joyce8/EMBER2024-capa huggingface dataset:
Function at 0x87b767
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror eax, 0x86
mov word [edi + eax - 0xfffff48], cx
cwd
cwde
pop ecx
pop ecx
jae fcn.00943216
mov edx, 0x2a92d51f
mov eax, 0x8792398c
inc ax
lea esi, [edx + esi - 0x2a92d523]
xor al, al
movzx ecx, dl
jle 0x947c47
mov ecx, 0x65966cbe
lea ecx, [ecx + ecx + 0x2221bb25]
movzx edx, cx
lea ebp, [ebp + edx*4 - 0x25288]
mov edx, dword [edx + ebp - 0x94a1]
xor edx, ebx
movsx eax, cl
push ecx
xchg ch, cl
sub edx, 0x67194e3b
jmp 0x8fc685
bts edx, ecx
add edi, eax
imul ecx, ecx
or edx, edx
call fcn.0084992d
mov ecx, 0x2d8882a1
mov eax, dword [esi + ecx*2 - 0x5b110542]
or cx, cx
movzx edx, cx
neg dx
lea esi, [esi + ecx*2 - 0x5b11053e]
xor eax, ebx
lea eax, [ecx + eax + 0x6884161c]
rol dl, 0x86
dec ecx
shr dl, 0x66
bswap eax
bswap edx
xadd edx, ecx
inc eax
sal ecx, 0xcf
push ecx
bswap eax
xor ebx, eax
sar dword [esp + ecx - 0x80000000], 0xcb
pop edx
sal ecx, 0x5d
adc edi, eax
movsx eax, cx
cwde
cwde
or ax, word [ebp + ecx*2]
imul ecx, ecx
setb cl
imul edx, edx
lea ebp, [ebp + ecx + 2]
btr edx, edx
bswap ecx
xor cl, byte [esi + ecx]
and dl, 0x38
lea esi, [esi + edx + 1]
xor edx, edx
or edx, edx
xor cl, bl
bts edx, edx
shl edx, 0xdb
adc cl, 0x2e
ror dl, 0x66
xor cl, 0xb6
btr edx, edx
xor dl, dl
adc edx, 0xa1232395
neg cl
inc dl
bt edx, edx
not cl
xor bl, cl
lea edx, [edx*4 - 0x5c51794a]
add ecx, esp
neg edx
mov byte [ecx], al
not dl
jmp edi
not eax
imul ecx, edx
xor ebx, eax
jmp 0x8c885a
mov eax, dword [esi + ecx - 0x1f]
xor eax, ebx
shl edx, cl
ja 0x9960a6
rol eax, 1
shr cl, 0x85
lea eax, [eax + edx - 0x5ad8a045]
sal cl, 0x44
shr cx, 0xcd
btr ecx, 0x33
xor eax, 0x2529c3ae
inc edx
jne 0x8e2acc

Function at 0x883516
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, eax
mov eax, 0x3d3f1d10
xchg ecx, edx
add eax, eax
movzx edx, byte [edx + esi - 0x4e0c008b]
mov dword [esp + eax - 0x7a7e3a20], ecx
lea esi, [eax + esi - 0x7a7e3a1f]
pop ecx
xor dl, bl
bts ecx, eax
bts cx, cx
cbw
rol dl, 1
add ecx, eax
xor cl, cl
bswap ecx
neg dl
push ecx
inc dl
rol dl, 1
xor dl, 8
xor bl, dl
push ecx
lea edx, [esp + edx + 8]
and ecx, eax
sar cl, 0x21
mov cx, word [ecx + edx - 0x1c0010]
neg al
lea edx, [eax*8 - 0x3fdc70d1]
lea ebp, [ebp + eax - 0x7a7e00e2]
mov word [ebp + eax - 0x7a7e00e0], cx
btc eax, edx
lea ecx, [eax + edx - 0x32d3cbe8]
pop ecx
pop ecx
jae fcn.009338ec
Function at 0x884bf4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx + edx*2 - 0xa3a00d0]
rol ecx, 3
mov dword [esp + edx - 0x2035a73b], edx
and dx, dx
jp 0x942a0b
sbb ecx, 0x8e14ee39
mov eax, edx
neg ecx
lea eax, [eax + edx*2 - 0x47f63efe]
or eax, edx
xor ebx, ecx
add eax, edx
bts eax, edx
add esi, ecx
sub ax, dx
lea ecx, [edx + eax - 0xb77cbfd]
sal ecx, cl
mov dx, word [edx + edi - 0x2035a73b]
adc byte [esp + eax - 0x58f5b7ba], ch
adc eax, 0x8f9aaf04
adc edi, 2
ror eax, 0xed
neg al
cwde
movzx eax, byte [ebp + eax - 0x447d]
adc dword [esp], ecx
adc ebp, 0
add ecx, ecx
imul ecx, ecx
jno 0x89c5ba
xor al, bl
call fcn.0093f14f
jmp 0x9c4154
lea esp, [esp + 8]
jmp ebp
push dword [esp + 4]
popfd
pop edi
mov esi, dword [esp + edi - 0x17943eba]
mov edi, dword [esp + edi - 0x17943eb6]
lea esp, [esp + 0xc]
push 0xc6013100
push 0xdba430aa
jmp 0x923eef

Function at 0x88564d
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror cl, 1
shl dword [esp + edx*8 + 4], 0x56
adc cl, 0xa4
inc dl
not al
mov dword [esp + edx - 1], edx
xor cl, 0x9c
neg edx
adc cl, 0x83
cwde
rol cl, 1
sal word [esp + 3], 0x61
xor bl, cl
sub ebp, 2
inc al
idiv word [esp + 5]
not eax
mov word [eax + ebp], cx
mov byte [esp + eax*2 + 4], al
lea ecx, [eax + edx*8 + 0x4e17c519]
pop eax
pop eax
jmp fcn.009338ec

Function at 0x8861bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol ecx, 1
mov dword [esp], eax
lea eax, [eax + eax*4 - 0x70fe93f2]
xor ecx, 0x93900888
jmp 0x9c0ffa
movzx edx, word [esp + 4]
xor ebx, ecx
sal edx, 0x6b
sal eax, 0xc7
adc esi, ecx
add eax, 0x28a5c229
lea eax, [edx*4 - 0x72c039d6]
jno 0x91f3dd
not ecx
call fcn.00868f90
retf

Function at 0x8895fd
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Terminate process

Disassembly:
lea esi, [edx + esi - 0x4f60001]
sal ax, 0xab
mov word [esi + edx*2 - 0x9ebfffe], cx
not ax
pop eax
pop eax
pop edx
jne fcn.00942899

Function at 0x889634
Capabilities:
Execute anti-debugging instructions
Packed with generic packer
Terminate process

Disassembly:
bswap eax
add cl, dl
bswap ecx
rol eax, 1
sub cx, 0xd23
adc eax, edx
call fcn.009bb5ee

Function at 0x88a6e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov dword [esp + 0xc], 0x2450ac0c
lea esp, [esp + 0xc]
call fcn.009a586c

Function at 0x88b2aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi + edx*4 - 0x40031c3f]
call fcn.009a9901

Function at 0x88c678
Capabilities:
Execute anti-debugging instructions

Disassembly:
cwde
not cl
mov dword [esp + eax*2 - 2], 0x561a4d2b
jne 0x8dcf02
mov eax, 0x1ca26014
mov cx, word [edi + eax*4 - 0x72898050]
push eax
dec al
lea edi, [edi + eax - 0x1ca26011]
lea esi, [esi + eax - 0x1ca26014]
xor al, 0x9c
movzx eax, byte [esi + eax*4 - 0x7289823c]
mov edx, 0xb908313a
push edx
rol edx, 0x8b
xor al, bl
shr edx, 0x1d
sar edx, 0xfe
sbb al, 3
rol al, 1
sal edx, 0xb8
inc al
bt dx, dx
jae 0x8d968f
Function at 0x897fb8
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp + ecx - 0x6b334d9b], edx
sal dword [esp + ecx - 0x6b334d9b], cl
mov dword [ebp + ecx - 0x6b334d97], eax
mov eax, dword [esi + ecx - 0x6b334d9b]
bts ecx, ecx
xchg dword [esp + ecx - 0x6b334d9b], ecx
adc esi, 3
shr cx, 1
sbb cl, ch
call fcn.00963b03
not eax
bts edx, 0x88
setae cl
sbb ecx, edx
inc eax
not eax
ror dword [esp + edx - 0x56bd29b8], 0xb7
setb dl
ror eax, 1
pop ecx
btr dx, cx
add dx, word [esp + edx - 0x56bd2900]
inc eax
dec dword [esp + ecx*2 - 0x43217654]
rol eax, 2
inc dl
xor eax, 0x700eb409
xadd byte [esp + ecx - 0x2190bb26], dl
rol eax, 2
dec dx
push ecx
btr edx, edx
xor ebx, eax
xor word [esp + edx - 0x56bd61a5], 0xc4ab
push edx
adc esi, eax
or cl, byte [esp + ecx*2 - 0x43217646]
pop eax
and ax, dx
mov dword [esp + eax - 0x56bd61ab], esi
ret 8
sub edx, 0xf1fa635
rol ecx, cl
ror eax, 2
push edx
pop ecx
xor ebx, eax
sar ecx, 0x1b
ror edx, 0xad
xor cl, 0x32
adc ebp, eax
mov eax, dword [edi + edx*8 - 0x29213890]
salc
jmp 0x95dd0c
call fcn.004016be
inc edx
mov word [eax - 0x2f0c46af], ds
loope 0x897fa3
lds esp, [esi + edi*8]
jne 0x897f83
in al, dx
add byte [ebx], bl
das
sbb ebp, dword [edi]
and ch, ah
dec edx
and byte [edx], ah
mov esi, 0x8a0c4469
cdq
lodsd eax, dword [esi]
cmp eax, 0x1cdddf1c
cmp bl, 0x75
xor byte [esi - 0x4c], ah
aas
and dh, byte [edi - 0x34]
jns 0x897fcd
mov bl, byte [esi + 0x77]
mov ebx, dr7
sub eax, 0xd58f7cd9
fstp st(0)
push esi
imul edi, dword [ebx + 0x7fabdd53], 0xffffffc3
cmc
arpl word [edi], cx
rcl byte [edi + 0x63], 0x28
adc al, 0xe2
and ecx, esi
sar dword [ebx + 0x60997c36], cl
clc
adc esi, dword [esp + esi*2 + 0xfb065cb]
sub cl, bh
sbb dl, dh
pop edx
cmp dword [eax], eax
sbb edi, dword [ebx + esi*4 + 0x442aebb2]
lodsd eax, dword [esi]
xor byte [ebx + ebp*4 - 0x184234da], ch
lds edi, [ecx + 0x750ba1bc]
movzx eax, cl
xchg ah, al
mov ecx, dword [ebp + eax - 0xbc00]
or ax, 0x822
mov eax, dword [eax + ebp - 0xbc1e]
push 0x6b334d9b
imul ecx
mov ecx, dword [esp]
jmp 0x897df8
mov dx, word [eax + edx*4 - 0x14909c48]
add edi, 2
add ecx, ecx
mov eax, 0x541c5ebb
sub eax, eax
mov word [eax + edi], dx
add eax, ebp
jmp eax

Function at 0x89dbc9
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr cx, 0x4f
mov dword [ebp + eax*2 - 0x350], edx
ror eax, 0x73
je fcn.009338ec
mov edx, 0xd9aabe2a
call fcn.008bcb01
and ecx, ecx
xor edx, 0x7d97cb2e
sub eax, eax
dec edx
bswap eax
push eax
xor ebx, edx
inc cl
inc ecx
add edi, edx
not dword [esp + eax]
mov ebp, dword [ebp + eax*2]
mov dword [esp + eax*2], ecx
shl byte [esp + eax*2], 0x23
btr ecx, ecx
pop eax
jb fcn.008f8cf2
btc dx, dx
add edi, ecx
mov dword [esp], 0x2a263c10
movsx ecx, dx
movzx edx, byte [esi + ecx*8 - 0x2a9f8]
and eax, ecx
bts cx, cx
lea esi, [esi + eax*8 - 0xa91f]
and dword [esp + eax*4 - 0x5490], eax
pop ecx
xor dl, bl
ror dl, 1
btc ecx, ecx
adc dl, 0x12
sar cx, cl
xadd cl, al
ror eax, 0x25
not dl
btc ax, ax
sal cx, 0xc5
ror ax, 0x42
inc dl
cbw
xor bl, dl
ror eax, 0xe7
lea ebp, [ecx + ebp - 0x4484]
rol eax, 0x69
jae 0x87c6af
Function at 0x89e3e3
Capabilities:
Encode data using base64

Disassembly:
bts ecx, 0x9a
lea edi, [edi + ecx*2 - 0x8020000]
add cl, 0x9e
sub ecx, ecx
mov dword [esp + ecx*4], 0xc30c2a0a
mov word [edi + ecx*2], ax
mov edx, dword [ebp + ecx]
lea ebp, [ebp + ecx*4 + 4]
jbe 0x8dce5d
push ecx
xor edx, ebx
shr ecx, 0xe1
call fcn.009a3d89

Function at 0x8a104a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
pushfd
mov ebx, 0x8688001e
add ebx, 0xb1b58294
movsx ebx, bl
sub bl, 0xaf
call fcn.009934ab

Function at 0x8a172c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp + eax - 0x1d87], edx
shr cx, cl
mov edx, dword [esi + eax*8 - 0xec38]
mov dword [esp + eax - 0x1d87], 0xffb93f8d
lea esi, [eax + esi - 0x1d83]
xor edx, ebx
sub ax, ax
dec eax
rol ax, 0xa2
xor edx, 0x28b06207
btc ax, 0xb6
ror edx, 2
call fcn.00887a66
mov ecx, 0x91118a9f
sub edi, 4
lea eax, [ecx - 0x28548a64]
btr eax, ecx
mov edx, ecx
mov edx, dword [edi + eax - 0x68bd003b]
adc cl, ch
adc ecx, ecx
xor edx, ebx
shl eax, 0x5e
dec edx
ror edx, 1
sal eax, cl
sar al, 0xa1
sar cx, 0xc1
sbb edx, eax
lea ecx, [ecx + eax*4 - 0x2d462859]
xor edx, 0xb39bddbf
not eax
lea eax, [ecx - 0x2858d2ed]
xor ebx, edx
ror ax, 0xe6
add ebp, edx
push ecx
mov edx, esi
shr word [esp], 0x4c
div cl
div al
sub esi, 2
or cl, byte [esp]
call fcn.008dce42
adc ebp, eax
jmp ebp
not ecx
inc eax
inc ecx
rol ecx, 1
push eax
not ecx
pop edx
call fcn.0091efd6
call fcn.008f11a0
lea ebp, [ebp + eax - 0x1d8b]
push ecx
sar ecx, cl
jns 0x8a0a38
mov eax, dword [esi + ecx - 0x72958793]
rol cx, 0x2e
shl ecx, 0xba
sal ecx, 0xc
xor eax, ebx
add ecx, ecx
sbb ecx, ecx
lea eax, [ecx + eax + 0x53116f9c]
ror eax, 2
btr cx, cx
btr ecx, ecx
shr ecx, 0x28
neg eax
or cl, ch
jle 0x8a447b
xor ebx, eax
ror cl, 0x61
bswap ecx
add cl, 0x83
adc ebp, eax
movzx eax, byte [esi + ecx*2 - 0x1c7f2]
lea esi, [esi + ecx - 0xe3f8]
shr cl, 0x64
xor al, bl
inc al
xadd byte [esp + ecx*8 - 0x71877], dl
rol al, 1
pop ecx
ror cx, 0xe
neg al
dec cx
and dl, cl
cmovg edx, ecx
sbb al, 0x26
imul dx, dx
xor bl, al
call fcn.0098da05
setle cl
adc eax, ecx
imul ecx, ecx
shl cx, cl
rol eax, cl
call fcn.00945acc
mov eax, 0x8280cf3e
mov ecx, 0x7613b71e
movzx ebp, al
mov esp, edi
pop ecx
cdq
movzx esi, ax
popfd
push ebp
mov esi, dword [esp + ebp - 0x3a]
mov edi, dword [esp + ebp*4 - 0xf0]
jmp 0x965d65
cwde
cdq
mov ebp, dword [esp + ebp - 0x32]
cdq
mov ebx, dword [esp + 0x10]
cbw
jmp 0x91c144

Function at 0x8a1d05
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, edi
shr ax, 0x88
sbb ecx, eax
pop eax
lea edi, [ecx + edi - 0x2ad2d]
xor ecx, ecx
mov word [edi + ecx], dx
jns fcn.008ac5bb
mov ecx, 0x3d13a487
bswap ecx
fsub qword [ebp]
movzx eax, cx
movsx edx, cx
rol ax, 0xac
lea esi, [esi + eax*4 - 0x344d0]
mov ecx, dword [esi + eax - 0xd133]
neg dl
js 0x95068e
xor ecx, ebx
sub ecx, 0xfb0f9b09
and eax, edx
neg ecx
neg ax
call fcn.0096b061
Function at 0x8a3673
Capabilities:
Execute anti-debugging instructions

Disassembly:
sar ecx, cl
mov cx, word [eax + edx - 0x4abbff05]
lea edi, [edi + edx - 0x4abbff03]
mov dword [esp + edx - 0x4abbff05], edx
push edx
not dword [esp + edx - 0x4abbff01]
mov word [edx + edi - 0x4abbff05], cx
add edx, dword [esp + edx - 0x4abbff02]
call fcn.00894549
mov cl, byte [ebp + edx*8 - 0x1bfffe]
sal edx, 0xe1
lea ebp, [edx + ebp - 0x6fffe]
add edx, 0xc9b09731
or al, cl
mov ecx, 0xea2ca803
call fcn.008e52ea
mov eax, 0x8905c408
lea edx, [eax + eax + 0x337b31e]
mov eax, dword [esi + edx*4 - 0x550cecb8]
mov ecx, 0xe4351f34
and edx, edx
lea esi, [esi + edx - 0x15433b2a]
xor eax, ebx
not ecx
call fcn.00901895

Function at 0x8a6396
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edx
push ecx
add dword [esp + eax], ecx
rol ecx, 0xce
lea edx, [edx + eax*2 - 0x19b4382d]
xor ecx, 0x29abb48e
add eax, 0xb5196635
sbb al, al
neg edx
xor ebx, edx
cbw
bt ecx, eax
jb 0x937679
adc edi, edx
mov edx, dword [ebp + ecx - 0x29abb48e]
add dword [esp + ecx*2 - 0x5357691c], ecx
xor ax, word ss:[edx + ecx*2 - 0x5357691c]
bswap ecx
add ebp, 2
mov word [ebp], ax
pop edx
jmp edi
btr edx, 0x83
movzx eax, byte [esp + edx - 0x5c21deac]
mov ebp, dword [ebp + ecx - 0x3801]
pop eax
pop ecx
jb fcn.009338ec
pop edx
mov edx, dword [edx + ecx - 0x1201bfa9]
mov eax, 0xe9ac4cba
ror eax, 0x2f
mov dword [ebp], edx
lea ecx, [eax + eax*4 + 0x5c1a85bb]
xchg ecx, eax
sub eax, ecx
mov edx, dword [esi]
adc esi, 3
sal cx, 0x62
xor edx, ebx
call fcn.00402159
fadd qword [ebp]
sub esi, 4
mov eax, dword [esi]
mov edx, 0x958e3f86
movzx ecx, dl
btc dx, dx
xor eax, ebx
lea edx, [ecx + edx*4 - 0x4df9f065]
or edx, edx
jo 0x4071de
dec eax
sar dl, cl
rol eax, 1
xchg ecx, edx
not eax
shl cl, 0x24
sar dl, 0x63
rol eax, 1
rol dx, 0x61
call fcn.0084a455

Function at 0x8a681d
Capabilities:
Execute anti-debugging instructions

Disassembly:
js 0x97ddf3
movzx eax, dl
mov edx, dword [eax + edi - 0x1e]
movsx ecx, ax
btr ax, 0x26
jb 0x83b33e
xor edx, ebx
rol cx, 8
sbb edx, 0xad881d00
add cl, ah
add ecx, eax
xor edx, 0xec881a3e
xchg ecx, eax
inc edx
mov dword [esp + eax - 0x1e1e], eax
xor cl, ah
call fcn.008b977c
sub word [esp + edx*2 - 0x118ed46d], ax
adc edi, ecx
push eax
mov ecx, dword [ebp + edx - 0x8c76a37]
lea ebp, [ebp + edx - 0x8c76a33]
add dx, 0xe83c
add ax, 0x2b9a
movzx eax, byte [esi + edx - 0x8c75273]
xor dword [esp + edx*2 - 0x118ea4e6], edx
bts dx, dx
not byte [esp + edx - 0x8c75275]
lea esi, [esi + edx - 0x8c7527a]
imul edx, edx
sar dl, 0x61
shl dx, 0x43
xor al, bl
mul edx
sbb ecx, 0xfdb4b106
xor ecx, 0x2e195f39
rol ecx, 1
shr eax, 0x5e
btc ax, ax
imul eax, edx
neg ecx
imul eax
lea edx, [edx*8 - 0x1513969]
ror eax, 0x47
xor ebx, ecx
jmp 0x8abfd4
Function at 0x8a9383
Capabilities:
Execute anti-debugging instructions

Disassembly:
iretd
not edx
mov dword [esp + eax - 0x674800cb], 0x9c092c3b
pop eax
and ecx, 0x60abde9a
rol edx, 2
xor edx, 0x5c24293c
neg cl
rol al, 0xa4
rol eax, 0x5e
inc edx
ror cx, 0xed
imul ax, cx
sbb ecx, 0x2b36389a
xor ebx, edx
btc cx, 0xae
not eax
add edi, edx
cdq
mov ebp, dword [ebp + eax - 0x18fd0fff]
neg edx
bts edx, edx
jae fcn.009338ec
push es
xor eax, 0xdd6a0547
ror byte [ecx], cl
push 0x23
aaa
sal byte [0xf6bf95f4], 0xb
push 0x56
jge 0x8a937f
hlt

Function at 0x8aad95
Capabilities:
Execute anti-debugging instructions

Disassembly:
or edx, ecx
adc edi, eax
pop edx
pop edx
pop eax
pop edx
jmp fcn.009338ec
Function at 0x8ab24b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol eax, 2
and ecx, ecx
inc cl
not eax
call fcn.0093f1a9
mov eax, 0x4f201a10
mov ecx, dword [ebp + eax - 0x4f201a10]
lea ebp, [eax + ebp - 0x4f201a0c]
xor ecx, ebx
mov edx, eax
ror eax, 0xbd
shr ax, 0x65
neg ecx
and ax, 0xd0aa
add al, ah
bswap ecx
ja 0x948ffa
cdq
dec eax
bswap ecx
sub ecx, 0xed9bc19f
bswap ecx
shr al, 0x62
neg edx
xor ebx, ecx
add edi, ecx
btr edx, eax
adc dx, word [ebp + edx*4]
mov ecx, 0x34181e24
mov cl, byte [ebp + eax - 0x2a2fe]
shr al, 0xc4
adc al, ah
lea ebp, [ebp + eax - 0x2a3a1]
ror al, 0x42
xor eax, eax
sbb eax, 0xed86c110
sal dx, cl
jmp 0x9b3d3e
lea eax, [edx + edx + 0x3baf321d]
mov dword [ebp + edx*2 - 0x285ae57c], ecx
cwde
bt edx, eax
jae 0x9a82f1
mov edx, dword [esi]
mov ecx, 0x1eb8b285
mov eax, 0x4b2ae6a9
shl cl, 0x41
lea esi, [esi + eax - 0x4b2ae6a5]
sub eax, ecx
xor edx, ebx
push ecx
lea edx, [edx + ecx*2 - 0x40fe831b]
shl cx, 0xec
ror eax, 0x7d
pop ecx
not edx
shr eax, 0x8c
neg edx
add eax, ecx
push eax
ror edx, 1
mov word [esp + ecx - 0x1eb8b208], 0x7390
inc edx
cwde
sar cx, 0x44
stc
inc esp
xor ebx, edx
dec ecx
xadd dword [esp + ecx*2 - 0x3d71f63e], ecx
adc edi, edx
xchg ch, cl
call fcn.0084531a
sbb esp, dword [ecx - 0x6ee21987]
xlatb
pop ebx
fscale
push eax
and al, 0x49
int 0xa9
dec esp
dec eax
add eax, 0x54b497b9
mov byte [ebx + 0x4b], cl
dec ebp
mov bh, 0x63
inc eax
push ss
and ebx, dword [ebx]
xor dword [ebx + 0x13], 9
jno 0x893e39
ror dword [edx + 0x5e7f3303], 1
sub ecx, dword [0xab0ed580]
xchg edx, eax
add dh, byte [ebx]
add al, 9
add byte [eax + 0x2fff067], ah
pop es
add eax, 0x6bbe7601
sub eax, 0xf207a5a5
mov bh, 0x56
cmpsd dword [esi], dword es:[edi]
add eax, 0xa4bcb177
push es
vpsadbw xmm3, xmm2, xmmword [edi]
aas
dec ecx
lodsb al, byte [esi]
cmp dword [ecx - 0xd], edx
push ecx
aad 0x88
imul ecx, dword [edx - 0x775fc631], 0x2a
mov esi, 0x9eba069f
jmp 0x33f014bf
movsx eax, dl
lea ecx, [ecx + edx + 0x7a8757aa]
jg 0x8540ba
call fcn.009288c3
mov eax, 0xcabd0933
bts ax, 0x82
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
mov edx, 0x542d32be
bts dx, dx
lea ebp, [ebp + edx - 0x542d72ba]
btc edx, edx
or ecx, eax
not ecx
jmp 0x893ddd
lea esi, [esi + edx - 0x142d72c2]
mov eax, dword [edx + esi - 0x142d72be]
xor eax, ebx
mov ecx, edx
bswap eax
inc edx
neg cx
sub edx, ecx
xor eax, 0x759ce59c
imul ecx, edx
ror edx, 0xe
bts cx, cx
inc eax
not cx
ror eax, 1
and edx, edx
shr edx, 6
lea eax, [eax + edx - 0x62daf43c]
adc edx, edx
not edx
xor eax, 0x463c2d3c
ror edx, cl
sbb ecx, 0x2db73f14
add cl, ch
inc eax
sal edx, 0x76
cmovs ecx, edx
shl cl, 0xe5
xor ebx, eax
btc ecx, 0x1c
dec edx
call fcn.0088c3c1
btr ecx, edx
mov edx, dword [ebp + ecx - 0x42c51559]
xchg byte [esp + ecx - 0x42c5155c], cl
btc cx, 0x85
neg cl
mov cl, byte [ebp + ecx - 0x42c515d8]
push 0x9d0a2f88
adc ebp, 5
shr word [esp + 3], 0x4d
inc dword [esp + 5]
setge byte [esp + 7]
shld eax, edx, cl
or byte [esp + 4], 0x18
setg byte [esp + 7]
mov dword [ebp], eax
mov edx, 0x39b991a9
mov dword [esp + edx*2 - 0x73732352], edi
ret 8
mov ecx, 0x5715f329
shl eax, cl
mov word [ebp + ecx - 0x5715f329], dx
jmp edi
Function at 0x8b060f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, dword [esi + ecx*8]
btr eax, eax
pop edx
cwde
adc esi, 4
and eax, 0xb144302
xor ecx, ebx
movzx edx, byte [esp + eax - 0xb1440fe]
mov byte [esp + eax - 0xb1440fd], al
lea ecx, [eax + ecx - 0xea16009]
xor dx, 0x790b
not ecx
cwde
neg ecx
or edx, 0x9c15de10
xchg byte [esp + eax*4 - 0x10403], al
sub al, 0xa
ror ecx, 1
inc ecx
xor ebx, ecx
add edi, ecx
xchg dword [esp + eax - 0x41f4], eax
pop edx
pop eax
jmp fcn.009338ec

Function at 0x8baac9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp]
mov ecx, 0xbcb8638a
xor edx, ebx
inc edx
movzx eax, cl
sal eax, cl
rol eax, cl
xor edx, 0x800834b2
xchg cl, al
bt eax, ecx
setb al
neg edx
neg ecx
setno al
cwde
lea edx, [edx + ecx*2 - 0x16fe385d]
or ax, cx
bt eax, 0xc
xor ebx, edx
xor eax, 0x979575a5
adc esi, edx
lea ebp, [ecx + ebp - 0x43479d01]
dec ecx
not al
movzx edx, byte [ebp + ecx - 0x43479cff]
lea ecx, [eax + 0x1987cbb5]
add cx, ax
shr al, 0x26
xor dl, bl
ror cx, cl
adc dl, 0xb8
not dl
sub eax, 0x72b8f82e
xor dl, 0x87
xadd cx, ax
ror dl, 1
and ecx, ecx
shl cx, cl
xor eax, ecx
push 0x5aa01915
mov word [ebp], dx
mov edx, 0x732ba0b2
lea ecx, [edx*8 + 0x4f209911]
mov dword [esp + edx - 0x732ba0ae], 0xdbb23e0f
mov ecx, dword [esi + edx - 0x732ba0b2]
lea eax, [edx + edx*4 - 0x447ed9df]
lea esi, [esi + edx - 0x732ba0ae]
xor ecx, ebx
neg dword [esp + edx - 0x732ba0b0]
call fcn.0087e673
adc esi, 1
mov ecx, eax
push ecx
and ecx, 0x4d3e8391
lea edi, [edi + ecx - 0x40108281]
shl ax, 0xeb
movzx eax, byte [edi + ecx - 0x40108280]
sar ecx, 0x71
xor al, bl
sub al, 0x9c
add byte [esp + ecx*8 - 0x1003d], 0x28
adc cl, 0x2d
rol al, 1
add dword [esp + ecx - 0x2036], 0xfc2a8c30
sal ecx, 1
adc al, 0x9b
jmp 0x8f1370
not al
call fcn.008af78b
sub esi, 2
mov eax, 0x13158b82
movzx edx, word [esi + eax - 0x13158b82]
xor dx, bx
movzx ecx, al
bts eax, eax
rol ecx, cl
ror dx, 1
add eax, 0x4bb5c89
adc dx, 0x1385
sub cx, 0x1aa9
neg dx
inc eax
sub dx, 0x9512
shr ax, 0x8e
jae 0x862b26
xor dx, 0x7d0a
ror ecx, 0x61
dec dx
ror dx, 1
cbw
idiv al
not dx
bts ecx, 0x39
jae 0x8fdcac
mov edx, 0xc9a8770d
sub ebp, 1
neg edx
mov eax, edx
movsx ecx, dl
movzx edx, byte [ebp + eax*2 - 0x6caf11e6]
xor dl, bl
not dl
inc dl
xor dl, 0xb
cbw
rol dl, 1
not al
xor bl, dl
xadd cx, ax
adc eax, eax
shl cx, 0xa7
lea edi, [edi + eax - 0x6cafffeb]
mov dword [edi + eax - 0x6cafffe7], edx
lea ebp, [ebp + eax - 0x6cafffeb]
sbb al, ch
shr ecx, 0xd0
mov ecx, dword [ebp + ecx*2 - 0x1fffe]
xor ecx, ebx
or ax, ax
ror ecx, 1
call fcn.0099f4b8
mov eax, 0xca248720
jmp 0x8f5a4c
movsx edx, ax
mov dx, word [esi]
movsx ecx, ax
xchg ecx, eax
rol ecx, 0x6b
mov cl, byte [esi + ecx*2 - 0x48720ca0]
shl ax, 0xa9
or eax, eax
adc esi, 2
sal ax, 0xa7
xor eax, eax
shl dx, cl
push eax
mov word [esi + eax], dx
or eax, eax
add al, 0x22
pop eax
lea edi, [eax + edi - 4]
mov edx, dword [edi + eax*2]
inc eax
xor edx, ebx
mov ecx, 0x302fac92
bt ecx, eax
sub edx, eax
neg eax
xor edx, 0xbc07bb3f
call fcn.00912ee4
xor eax, 0xf2b15aae
xor bx, dx
sub edi, 4
lea ecx, [ecx + ecx*8 - 0x4f9da72]
bts eax, 0x18
sal cx, 0xac
mov dword [edi], edx
call fcn.0092269f
Function at 0x8badd7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x9b9910a5
adc edi, ecx
movsx ecx, byte [esp + 4]
btc cx, 0x98
ror cl, 0xa1
pop ecx
pop edx
jo fcn.008f8c19

Function at 0x8badf6
Capabilities:
Execute anti-debugging instructions

Disassembly:
add cx, ax
pop eax
jno fcn.00942899
mov word [ebp], ax
pop eax
jmp fcn.009338ec

Function at 0x8c0f23
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
adc ebp, 5
xor dword [esp + 4], 0xfeb2c993
adc byte [esp + 4], 0x83
shld edx, eax, cl
dec byte [esp + 6]
mov dword [ebp], edx
mov eax, 0x7b06b1bd
lea esi, [esi + eax - 0x7b06b1c1]
cdq
btc eax, 0x8b
xor edx, dword [esi + eax - 0x7b06b9bd]
call fcn.008b4ffc

Function at 0x8ce136
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror byte [esp + edx - 0x4f3ab382], 0x27
add cl, dh
lea ebp, [edx + ebp - 0x4f3ab387]
or edx, 0x2906ab0c
mov dword [ebp + edx - 0x6f3ebb8f], eax
pop eax
jno fcn.009338ec
mov edx, dword [edi + edx*2 - 0xc3c91fc]
neg eax
pop eax
call fcn.0094d606
bts ecx, ecx
add edi, edx
push eax
mov ecx, dword [ebp + ecx - 0x2b1750b1]
call fcn.008f5aab
mov ecx, 0x1c10868b
lea esi, [esi + ecx*4 - 0x70421a30]
mov ecx, dword [esi + ecx*4 - 0x70421a2c]
mov edx, 0xb4080780
mov eax, 0x7727891c
xor ecx, ebx
dec ecx
or eax, edx
ror ecx, 1
dec ecx
not edx
ror ecx, 3
bswap ecx
inc dl
xor ebx, ecx
inc eax
add edi, ecx
ror eax, 0x8a
lea ecx, [eax + eax + 0x5f3ec90f]
mov edx, dword [edx + ebp - 0x4bf7f880]
bswap eax
xchg cx, ax
xor ecx, eax
mov ecx, dword [ebp + 4]
adc ebp, 8
call fcn.0085db1f
inc ecx
push eax
dec dword [esp + eax - 0x1c90d02a]
xchg dword [esp + eax*4 - 0x724340a8], eax
rol ecx, 1
neg edx
xor ebx, ecx
xor edx, 0x4f3ab383
adc edi, ecx
cwde
movzx ecx, word [esp + edx - 0x4f3ab383]
mov eax, ebp
jmp 0x8a53f5

Function at 0x8d0136
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + eax - 0xd2], eax
movsx edx, byte [esp + eax - 0xd2]
lea ebp, [ebp + eax*8 - 0x6b2]
mov word [ebp + eax*4 - 0x358], cx
lea ecx, [eax + eax - 0x4bcd2fda]
shl dword [esp + eax - 0xd2], 0xf3
btc ecx, ecx
pop edx
pop ecx
jae fcn.008f8c19
mov dword [esp + 0x34], ebx
jmp 0x99c0a7