stc
sub esp, 0x14
add esp, 9
lea esp, [esp + 3]
jmp 0x7a51be
mov edi, edx
stc
stc
shr edi, 0x18
jmp 0x7a5178
movzx ebx, byte [esi + 0xa]
stc
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x7a56e9
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + 0x78661c]
jmp 0x7a51a7
push edx
and edx, ecx
clc
sub esp, 0x16
mov byte [esp + 6], ah
call fcn.007a55f2
lea esp, [esp + 2]
mov edx, dword [edx*4 + 0x785a1c]
push edx
jmp 0x7a5643
bswap ebx
lea ebx, [ebx + ebp]
lea ebx, [edx + ebp]
neg ebx
movzx ebx, byte [esi + 0xd]
jmp 0x7a5609
and edx, ecx
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + 0x786a1c]
jmp 0x7a569e
lea esp, [esp + 3]
and ebx, ecx
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x78621c]
jmp 0x7a5633
pushal
not bh
rdtsc
mov dword [esp + 0x10], esi
pushal
add esp, 0x1f
jmp 0x7a5687
lea esp, [esp + 1]
popal
jmp 0x7a56a7
mov edx, dword [esi + 0xc]
sub esp, 8
push ebx
jmp 0x7a5674
lea ebx, [ebx + 8]
mov dword [ebx], edi
pop ebx
rcl di, cl
neg edi
jmp 0x7a56d3
lea ebp, [ebp + 0x785a1c]
mov ebx, dword [ebp]
pop ebp
sub esp, 0x18
add esp, 9
clc
jmp 0x7a5661
mov ebx, dword [ebx*4 + 0x785a1c]
mov edi, dword [esp]
jmp 0x7a570b
push ebp
mov ebp, ebx
lea ebp, [ebp*4]
jmp 0x7a56c0
mov edi, dword [edi*4 + 0x785a1c]
jmp 0x7a5713
mov edi, edx
shr edi, 0x18
stc
jmp 0x7a56f5
and edi, ecx
cmc
mov edi, dword [edi*4 + 0x785e1c]
sub esp, 0x18
jmp 0x7a595a
and ebx, ecx
push esp
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x78661c]
jmp 0x7a5942
lea ebx, [ebx + edi]
bsf bx, ax
not bx
lea ebx, [edx + ebx]
jmp 0x7a5bbf
lea esp, [esp + 7]
mov dword [esp + 6], ebp
lea esp, [esp + 1]
jmp 0x7a592e
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + 0x785a1c]
push edx
mov byte [esp], ah
call fcn.007a5ba4
and ebx, ecx
call fcn.007a5b86
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x78621c]
stc
call fcn.007a5e0f
push ebx
retf 0x9465

Function at 0x7a5070
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0x78621c]
mov bl, byte [esp]
jmp 0x7a508f
pushal
and ebx, ecx
jmp 0x7a505a
movzx ebx, byte [esi + 9]
push esp
mov dword [esp], eax
jmp 0x7a5101
mov bx, word [esp]
mov bl, 0x62
jmp 0x7a5075
and edx, ecx
call 0x7a50e8

Function at 0x7a5161
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + 0x785e1c]
push esp
jmp 0x7a5186
mov word [esp], dx
jmp 0x7a514b

Function at 0x7a5b86
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], sp
pop word [esp]
lea esp, [esp + 2]
jmp 0x7a5bda
Function at 0x7a5ba4
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 2], dx
and edx, ecx
push esi
jmp 0x7a5ba6
jmp 0x7a5b7a
mov esi, edx
lea esi, [esi*4]
lea esi, [esi + 0x785a1c]
mov edx, dword [esi]
pop esi
call fcn.007a5b84
push ecx
ror byte [edi], 1
mov dh, 0x5e
push cs

Function at 0x7a5e0f
Capabilities:
Encrypt data using aes

Disassembly:
push edx
push dword [esp]
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x7a5e13
and edx, ecx
jmp 0x7a5df0
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0x786a1c]
call fcn.007a604d
fcomp qword [esi - 0x34]
stosd dword es:[edi], eax
mov byte [0x4623b32e], al
mov ch, 0x5c
xor al, 0xb4
sub cl, byte [ebp - 0x44]
push edx
and dword [ebx], edx
wait
or ebp, dword [esi - 0x63]
jge 0x7a5eb8
cld
xchg edx, eax
cmc
add al, 0xea
dec edi
leave
pop ecx
cmp bl, cl
and bh, ch
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffd5
add ecx, dword [edi + 0x28897a1f]
stosd dword es:[edi], eax
and byte [esi - 0x2860df2f], dh
pop ebp
int 0x94
loop 0x7a5e8d
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x72
ret
mov esp, 0xf67cf24f
add edi, esi
inc ecx
outsb dx, byte [esi]
jmp 0x7a5f14
xor cl, bl
test eax, 0x37c4bd2d
sar dword [ecx + 0x46cbac3e], cl
test al, 0x89
adc eax, dword [ebx + 0x11fa15e6]
xchg esp, eax
or ch, byte [ebp - 0x64]
and ecx, dword [ecx + 0x3f09101]
mov esi, 0x3750c249
ret 0x97d
retf 0xd640

Function at 0x9f3e46
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
mov ebx, 0x6866872
pop esi
add esp, 2
jmp 0x9f3e58
mov bh, byte [esp + 1]
mov bp, dx
neg edx
cmc
bswap ebp
btc eax, ebx
jmp 0x9f3f06
not cx
cmc
bswap ecx
rdtsc
not edi
pop dword [esp + 8]
jmp 0x9f3fb6
mov ch, byte [esp + 2]
mov bp, word [esp + 2]
mov bx, 0x7e4d
sub esp, 0x16
mov di, dx
jmp 0x9f3ea4
mov al, 6
mov ah, byte [esp + 2]
not ah
mov ebx, 0x93a664ba
xchg di, cx
rdtsc
jmp 0x9f3ec3
mov esi, dword [esp]
bsf bp, ax
cpuid
bswap esi
rdtsc
xchg word [esp], di
jmp 0x9f3ede
rdtsc
xchg di, bp
xchg ch, dl
inc eax
push esp
xchg si, ax
jmp 0x9f3f9b
xchg dword [esp + 0xa], ebx
xchg byte [esp + 2], bl
lea esi, [ebp*4]
btc esi, edi
lea esp, [esp + 0x10]
mov edi, ecx
jmp 0x9f3f42
xchg ah, bl
mov dword [esp + 6], eax
mov bl, 0x68
pop esi
mov dh, byte [esp + 0xd]
rdtsc
jmp 0x9f3f65
lea esi, [esi + 0x9d]
pop word [esp]
sub esp, 0x12
inc dl
bswap ebp
jmp 0x9f3fe6
xchg ch, dl
mov word [esp + 4], dx
lea edx, [ecx + 0xeb]
xchg byte [esp + 0xa], dl
btr ebx, edx
xchg dword [esp + 0xd], ebx
jmp 0x9f3f8a
push word [esp + 7]
xchg dword [esp], ebp
lea esp, [esp + 7]
xchg cx, bp
jmp 0x9f5e08
mov ebp, 0xa20da17a
xchg bh, cl
lea esp, [esp + 0xb]
xchg byte [esp + 2], cl
sete dh
jmp 0x9f3fd0
lea ecx, [esi*4]
rdtsc
shr ebx, 0xf
mov word [esp], bx
mov dword [esp], ecx
mov ebp, 0x27e7858c
xchg byte [esp], al
jmp 0x9f5cb7
Function at 0x9f47b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, ecx
xchg ebx, edi
mov ax, 0x1ea5
add esp, 0
setge ch
bsf ax, ax
jmp 0x9f466c
btr edi, edx
xchg bh, cl
mov di, word [esp]
neg ebp
mov edi, 0x754aaefc
xchg byte [esp], al
jmp 0x9f45f6
bsr dx, bp
pop di
xchg word [esp], bp
xchg byte [esp], bl
mov dx, word [esp]
bsf si, ax
jmp 0x9f4695
mov edi, 0xce23b532
mov cl, 0x3a
neg esi
push esp
mov dx, 0xfd1
mov eax, 0xbe169c4a
jmp 0x9f462f
lea ecx, [ebx*4]
cpuid
xchg ebx, ebp
lea ebx, [ebp - 0xe7]
jmp 0x9f464b
add esp, 0
inc bp
lea edi, [eax + edi]
rol bx, cl
rdtsc
mov dl, dh
jmp 0x9f461a
cpuid
lea ebp, [edx + esi]
mov bx, 0x8a55
rdtsc
xchg cx, bx
shr ch, 5
jmp 0x9f471c
lea esp, [esp + 7]
add esp, 4
bsf cx, si
lea esp, [esp]
mov esi, ecx
rcr eax, 0xf
jmp 0x9f4684
mov dh, byte [esp + 0xb]
pop ebx
popal
xchg ch, dl
jmp 0x9f4725
mov al, ah
sub eax, eax
call fcn.009f46a8
mov si, 0xec59
mov dx, word [esp]
rdtsc
mov dl, dh
xchg edx, eax
mov byte [esp], ch
jmp 0x9f4788
xchg di, ax
push word [esp + 7]
mov cl, 0x92
add bx, 0x2cf6
rol bx, cl
xchg word [esp + 5], di
jmp 0x9f46c0
lea ecx, [edx*4]
push word [esp + 4]
bsr cx, cx
add esp, 7
mov ah, byte [esp + 5]
xchg bh, cl
jmp 0x9f4747
xchg byte [esp], al
pushal
push word [esp + 5]
call 0x9f4797
jo 0x9f47fe
mov edx, 0x310fea75
push word [esp + 0x17]
and al, 0x17
call fcn.009f47f0
jo 0x9f47a0
add dh, cl
push ss
outsb dx, byte [esi]
call 0xf876131
test dword [esi - 0x79], esp
xchg word [esp + 4], bp
mov word [esp + 9], sp
rdtsc
jmp 0x9f476d
rol dword [ebx - 0x3c01f114], cl
jmp 0x9f4971
xchg byte [esp + 2], al
pushal
push dword [esp + 0x19]
btr ecx, esp
mov word [esp + 0x1c], dx
xchg word [esp + 0x24], bx
jmp 0x9f4837
mov dx, bx
lea edx, [eax + 0xb9]
push word [esp + 0xb]
pop ebp
mov word [esp + 9], dx
xchg ebx, edx
jmp 0x9f4851
mov word [esp + 0xc], sp
lea eax, [esi + 0x6ae2eaad]
stc
setae dh
add esp, 0x13
lea edi, [edx*4]
jmp 0x9f48b4
rdtsc
sub cx, 0x2520
mov bp, dx
not ecx
mov edx, 0x30d64906
bsr dx, cx
jmp 0x9f4900

Function at 0x9f47f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol si, cl
pop cx
btc edi, edi
mov di, 0xaa1
sub esp, 0x1a
jmp 0x9f480e
cmc
cmc
xchg ah, bl
xchg dword [esp + 0x10], ebx
bswap ebp
push dword [esp + 0x16]
jmp 0x9f47c2
jmp 0x9f47d9
sub esp, 0x16
add esi, ebp
mov cx, word [esp + 0x14]
not bx
sub esp, 0xe
inc bl
lea esp, [esp + 0x4a]
not bh
cpuid
shl ax, cl
setp dh
and cx, 0x5272
jmp 0x9f47f2

Function at 0x9f4daf
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov word [esp + 0x1b], bx
push dword [esp + 0xd]
xchg word [esp + 0xb], bx
bsr dx, cx
jmp 0x9f4d4d

Function at 0x9f5b56
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 7]
pop word [esp + 0xb]
bsf ax, si
xchg byte [esp + 0x10], al
jmp 0x9f5bfa
push word [esp + 5]
xchg byte [esp + 2], cl
mov cx, word [esp + 0x18]
pop word [esp + 0x15]
xchg di, ax
cmc
jmp 0x9f5c48
btc eax, edi
mov bh, byte [esp + 0x17]
btr ebx, edx
mov ebx, ebp
rdtsc
mov ax, di
jmp 0x9f5bdb
xchg bx, ax
rdtsc
pop bp
inc cl
xchg word [esp + 0xe], di
pop ax
push word [esp + 0xb]
add esp, 7
and bp, 0x876a
mov byte [esp + 1], dh
jmp 0x9f5c21
Function at 0x9f6637
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, eax
bsf cx, si
mov byte [esp + 1], ch
mov edx, eax
stc
setp ch
jmp 0x9f661c
add esp, 0
mov si, word [esp]
not edi
xchg word [esp], cx
mov dl, dh
xchg ah, bl
jmp 0x9f6592
mov dword [esp], esi
mov cl, ch
pop si
mov al, 0x86
xchg di, si
xchg ecx, edx
jmp 0x9f65b1
xchg byte [esp + 2], bl
setae ah
lea esp, [esp + 4]
mov ebx, dword [esp]
mov byte [esp], ch
shr ah, 1
jmp 0x9f677e
push word [esp + 2]
xchg dh, al
mov dh, byte [esp + 3]
inc ecx
mov di, sp
jmp 0x9f65df
lea eax, [eax*4]
xchg di, ax
mov bp, word [esp + 1]
neg di
shr edx, 0x15
jmp 0x9f6604
setl dh
lea eax, [ebp + 0x6ced8047]
xchg byte [esp + 2], bl
jmp 0x9f65cf
cmc
mov bl, bh
add esp, 1
bsr cx, cx
mov edx, dword [esp]
add esp, 1
jmp 0x9f6662
pop si
mov ebx, eax
mov ebp, ecx
xchg word [esp], dx
mov byte [esp + 1], dh
cpuid
jmp 0x9f667a
push word [esp + 0x11]
xchg byte [esp + 0x20], al
mov si, word [esp]
mov word [esp + 0xd], bx
lea ecx, [esi - 0x35]
popal
jmp 0x9f6691
mov dl, 0xbc
pushal
cpuid
xchg ah, bl
push word [esp + 0x16]
mov ebx, ebp
jmp 0x9f66ac

Function at 0x9f69ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ah, bl
btc ecx, edi
add al, dh
rdtsc
xor ebx, esi
rcr bh, 3
jmp 0x9f6973
xchg dword [esp + 6], edi
xchg ch, dl
inc edx
mov dword [esp + 0x18], eax
neg ecx
pop dword [esp + 4]
jmp 0x9f68fc
not di
mov cl, 0x12
push dword [esp + 1]
rdtsc
lea ebp, [eax*4]
btr esi, edx
jmp 0x9f6988
mov si, 0x8a9b
cld
lea edx, [edx*4]
xchg word [esp + 0x1a], ax
xchg dword [esp + 0x16], eax
rdtsc
jmp 0x9f6932
xchg dword [esp + 0xc], esi
lea edx, [ebx*4]
xchg bp, di
inc eax
setp ch
pop edi
jmp 0x9f6952
lea esp, [esp + 8]
mov ch, byte [esp + 0x13]
xchg dword [esp + 0xe], ebx
push dword [esp + 0x11]
inc bx
xchg bh, cl
jmp 0x9f69d2
lea ebp, [esi + 0x45581225]
mov byte [esp + 0x1b], ch
jmp 0x9f691f
stc
sub esp, 0x1e
mov ebx, dword [esp + 0x10]
mov cl, 0x6a
xchg byte [esp + 0xc], dl
mov ax, dx
jmp 0x9f6a1d
lea esp, [esp + 0x17]
btr edx, esp
pop ecx
push edx
add esp, 5
mov dl, dh
jmp 0x9f69ba
xor dl, ch
setle ch
shr ch, 5
push word [esp + 7]
xchg dword [esp + 9], edx
rdtsc
jmp 0x9f6ae4
bsf bx, si
mov word [esp + 4], sp
lea ebx, [edx + edi]
push dword [esp]
mov di, word [esp + 3]
jmp 0x9f6a04
mov esi, dword [esp + 0x1c]
call fcn.009f6a60
out dx, eax
cli
popfd
insb byte es:[edi], dx
rcr dword [ebx], cl
xchg ecx, eax
add dword [eax - 0x6d], esp
push ss
nop
adc ecx, dword [ecx + 0xf05246c]
xchg ebp, eax
invalid
mov dword [esp + 5], ebp
setne dh
push word [esp]
not si
pop si
xchg ch, dl
jmp 0x9f6aa0
lea ebx, [ebp*4]
pop dword [esp + 0x14]
neg bh
mov dx, sp
lea ebx, [edi*4]
lea esi, [ecx + edi]
jmp 0x9f6ab7
Function at 0x9f6a60
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], al
mov byte [esp], dh
mov di, word [esp]
pushal
xchg edi, eax
jmp 0x9f6a88
push esp
inc esi
mov bp, word [esp + 0x28]
lea esp, [esp + 0x23]
pop esi
jmp 0x9f6a49
pop bx
pushal
lea esp, [esp + 0x42]
mov cx, 0xed01
rol si, cl
btc edi, ebx
jmp 0x9f6acb
push word [esp + 3]
inc cx
setae dh
lea esi, [ebp*4]
jmp 0x9f6a6e
setns ch
mov ebp, dword [esp]
rdtsc
lea ecx, [esi*4]
btc edi, ebx
jmp 0x9f6b17
mov ebp, ecx
cmc
ror ah, 1
sub esp, 0x1c
setne dh
mov bp, 0xb963
jmp 0x9f6b3f
shl cx, cl
mov edx, dword [esp]
mov ax, dx
setge ch
mov bh, 0xc3
inc edi
jmp 0x9f6b00
mov dl, 4
mov dl, 0x4c
mov dl, dh
mov byte [esp + 9], ah
lea esp, [esp + 5]
xchg dx, bp
jmp 0x9f6c0f
mov bx, sp
mov edx, ebp
btc ecx, ebx
xchg cx, di
lea ebx, [ebx + ebp]
pop dword [esp + 6]
jmp 0x9f6b28
cpuid
lea ebx, [ebx + edi]
cmc
xchg bh, cl
pop edx
cpuid
jmp 0x9f6b7e
setbe ah
add esp, 5
cpuid
cpuid
mov ecx, 0x98c7a05c
jmp 0x9f6bc3
mov al, 0xee
rdtsc
mov al, 0xfe
mov word [esp + 0xa], dx
xchg edx, eax
add esp, 0xd
jmp 0x9f6b6d
bsf di, ax
cld
xchg byte [esp], al
inc cl
lea esp, [esp]
mov edi, dword [esp]
jmp 0x9f6bef
mov edi, 0xfcb71b5a
xchg byte [esp], cl
bsr si, cx
push edx
pop eax
add esp, 0
jmp 0x9f6ba5
xchg dword [esp + 8], edx
xor si, 0x8b44
stc
inc ax
xchg word [esp + 3], cx
not esi
jmp 0x9f6b94
xchg dh, al
bsr bp, bp
mov byte [esp], dh
mov bl, 0xb0
bswap edx
rcr edi, 0x19
jmp 0x9f6cff
push edx
mov word [esp + 0xf], sp
add al, dh
mov dword [esp + 5], ecx
not edx
mov ax, dx
jmp 0x9f6bda
pop word [esp + 0xb]
not dx
push word [esp + 0xb]
mov dx, 0xeacf
xchg word [esp + 0xc], cx
mov ebx, esi
jmp 0x9f6c99
pop ecx
lea edi, [ebp*4]
not ah
xchg bh, cl
xchg byte [esp + 8], dl
lea ebp, [ecx + 0x4b]
jmp 0x9f6c22
lea esi, [esi + 0x75]
mov dl, 0xac
stc
inc ebx
mov cl, 0x32
pop edx
call fcn.009f6c59
lea esp, [esp + 0xa]
bsf si, si
mov edx, 0x3133314a
cld
call fcn.009f6c5b
xchg ebp, eax
add al, 0xb7
sahf
jmp 0xbc7e1ca4
mov al, 0xde
mov ebx, 0xfa756c66
lea edx, [ebp + 0xff9f347]
add esp, 4
mov dl, 0x1c
not bx
jmp 0x9f6c71
not eax
sub esp, 0x1a
xchg word [esp + 0x13], dx
pop ebx
mov edx, eax
xchg bh, cl
jmp 0x9f6c44

Function at 0x9f6f37
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0x9f6f94
mov byte [esp], dh
pop word [esp]
mov byte [esp], ch
jmp 0x9f6f1c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x9f6f6b
Function at 0x9f7ab1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], ah
mov ah, byte [esp + 1]
mov edx, dword [esp + 7]
rdtsc
push word [esp + 3]
push word [esp + 5]
jmp 0x9f6050
pop word [esp + 1]
bswap ecx
lea esi, [esp + edi]
cmc
xchg edi, esi
mov ebp, dword [esp + 7]
jmp 0x9f5ff8
setl dh
cpuid
xchg word [esp + 1], bp
pop word [esp + 1]
mov word [esp + 2], dx
jmp 0x9f6069
mov word [esp + 2], sp
not eax
rdtsc
mov dh, byte [esp + 7]
mov si, dx
lea edi, [edi*4]
jmp 0x9f6035
setae ch
push word [esp + 7]
btr edi, edx
pop esi
neg edi
rdtsc
jmp 0x9f60e0
popal
mov bl, 0x40
mov edx, 0xa13032c2
lea ebx, [ebx + ebp]
sub esp, 0xa
mov dword [esp + 3], esi
jmp 0x9f6022
inc cl
rdtsc
rdtsc
lea edi, [eax*4]
ror edx, 1
mov di, word [esp]
jmp 0x9f610a
mov ebp, 0x2b59d0c6
btc ecx, ebx
bswap esi
mov bx, word [esp]
lea esi, [ebx*4]
lea edx, [ecx + ebx]
jmp 0x9f6094
add esp, 5
rcl cx, cl
not eax
mov ax, 0x6e23
rcr dh, 7
add esp, 1
jmp 0x9f60ba
mov al, ah
bsf dx, ax
sub esp, 0x18
pop cx
xchg word [esp + 9], ax
call fcn.009f60f4
jns 0x9f6179
lea edx, [edx + edi]
mov bh, byte [esp + 0x1b]
mov bl, 0xb0
xor bx, 0xf674
xchg word [esp + 0x1b], bp
pop word [esp + 0x19]
jmp 0x9f6080
mov ebp, dword [esp + 0x11]
mov byte [esp + 0x1c], ch
btc edx, edi
cli
neg esi
xchg word [esp + 0xd], bx
mov word [esp + 0x16], sp
jmp 0x9f6121
cmc
mov byte [esp], ah
lea edi, [esp + edx]
xchg word [esp], cx
pushal
mov cx, word [esp + 0x16]
jmp 0x9f616f
xor dl, ch
mov edx, 0x79863b52
rdtsc
and bp, 0x4f5a
mov eax, dword [esp]
xchg byte [esp], bl
jmp 0x9f6526
lea edi, [ebx*4]
clc
mov ah, byte [esp]
lea esp, [esp + 1]
mov dl, dh
mov si, word [esp]
jmp 0x9f67d7
mov bl, 0x30
pop bp
ror bh, 3
jmp 0x9f6db4
Function at 0x54dd20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x111000]
push edi
jmp 0x54dd3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54dd41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54dd30
mov eax, 1
add ebx, ebx
jne 0x54dd53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54dd64
jne 0x54dd83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54dd83
dec eax
add ebx, ebx
jne 0x54dd70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54dd48
add ebx, ebx
jne 0x54dd7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54ddd5
xor ecx, ecx
sub eax, 3
jb 0x54dd9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54de0a
sar eax, 1
mov ebp, eax
jmp 0x54dda6
add ebx, ebx
jne 0x54dda6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54dd74
inc ecx
add ebx, ebx
jne 0x54ddb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54dd74
add ebx, ebx
jne 0x54ddc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54ddb6
jne 0x54ddd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54ddb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54ddf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54dde6
jmp 0x54dd36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54ddf4
add edi, ecx
jmp 0x54dd36
pop esi
mov edi, esi
mov ecx, 0xf1f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54de12
cmp byte [edi], 0xa
jne 0x54de12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54de17
lea edi, [esi + 0x14b000]
mov eax, dword [edi]
or eax, eax
je 0x54de8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14d74c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14d788]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54de44
mov ecx, edi
jns 0x54de73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14d790]
or eax, eax
je 0x54de89
mov dword [ebx], eax
add ebx, 4
jmp 0x54de61
call dword [esi + 0x14d78c]
mov ebp, dword [esi + 0x14d794]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54dec3
sub esp, 0xffffff80
jmp 0x408484