joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bcf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.0049c000
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x622004
call fcn.004ec06f
mov ecx, dword [0x59dcd8]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00495a30
mov esi, 0x59dd40
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x49bd97
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49bd8e
cmp al, 0xff
je 0x49bd8e
dec al
mov byte [ecx], al
jmp 0x49bd97
push ecx
call fcn.0050d7be
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00509250
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x49bddd
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49bdd4
cmp al, 0xff
je 0x49bdd4
dec al
mov byte [ecx], al
jmp 0x49bddd
push ecx
call fcn.0050d7be
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004ec0f6
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4a5bdd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51e8c8
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x40]
test edx, edx
setne bl
inc ebx
test eax, eax
je 0x4a5bf3
or bh, 0x80
lea ecx, [esp + 0xc]
call fcn.004acf90
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x28], 0
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004ad300
lea eax, [esp + 0xc]
push ebx
push eax
mov ecx, esi
call fcn.004a5c60
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x59ee58
call fcn.004ad190
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x4aaab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4aaafc
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4aaafc
mov ebp, dword [0x5215bc]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x4aaae6
push eax
call ebp
test ax, ax
jl 0x4aaaf4
inc esi
add edi, 4
cmp esi, 6
jb 0x4aaad8
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004aa7b0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4ae9a0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4aea00
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4aea00
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4aea00
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4aea00
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4aea10
push 0
push 0
call dword [fcn.0052138c]
push eax
call dword [fcn.005213dc]
pop ecx
ret
Function at 0x4b58a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4b58d3
push esi
call fcn.004ba530
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4b58cc
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4b5959
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4b5942
mov eax, dword [esi + 8]
test eax, eax
je 0x4b58f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4b593e
cmp eax, 2
je 0x4b5942
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b58ea
cmp eax, 3
je 0x4b591d
cmp eax, 1
jne 0x4b58ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4b58ea
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4b58ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004b5990
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4b5979
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004b5990
add esp, 4
pop esi
ret
Function at 0x5038b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5208d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004f8a23
mov eax, dword [0x5b8de8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004f8955
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.005043b0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x503957
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x50394e
cmp al, 0xff
je 0x50394e
dec al
mov byte [ecx], al
jmp 0x503957
push ecx
call fcn.0050d7be
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x503988
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x50397f
cmp al, 0xff
je 0x50397f
dec al
mov byte [ecx], al
jmp 0x503988
push ecx
call fcn.0050d7be
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x50fe22
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x50fe5a
push dword [esi + 0x1c]
call dword [0x521524]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0050deaf
push eax
push dword [esi + 0x1c]
call dword [0x521534]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0050de87
jmp 0x50fe66
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x511517
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x511559
call fcn.005174d7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [0x52131c]
cmp eax, edi
je 0x511559
push eax
push esi
call dword [0x521320]
cmp eax, edi
jne 0x511550
xor eax, eax
jmp 0x511561
push eax
call dword [0x521324]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00511567
pop edi
pop esi
pop ebx
ret 4

Function at 0x517a07
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [fcn.005212f8]
cmp dword [esp + 0x10], 0
jne 0x517a35
push dword [esi]
call dword [0x52121c]
test eax, eax
je 0x517a53
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0051796d
jmp 0x517a53
mov eax, dword [esi + 0x14]
test eax, eax
je 0x517a53
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0051796d
test edi, edi
mov eax, edi
jne 0x517a3d
pop edi
push ebx
call dword [fcn.005212fc]
pop esi
pop ebx
ret 8
Function at 0x6a66a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov dh, 0xaa
lea esp, [esp]
jmp 0x6a66a2
rdtsc
mov dh, 0xaa
lea esp, [esp]
mov eax, ebp
mov dl, dh
mov al, ah
lea esp, [esp + 1]
jmp 0x6a66a8
pop dword [esp]
pop ax
mov byte [esp + 1], bh
add esp, 3
jge 0x6a665f
jl 0x6a6643
rol dword [edi - 0x29], 0xb2
inc ecx
invalid
jmp 0x6a667b
mov eax, ebp
mov dl, dh
jmp 0x6a666a
not cl
mov eax, 0x2a7e35da
not dh
xchg ah, dh
call fcn.006a66eb
lodsb al, byte [esi]
sub dword [ecx - 0x3766d428], edi
imul eax, dword [edx + 0x52d1f658], 0x66
pop eax
not cl
push edx
push word [esp + 1]
call fcn.006a66a0

Function at 0x6a7343
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
mov byte [esp], bh
mov byte [esp], ah
jmp 0x6a732c
jmp 0x6a72f0
pushal
mov word [esp], di
sub edx, eax
jle 0x6a730f
push esp
mov byte [esp], bh
mov byte [esp], ah
pushal
lea esp, [esp + 0x28]
jmp 0x6a7331

Function at 0x6a7477
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
call fcn.006a7343
jmp 0x6a7398
mov word [esp], sp
pop word [esp]
add esp, 1
ja 0x6a73f5
lea esp, [esp + 1]
jmp 0x6a739c
Function at 0x6cf2c6
Capabilities:
Encrypt data using aes

Disassembly:
ror ebx, 0x19
jmp 0x6cf2cf
push dword [esp + 2]
shl edx, 8
bsf di, si
inc bx
mov edi, 0x5ee8e854
jmp 0x6cf50c
mov ebp, ecx
lea ebp, [ebp + 0xc]
mov dword [ebp], edx
pop ebp
jmp 0x6cf516
xor edx, eax
inc si
lea esi, [edx + edx]
push ebp
jmp 0x6cf4f0
mov si, word [esp]
inc edi
mov eax, edx
sub esp, 0xe
cmc
jmp 0x6cf739
push dword [esp + 0xc]
xchg si, di
lea esp, [esp + 2]
shr eax, 0x10
lea esi, [esi - 0x1d]
jmp 0x6cf9f2
pop esi
mov bl, byte [esp]
jmp 0x6cf9d9
mov esi, eax
lea esi, [esi*4]
lea esi, [esi + 0x6a2e90]
mov eax, dword [esi]
jmp 0x6cf962
sub bl, dh
clc
push esi
jmp 0x6cf97a
lea edi, [ebx + edi]
mov bp, 0x38f9
and eax, esi
not ebp
mov bx, 0x158b
jmp 0x6cf999
pushal
stc
mov di, bx
not bh
mov al, ah
jmp 0x6cfa3f
xor eax, 0x1000000
mov ebx, ebp
jmp 0x6cf9c3
bsf si, ax
lea esp, [esp + 0x1c]
mov esi, 0xff
mov bl, bh
btr edi, esp
jmp 0x6cf9b2
pop word [esp]
lea ebp, [esp + edx]
lea esp, [esp + 2]
jmp 0x6cfa27
shr edi, 8
not bl
and edi, esi
inc ebp
push esp
jmp 0x6cfa06
mov edi, dword [edi*4 + 0x6a2e90]
mov bp, 0x8e89
setg bh
xchg ebx, ebp
jmp 0x6cfa4c
mov dword [esp], edx
stc
popal
mov ebp, dword [esp]
setbe bl
jmp 0x6cfa1c
mov ebp, dword [esp]
and edi, 0xff0000
inc bl
mov ebx, dword [ecx + 4]
jmp 0x6cfcb7
bts ebp, edi
and eax, 0xff000000
xor eax, edi
mov edi, 0xa4f03b22
call fcn.006cfc9b
neg ebp
xor eax, edi
call 0x6cfcd5
sbb ecx, dword [ebx + 0x6603247c]
pop edi
lea esp, [esp + 2]
jmp 0x6cff12
and edi, esi
mov edi, dword [edi*4 + 0x6a2e90]
rcr ebp, 0xb
rcr ebp, 5
jmp 0x6d0196
mov edi, edx
not bp
stc
push edx
mov word [esp], di
jmp 0x6cfeed
ror bp, cl
lea esp, [esp + 4]
mov ebp, 0xff00
pushal
call fcn.006d017f
lea eax, [ebp*4]
jmp 0x6d01cd
push ecx
mov ecx, edi
mov dword [ecx], eax
pop ecx
call 0x6d01a8
lea eax, [esi + 0x2d67126d]
mov eax, dword [ecx + 8]
sub esp, 0x18
push edx
cmc
jmp 0x6d01e1
xor eax, ebx
cmc
call fcn.006d021a
sub byte [esi + 0x7b65b3c], ch
cmp al, bl
push ebx
lds esi, ss:[ebx + 6]
mov cl, 0xb0
lea edi, [ecx + 0x10]
stc
xor ebx, eax
jmp 0x6d01c2

Function at 0x6cfc9b
Capabilities:
Encrypt data using aes

Disassembly:
mov di, bx
mov edi, edx
mov ebp, 0xa46c9484
mov bp, word [esp]
add bp, 0x46a6
jmp 0x6cfc9d
jmp 0x6cfc74
shr edi, 0x18
lea esp, [esp + 4]
movzx edi, byte [edi*4 + 0x6a2e90]
bswap ebp
jmp 0x6cfccb

Function at 0x6da43d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 0x2c]
rdtsc
rcr ax, cl
jmp 0x6da4bb
clc
lea esp, [esp + 0x20]
push ebp
jmp 0x6da410
lea esp, [esp + 4]
sub esp, 0x24
bsf dx, ax
pushal
jmp 0x6da426
mov ecx, dword [esi]
pop esi
sub esp, 0x1e
rdtsc
call fcn.006da462
lea esp, [esp + 0x20]
mov eax, 0x10b
call fcn.006da4e4
lodsd eax, dword [esi]
sub bh, byte [eax - 0x3465d521]
bound ebx, qword [ebp + 0x3c6ffec]
int 0x66
mov eax, 0x8b663447
add al, 0x24
lea eax, [edx + esi]
lea eax, [edx + ebp]
jmp 0x6da486
push esi
mov esi, ebp
lea esi, [esi + 0x3c]
jmp 0x6da479
Function at 0x8218d8
Capabilities:
Encode data using xor

Disassembly:
mov bl, 1
xor byte [ebx], dh
sub al, byte [ebp - 0x73]
and al, 0xd
lea esp, [esp + 0xd]
push dword [esp + 0xe]
pushal
pushal
lea esp, [esp + 0x5e]
call fcn.008218a1
cmc
jbe 0x8218b1
cmp dword [esi - 0x31], 0xffffffe5
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fisttp dword [esi]
cdq
pop word [esp + 0x11]
jmp 0x8218b7

Function at 0x824a5c
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0xc], dx
pushal
lea esp, [esp + 0x44]
call int.00824a3c
test byte [edx], al
nop
test dword [edx], 0x57c746b3
invalid
xor al, cl
jg 0x824a74
js 0x824a68
mov dword [eax - 0x37], edi
aad 0x44

Function at 0x83eb58
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], ax
bswap eax
jmp 0x83ea17

Function at 0x91a402
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
rdtsc
inc cx
lea ebp, [edx + ebx]
lea edx, [edx*4]
sub esp, 8
pop dword [esp]
mov edi, esi
mov si, word [esp + 2]
jmp 0x91a373
pushal
pop dword [esp + 0x14]
push dword [esp + 0x1a]
lea esp, [esp + 2]
lea esp, [esp + 0x24]
pushal
jmp 0x91a3a5
jmp 0x91a3e1

Function at 0x91a92d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 0xa]
mov byte [esp + 0x11], dh
mov dl, 0xf4
xchg bx, dx
mov cl, 0x32
pop word [esp + 0x14]
jmp 0x91a8cf
mov byte [esp + 0xb], ah
lea ecx, [ecx + 0x93]
xchg dword [esp + 0x1a], edi
shr ah, 1
mov si, 0xee75
rdtsc
jmp 0x91a89d
neg ebp
bswap ebp
mov word [esp + 9], bx
xchg ebp, edx
lea esi, [ebx + esi]
stc
jmp 0x91a915
add esp, 4
pushal
mov di, 0x3ced
setns dh
not dx
inc bx
jmp 0x91a8b7
lea ecx, [ebp - 0xff]
push word [esp + 0x11]
xchg ecx, edx
lea esp, [esp + 0x1b]
jmp 0x91a95f
xchg word [esp + 9], cx
rdtsc
lea eax, [ebx*4]
jmp 0x91a8fd
mov ebp, 0x932fafd2
lea edi, [ebx + edi]
pop bx
mov byte [esp + 3], ah
jmp 0x91a8eb
inc esi
mov dx, sp
mov bp, word [esp]
mov bl, bh
bswap eax
cmc
jmp 0x91a9b2
mov bl, bh
pop word [esp + 1]
lea edi, [ebp*4]
mov byte [esp + 2], bh
push word [esp + 3]
xchg cx, ax
jmp 0x91a93d
xchg ch, dl
mov word [esp], di
call int.0091a9c5
enter 0xffffffffffffc353, 0xffffffffffffffa6
push ebp
loopne 0x91aa04
rol dword [eax - 0x749905bd], 0xfa
mov di, dx
mov bx, word [esp + 2]
xchg edi, esi
bsr cx, cx
xchg bx, ax
clc
jmp 0x91a99c
Function at 0x91ab39
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov word [esp], sp
add al, dh
mov cl, 0x92
mov edi, ebp
mov bl, 0x20
jmp 0x91ab41
pop bp
xchg byte [esp + 2], dl
jmp 0x91ab1a
mov ch, byte [esp + 1]
not ch
pop ebx
mov eax, dword [esp]
cld
xchg si, ax
jmp 0x91abc5
xchg word [esp + 6], bp
mov word [esp + 2], bx
mov bx, dx
jmp 0x91ac13
btc esi, ebx
sub esp, 8
sub ecx, eax
lea edx, [esp + ebx]
btr edx, edx
mov dl, dh
jmp 0x91ab92
mov dh, byte [esp]
mov eax, dword [esp]
mov edx, 0xfea0e4c
lea edx, [esi + edi]
btc ebx, ebx
mov cl, ch
jmp 0x91aba9
xchg word [esp + 1], cx
cpuid
mov bx, 0x91af
xchg word [esp], ax
xchg byte [esp], cl
sub esp, 0x1e
jmp 0x91ac2e
pop esi
not ch
mov si, 0x5483
btr ebx, esp
mov bh, byte [esp + 1]
xchg esi, eax
jmp 0x91abda
mov ax, 0x56a5
bsf dx, si
lea esi, [esi + edi]
mov bx, word [esp + 6]
bsr si, cx
mov ebp, 0x700bff86
jmp 0x91abfb
rdtsc
not esi
call 0x91ac38
add dword [edi + 0x400f2444], 0xffffffbd
enter 0x41f9, 0xfffffffffffffff7
xchg si, bp
jmp 0x91ade2
xchg word [esp + 0x20], di
call fcn.0091ad45

Function at 0x91ac59
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, ah
mov dword [esp + 1], ebp
sub edi, eax
xchg word [esp + 0xb], bp
sub ecx, eax
clc
jmp 0x91aaa2
lea esp, [esp + 5]
clc
pop ax
xchg word [esp + 0xd], bp
push word [esp + 3]
jmp 0x91aa16
lea esi, [ebp - 0x3a951bc9]
xor dl, ch
bsf bx, si
xchg byte [esp + 4], al
lea eax, [esi + edi]
xchg ecx, edi
jmp 0x91aa2c
clc
lea esi, [edi*4]
xchg dword [esp + 0x10], edx
mov dword [esp + 0x15], ecx
not edi
push edx
jmp 0x91aa8b
xchg ch, dl
xchg byte [esp + 0xc], dl
mov edi, dword [esp + 7]
lea ebx, [edx + ebx]
sub esp, 4
mov al, 0x9e
jmp 0x91aa5b
xchg bx, cx
mov byte [esp + 0xd], bh
popal
mov ecx, 0xfaa204ea
cpuid
push edx
jmp 0x91ab5b
pop dword [esp + 0xe]
xchg dword [esp + 6], ecx
mov ecx, dword [esp + 0xd]
push dword [esp + 6]
rdtsc
mov si, 0xb
jmp 0x91aa77
xchg word [esp], dx
btr ecx, esp
xchg byte [esp], dl
mov bp, 0xf57b
cmc
mov ecx, 0x5f2164b6
jmp 0x91aaee
neg bh
xchg word [esp], bp
mov ebp, dword [esp]
xor si, 0xdc3c
mov bl, bh
stc
jmp 0x91aaba
mov edx, dword [esp]
xchg ah, bl
xchg di, ax
btr ebp, esp
call fcn.0091ab39
jne 0x91aaf3
push 0xd
cld
inc edx
popal
mov al, byte [0x24448b66]
add dh, ch
mov ax, word [esp + 2]
cmc
push word [esp + 3]
lea esp, [esp + 3]
mov dl, dh
rdtsc
jmp 0x91aadb
mov cl, ch
xchg word [esp + 1], bx
xchg cx, bx
rdtsc
mov cx, 0x5fbd
inc al
jmp 0x91ab05
mov edx, 0xbe3d7d86
add esp, 0x11
xchg edi, eax
mov bx, 0x252d
inc eax
pop dword [esp + 0xd]
jmp 0x91aa44
mov edx, eax
mov cx, bx
xchg byte [esp + 5], cl
pushal
mov dword [esp + 0x15], eax
jmp 0x91ab7a
Function at 0x91aca3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, di
lea esp, [esp + 0x25]
add bx, 0xc676
jmp 0x91ace3
sub bl, ah
mov byte [esp + 1], ah
xchg word [esp + 3], dx
cpuid
bswap ebx
pop si
jmp 0x91ad21
ror edi, 0x15
mov cx, 0xf75d
rcr ecx, 5
mov bp, 0xdb99
bswap edi
push esp
jmp 0x91acb1
lea ebp, [edx + ebx]
mov byte [esp], ah
mov byte [esp], ah
xor di, 0xeaec
mov bl, 0x70
mov ch, byte [esp + 1]
jmp 0x91ad74
mov byte [esp + 3], dh
mov dl, dh
lea esp, [esp + 0xb]
inc bl
mov byte [esp], ch
clc
jmp 0x91adb1
stc
not bp
sub esp, 8
btc ebp, edi
bsf cx, ax
xchg byte [esp + 8], cl
jmp 0x91ad51
push dword [esp + 3]
rdtsc
inc bp
pop si
rdtsc
xchg byte [esp], al
jmp 0x91adc8
pushal
xchg word [esp + 0x2e], bx
pop ax
mov si, bx
bsr bx, cx
jmp 0x91af6b
sub esp, 0x10
pop word [esp + 5]
mov dl, 0xbc
sub edx, eax
mov esi, 0x17117b04
mov ah, byte [esp + 2]
jmp 0x91ad88
mov byte [esp + 5], bh
and ax, 0x79e2
xchg edx, edi
mov ebp, dword [esp]
rcr edi, 0x19
not ch
jmp 0x91ad99
pop bx
sete ah
call fcn.0091ae4d
mov word [esp + 1], sp
mov cl, 0x12
mov byte [esp + 0x21], ah
mov ebp, esi
mov dword [esp + 0x22], ebp
lea esi, [edx*4]
jmp 0x91aeb3
Function at 0x91adec
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
add esp, 0xe
xchg byte [esp + 2], dl
jmp 0x91ae17
push edx
bsf di, ax
xchg di, bx
clc
ror esi, 1
bsf bx, si
jmp 0x91ae7a
mov dword [esp + 0x15], ecx
mov word [esp + 5], dx
lea edi, [eax - 0x51]
bsf si, si
push word [esp + 0x15]
jmp 0x91ae95
lea ebx, [esi*4]
pushal
lea edi, [eax*4]
sub esp, 0x12
setno ch
xchg byte [esp + 0x2e], al
jmp 0x91ae5d
mov edi, dword [esp + 0x1f]
rdtsc
rdtsc
lea esp, [esp + 0x38]
xchg dword [esp], ebx
neg ebx
jmp 0x91aee9
cld
sub esi, eax
cld
push esp
not ah
mov ax, 0x3c75
jmp 0x91aecf
pushal
xchg byte [esp + 2], dl
mov dword [esp + 4], ebp
lea eax, [esi*4]
mov si, sp
jmp 0x91af19
mov di, word [esp]
xchg dh, al
xchg word [esp], dx
xchg word [esp + 2], ax
push word [esp + 2]
add esp, 4
jmp 0x91aebd
mov byte [esp + 0x17], bh
push word [esp + 5]
cpuid
mov al, 0x3e
jmp 0x91af54
mov word [esp + 0x17], bx
cpuid
lea edi, [esp + esi]
rcr bh, 3
mov word [esp + 0x1f], sp
pop dword [esp + 0xf]
jmp 0x91af02
neg bp
setns dh
mov di, word [esp + 0x20]
mov bl, bh
mov dl, 0x54
mov edi, eax
jmp 0x91b640
lea ecx, [edx*4]
xchg bh, cl
sub bl, ah
mov dword [esp + 0x14], esi
jmp 0x91af31
not ecx
xchg dh, al
sub esp, 0x10
mov bp, word [esp]
not edi
rol cx, cl
jmp 0x91afba
mov ecx, 0x8512bf1a
btc edx, edi
lea edx, [edx + edi]
push dword [esp + 0xc]
btr ebx, edx
add esp, 0xb
jmp 0x91af88
push dword [esp + 9]
sub esp, 0x1a
xchg word [esp + 0x32], si
cld
xchg cx, si
xchg ah, bl
jmp 0x91b035
pop dword [esp + 8]
stc
mov ebx, 0x546b940a
mov eax, dword [esp + 7]
shr ebp, 0x1b
add al, dh
jmp 0x91afa3
btc esi, edi
cpuid
cmc
sub esp, 0x12
sete ch
mov ax, 0xe2c1
jmp 0x91afe3
popal
call fcn.0091b01e
xchg word [esp + 7], cx
push esp
pop dword [esp + 2]
setle dh
pop word [esp + 1]
jmp 0x91b068
neg bx
stc
mov ax, 0x4465
mov cx, bx
bswap edx
mov bp, word [esp + 4]
jmp 0x91b119
not bh
mov al, ah
xchg si, ax
lea ebx, [edx + edi]
lea esi, [edx*4]
stc
jmp 0x91b00c
lea esp, [esp]
rdtsc
neg cx
xchg byte [esp], dl
xchg ebx, eax
rdtsc
jmp 0x91b0eb
xchg ch, dl
bswap ecx
lea esp, [esp + 1]
cpuid
mov bp, word [esp]
rdtsc
jmp 0x91b0a3
lea ebp, [ecx + 0x22594d83]
call fcn.0091b100
inc ecx
ret 0x3750
add esp, 0
mov byte [esp], ch
lea edx, [ebp + 0x115b19e7]
mov esi, dword [esp]
mov edx, esi
bswap ebx
jmp 0x91b0cf
add esp, 1
xchg dword [esp], ebp
mov bp, di
add esp, 3
bsf cx, ax
pop word [esp]
jmp 0x91b0bd
lea esp, [esp + 0x43]
mov cl, ch
cld
neg dh
bswap ebp
xchg esi, edi
jmp 0x91b08c
lea ecx, [esi + 0xd]
pop word [esp + 0xe]
pop dword [esp + 7]
push dword [esp + 5]
inc cx
pushal
jmp 0x91b20f

Function at 0x91b01e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x16]
cpuid
bswap ebx
rol dx, cl
push dword [esp + 0x15]
jmp 0x91b053
xchg ecx, edi
mov edx, 0xc59deb92
inc bl
mov byte [esp + 0x17], ch
add esp, 0x17
xchg cx, ax
jmp 0x91b03b
Function at 0x91b39e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xc]
pop dword [esp + 0xc]
mov bl, bh
pop di
btc ecx, ebx
cmc
jmp 0x91b482
xchg edi, esi
xchg byte [esp + 0xd], cl
jmp 0x91b377
mov bx, 0x325d
xchg bh, cl
pushal
lea esp, [esp + 0x4d]
mov esi, 0x58f5d3c
bsf ax, ax
jmp 0x91b45c
pushal
not edi
cld
not ebx
pop dword [esp + 0x23]
btc edx, ebx
jmp 0x91b3a6
bswap esi
mov esi, 0x21313556
mov byte [esp], ch
lea ebp, [eax + 0x67854729]
lea edi, [esp + eax]
sub esp, 0x10
jmp 0x91b3c5
cpuid
cpuid
mov al, ah
mov cl, 0xb2
bsr si, bp
mov edi, ecx
jmp 0x91b444
mov dx, word [esp]
rdtsc
rdtsc
call fcn.0091b401
xchg bh, cl
xchg ebx, edi
add edx, ebp
lea edx, [edx + edi]
lea edi, [ebx + ebx]
mov dx, 0x83f5
jmp 0x91b40e
mov dl, 4
mov edx, esi
mov di, word [esp]
mov bx, 0xc4fb
xchg ch, dl
mov cx, dx
jmp 0x91b4b6
not dx
lea ebp, [esi*4]
mov dl, 0x14
cpuid
rol dx, cl
mov al, ah
jmp 0x91b425
xchg word [esp + 7], di
cld
mov bx, di
add esp, 0xf
lea ecx, [edx + edx]
lea esi, [ebp - 0xa7]
jmp 0x91b3e9
Function at 0x403725
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004038d5
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x403823
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4037c6
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x403809
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4037dd
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4037f8
test al, 0x40
je 0x4037ef
mov ecx, dword [edi + 0x20]
jmp 0x4037f6
test al, 0x80
je 0x403809
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x403809
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x403795
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret