joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70efcd
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0070efff
lea esp, [esp + 2]
jmp 0x70f043
not edx
xchg ebx, edx
cmp edi, eax
jnp 0x70f02d
jp 0x70f055
movsb byte es:[edi], byte es:[esi]
cmp bl, byte [ebp - 0x54]
sbb al, 0x51
shl byte [esi - 0x79], 1
fidiv dword [ebx - reloc.MSVCRT.dll_strncpy]
sti
add byte [eax], al
add byte [edx - 0x29], dl
inc edi
and dl, cl
insd dword es:[edi], dx
enter 0xffffffffffffde48, 0xffffffffffffffb9
dec eax
clc
in ax, 0x75
sbb al, 0xef
pop edi
xchg esp, eax
pop es
scasb al, byte es:[edi]
xchg dx, bx
mov bl, 0x44
not dh
jmp 0x70f15c
mov dx, 0x3c71
jmp 0x70f714

Function at 0x70efff
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 6
jns 0x70efd2
lea esp, [esp + 2]
jmp 0x70f043

Function at 0x7131b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf06fc3d4
jmp 0x713200
jmp 0x713199
push word [esp + 1]
mov byte [esp + 6], cl
mov dword [esp + 0x18], edi
jmp 0x71322f
push word [esp + 1]
jnp 0x713176
push word [esp + 1]
mov byte [esp + 6], cl
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x713233
mov bp, dx
mov esi, dword [esp + 0x2c]
mov edi, dword [esp]
mov di, 0x1455
inc dh
jmp 0x71324f
lea esi, [esi + ebp]
mov dx, 0x2a52
jmp 0x7131e4
lea edi, [esp]
mov ebp, dword [esp]
mov ch, dh
shl eax, 0x19
jmp 0x713269
lea esp, [esp + 0x18]
pushfd
jmp 0x712f1e
call fcn.00713216
mov ch, 0x15
test esp, ebp
pop ds
lcall 0x3e8e, 0x73148604
mov bh, 0x9e
jmp 0xb8e8dd59
ja 0x713209
jbe 0x713209
mov ebp, esp
rdtsc
not ecx
xchg ah, dh
mov ecx, esi
jmp 0x713506
jge 0x713239
jl 0x713239
dec esi
into
pop esp
cmp edx, esi
fsub qword [ebx - 0xd]
xchg esi, eax
shl dword gs:[edx], 1
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x54]
outsd dx, dword [esi]
push ecx
ror byte [ecx + 0x6004244c], 1
lea eax, [esi + ebp]
mov edx, dword [esp]
mov ax, word [esp]
jmp 0x7132a0
lea eax, [esi + ebp]
pushal
xchg bh, bl
mov al, bl
ror ebx, 3
jns 0x713314
js 0x7132b6

Function at 0x719763
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.007191bb
inc dword [esp + 8]
jmp 0x7198b4
mov byte [esp + 1], bl
jmp 0x71976d
bswap eax
mov dword [esp], esp
mov dword [esp], edx
mov ah, byte [esp]
not al
mov eax, dword [esp]
jmp 0x71979e
lea edx, reloc.MSVCRT.dll_strncpy
mov ebx, ebp
mov ax, 0x5827
lea eax, [eax - 2]
pop ebx
jmp 0x7198cf
not ah
mov dx, 0x61f2
mov ax, cx
push ebx
rdtsc
not al
jmp 0x719788
jne 0x719731
pushal
jmp 0x7191b6
mov ah, 0xd7
mov ax, word [esp]
lea eax, [ebp + 0x25]
pop eax
cmp dword [esp + 4], 0
jmp 0x7197e8
popfd
ret
sete dh
lea eax, reloc.MSVCRT.dll_strncpy
bswap edx
rdtsc
mov dx, 0x4414
pop edx
jmp 0x71988a
Function at 0x71a1df
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x71a11d
mov dword [esp + 0x24], eax
jmp 0x71a22e
call 0x7194fc
jmp 0x71a165
pop ecx
jmp 0x71a310
mov eax, dword [esp]
mov ax, 0x8f51
mov eax, dword [esp]
call fcn.0071a19e
mov cs, word [edx + eax*4]
in eax, 0x14
movsb byte es:[edi], byte [esi]
sbb byte [ecx + 0x2b9b6809], bl
js 0x71a1dd
mov dl, 0xad
mov esp, 0xc7840f
add byte [eax], al
je 0x71a252
jne 0x7194cc
cmp dword [esp + 4], 0
jne 0x71a1b9
pushal
jmp 0x7194f7
jmp 0x71a24b
insb byte es:[edi], dx
add bl, ch
sub eax, edx
jge 0x71a230
fisttp word [edi]
mov dh, 0x18
movzx ebx, byte [eax]
add ebx, 0xb8571d45
cmp ebx, 0xb8571e11
jmp 0x71a185
popal
inc dword [esp + 8]
inc esp
and al, 8
popfd
ret
popfd
ret
adc cl, byte [eax + ecx*8 + 0x7ff528eb]
out dx, eax
mov bh, byte [ecx + 0x31]
fst qword [eax - 0x3a]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
das
and dword ss:[eax - 0x75], esp
invalid
sub ecx, 0x1001d0db
mov dword [ecx + reloc.MSVCRT.dll_strncpy], eax
jmp 0x71a1e5

Function at 0x7ab244
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror dh, 4
push dword [esp + 6]
mov word [esp + 2], bp
bsr dx, ax
jmp 0x7ab1fd
lea edx, [edi + ebp]
push dword [esp + 1]
push eax
not eax
mov cx, word [esp + 7]
setns ah
jmp 0x7ab1bd
mov cl, ah
pop word [esp + 3]
inc eax
lea ecx, [esi*4]
jmp 0x7ab21a
pop dword [esp + 3]
mov dx, word [esp + 1]
lea eax, [ecx*4]
mov ecx, dword [esp + 0xa]
mov cx, 0x8040
sub esp, 0x16
jmp 0x7ab1e7
lea ecx, [esi*4]
bts edx, ebx
bswap eax
lea eax, [esi + 0x8a]
mov dword [esp + 0x16], esp
clc
jmp 0x7ab261
neg edx
jmp 0x7ab1d3
sub esp, 0
pop dword [esp + 0x13]
lea eax, [ecx*4]
mov eax, 0xcb3b417e
rdtsc
clc
lea edx, reloc.MSVCRT.dll_strncpy
xchg word [esp + 6], ax
xchg ch, dh
jmp 0x7ab248
Function at 0x7ab332
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
mov ecx, dword [esp]
bswap eax
lea edx, [esi*4]
lea esp, [esp]
jmp 0x7ab376
jmp 0x7ab31c
xchg edx, ecx
push word [esp]
rdtsc
lea ecx, [ecx + edx]
mov al, byte [esp + 2]
mov ax, 0xe56b
jmp 0x7ab39f
rol edx, cl
rdtsc
btr ecx, ebp
bts edx, edi
mov edx, 0xc6acbf3f
or edx, esi
jmp 0x7ab35c
mov ax, di
mov cx, 0xb07c
push sp
mov ax, si
not eax
jmp 0x7ab3fa
not ah
rol dl, cl
lea ecx, [eax + ecx]
mov dx, word [esp + 2]
xchg word [esp + 1], dx
mov ch, ah
jmp 0x7ab389
lea ecx, [ebx - 0x3e]
pop ax
mov cx, 0x97b2
lea ecx, [edx + edi]
add cx, sp
mov cx, word [esp]
jmp 0x7ab455
lea eax, reloc.MSVCRT.dll_strncpy
bswap ecx
bswap edx
bswap eax
pop eax
inc ax
jmp 0x7ab3d7
cld
bsf ax, si
std
setnp ch
not eax
pop eax
jmp 0x7ab439
mov dx, 0x23e5
pushal
push word [esp + 7]
xchg dx, ax
xchg dx, ax
mov ax, 0x51e7
jmp 0x7ab40b
pop word [esp + 3]
pop word [esp + 0xe]
inc eax
mov ecx, 0xe8760db0
mov ax, si
cmp edx, esi
jmp 0x7ab47b
push ebx
mov byte [esp + 1], dh
xchg ah, dl
inc al
mov dword [esp], edx
bswap edx
jmp 0x7ab424
mov byte [esp + 7], bl
xchg dh, al
mov dword [esp + 0xd], eax
xchg byte [esp + 0x12], cl
jmp 0x7ab48e
mov dword [esp + 0x16], eax
std
lea ecx, [eax + ebp]
inc ch
setge ch
lea esp, [esp + 0xa]
jmp 0x7ab465
push word [esp + 0xa]
lea eax, [ecx + edi]
xchg byte [esp + 0x11], ah
push dword [esp + 7]
rcr ax, cl
jmp 0x7ab4db
setb ch
xchg byte [esp + 0xc], ch
mov dx, 0x3d67
bsf cx, bx
not ah
bswap eax
jmp 0x7ab503
pop dword [esp + 0xf]
not ecx
pop dword [esp]
pop eax
xchg edx, ecx
mov dword [esp + 6], esi
jmp 0x7ab4c2
sub esp, 2
mov word [esp + 0xa], di
lea esp, [esp]
mov dx, 0x8aa1
jmp 0x7abb40
mov dx, 0xcb4a
pop word [esp + 8]
xchg dword [esp + 2], edx
xchg word [esp + 3], ax
jmp 0x7ab4ed
xchg dword [esp], edx
rol dl, 4
call fcn.007ab53f
lea esp, [esp + 8]
cmp edx, 0xec715c7b
xchg dword [esp], edx
bswap eax
bt ecx, esp
add esp, 2
jmp 0x7ab577
Function at 0x7ab582
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cx, dx
xchg dl, ah
mov dx, 0x8bb1
mov ax, word [esp + 1]
bsr dx, bp
jmp 0x7ab5c0
mov ecx, dword [esp + 0x1a]
mov dword [esp + 0x1c], edx
xchg edx, eax
lea esp, [esp + 0xc]
mov dword [esp + 3], ebp
jmp 0x7ab5ef
xchg byte [esp + 2], ch
mov ah, byte [esp + 1]
pop dword [esp]
pushal
mov eax, 0xd090cbbb
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x7ab5a5
lea esp, [esp + 0x12]
add esp, 0x14
bswap eax
neg eax
and dx, dx
pop ecx
jmp 0x7ab658
mov edx, dword [esp + 0x11]
sub esp, 0x1a
xchg dword [esp + 0xd], eax
push word [esp + 3]
lea edx, [esi + 0xdc]
mov dword [esp + 0x13], eax
jmp 0x7ab5d9
mov dh, bl
xchg byte [esp + 0x11], cl
mov ax, word [esp + 0x1d]
btr eax, ebp
jmp 0x7ab708
mov eax, 0xfd92bc04
pop cx
pushal
pop word [esp + 0x18]
mov ecx, dword [esp + 0x18]
jmp 0x7ab62b
push bp
xor edx, ecx
push dword [esp + 3]
push dword [esp + 7]
neg cx
lea eax, [ebp*4]
jmp 0x7ab641
not dx
mov byte [esp + 0xe], bl
shr cl, cl
mov dword [esp + 0x20], eax
setae dl
push bp
jmp 0x7ab6c0
neg eax
mov cl, ch
mov cx, word [esp + 3]
rol ah, 2
mov dx, 0xd855
pop cx
jmp 0x7ab670
cmc
mov edx, dword [esp + 0x17]
bsr dx, dx
mov eax, dword [esp + 0x25]
jmp 0x7ab6f0
lea ecx, [esi*4]
push word [esp + 0x14]
rdtsc
setae cl
bswap ecx
mov word [esp + 2], ax
jmp 0x7ab6aa
mov dh, 0xe6
rcr al, 3
mov ah, 0x57
mov dl, dh
mov ecx, ebx
xchg ch, dh
jmp 0x7ab721
mov word [esp + 0x22], bp
sub esp, 0x1f
lea esp, [esp + 0x4d]
lea ecx, [ecx + ebx]
mov ax, dx
jmp 0x7ab6da
btr edx, ecx
mov dword [esp + 0x28], ebp
mov word [esp + 5], ax
pop eax
mov cx, word [esp + 4]
pop cx
jmp 0x7ab696
std
rdtsc
lea edx, [esi*4]
mov cx, ax
xchg al, dh
xchg dh, ah
jmp 0x7ab87f
mov ecx, 0x3597f7e5
bt ax, di
call fcn.007ab7a7
cld
setnp ch
xchg word [esp], ax
pop word [esp]
sbb ah, dh
xor ch, dl
jmp 0x7ab841
rdtsc
bsf eax, edi
pop word [esp]
bswap eax
push word [esp]
bsf edx, ebx
jmp 0x7ab859
push word [esp + 1]
mov ecx, 0xbeb15dbb
mov ax, sp
mov cx, 0x9f7f
mov dh, byte [esp]
bswap edx
jmp 0x7ab81d
mov byte [esp + 2], ah
call fcn.007ab9d6
mov cl, byte [esp]
call fcn.007ab8c8
push ds
xchg edx, eax
add byte [edi - 0x6e], ah
jns 0x7ab80d
pop ss
xchg edx, esp
adc esp, edi
sbb cl, byte [eax + 0x6a88791e]
movsd dword es:[edi], dword [esi]
aam 0x47
sete ch
mov cx, word [esp]
bswap ecx
neg ecx
inc dx
lea eax, [ecx + ebx]
jmp 0x7ab7f7

Function at 0x7ab8c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 1]
xchg edx, ecx
mov eax, dword [esp]
xchg byte [esp], dl
xchg byte [esp + 1], cl
jmp 0x7ab99f
rdtsc
mov ecx, dword [esp + 2]
shl ecx, 0x1e
mov ah, byte [esp]
add cx, 0x139
mov eax, dword [esp]
jmp 0x7ab894
std
add esp, 2
mov cx, di
mov edx, 0x2ae2d175
xchg byte [esp], al
jmp 0x7ab8aa
sub esp, 0x14
mov eax, edi
rdtsc
mov dx, word [esp + 0xc]
mov dl, 0x1c
call fcn.007ab920
add byte [eax + 0x37906106], dl
lea ebx, [edi + ebp*2]
neg dx
lea esp, [esp + 0x11]
mov cx, sp
neg ax
bts edx, esi
sub esp, 3
jmp 0x7ab8d9
sub esp, 0x15
mov dx, cx
btr ecx, ebp
bsr dx, cx
cld
pop edx
jmp 0x7ab8f5
pop cx
mov word [esp], bp
lea ecx, [ebx + esi]
pushfd
setl dl
std
jmp 0x7ab93f
Function at 0x7ab920
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xd], di
xchg dword [esp + 9], edx
push word [esp + 0x17]
jmp 0x7ab925
bt edx, ebx
jmp 0x7ab90a
xchg word [esp + 0x12], dx
mov byte [esp + 0x12], dh
mov word [esp + 0xd], cx
lea eax, [esi + edi]
mov ch, 0x1b
jmp 0x7ab966
xchg dword [esp + 0xf], edx
mov ah, byte [esp + 0x1c]
inc ax
xchg byte [esp + 0xa], dh
jmp 0x7ab97f
xchg ch, dh
pop dword [esp + 6]
mov ax, dx
push word [esp + 1]
mov eax, 0x633369f7
mov byte [esp + 3], ch
jmp 0x7ab950
mov ch, 0xf7
neg eax
push word [esp + 0x1f]
bswap edx
rdtsc
inc eax
jmp 0x7ab9af
mov ax, bp
lea esp, [esp + 0xb]
lea edx, [esi*4]
btr cx, bx
xchg word [esp], cx
rol dl, 2
jmp 0x7abafc
xchg cx, ax
xchg word [esp + 0x1b], cx
xchg edx, eax
mov ch, bh
jmp 0x7aba27
xchg cx, ax
mov dx, 0x209a
mov cx, si
mov dh, 0x7a
sub esp, 0x15
bsf edx, eax
jmp 0x7ab9e8
pop word [esp + 0x1a]
cmp ax, 0x5b10
pop word [esp + 0x1b]
call fcn.007aba11
dec ecx
ror cx, 0
lea ecx, [eax + edx]
mov byte [esp + 0x22], ah
xchg word [esp + 2], dx
mov ch, dh
jmp 0x7aba90
mov cx, word [esp + 0xe]
lea esp, [esp + 0xb]
sbb cx, sp
mov dword [esp], ecx
rdtsc
mov eax, 0xc82d7ee8
jmp 0x7ab9fe
bts cx, sp
inc dx
mov byte [esp + 0xe], cl
xchg cx, ax
bswap ecx
jmp 0x7abaa6
bts edx, eax
mov byte [esp + 0x1a], dh
inc dx
mov byte [esp + 0x20], bl
push word [esp + 4]
dec cx
jmp 0x7aba7a
mov dword [esp + 1], esp
mov dword [esp + 0x1f], ecx
pop edx
mov dx, bx
pushfd
mov dword [esp + 0x11], edi
jmp 0x7abad5
xchg ah, cl
std
sub esp, 0x1d
lea esp, [esp + 0x1c]
setbe al
push word [esp + 0x15]
jmp 0x7aba62
lea edx, [esi*4]
mov eax, 0xe6b3dc9a
mov ecx, dword [esp + 0x15]
xchg word [esp + 0x20], ax
mov dh, byte [esp + 0x26]
xchg dword [esp + 0x17], edx
jmp 0x7abb1b
lea eax, [eax*4]
mov cx, word [esp + 0x13]
lea eax, [esi*4]
pop word [esp + 4]
lea edx, [edi + ebp]
rdtsc
jmp 0x7abac1
lea eax, [eax + edx]
add esp, 0x21
setnp cl
xchg word [esp + 2], ax
mov byte [esp + 1], dh
lea edx, [ebx*4]
jmp 0x7ac2ab
xchg dword [esp], edx
xchg byte [esp + 1], cl
std
mov word [esp + 1], di
shl dx, cl
not ax
call fcn.007abb70
xchg ah, ch
lea eax, [ecx + 0xa2]
ror eax, cl
pop dx
pop ax
add esp, 0x16
jmp 0x7abbd4
push dword [esp]
bswap eax
mov byte [esp + 6], ch
sub esp, 0x15
mov al, cl
xchg edx, ecx
jmp 0x7abc1a
xchg dword [esp + 2], ecx
lea edx, [esi*4]
mov ax, word [esp + 8]
jmp 0x7abc56
pop dword [esp + 0xa]
lea edx, [edx + edi]
pop word [esp + 4]
mov word [esp + 0xe], bp
mov ax, word [esp + 0x14]
lea eax, [esi*4]
jmp 0x7abc04
push dword [esp + 4]
lea eax, [esp + edx]
xchg byte [esp + 0x13], al
mov eax, edx
pop eax
call fcn.007abc6a
cmp bh, byte [edx + edx*2 + 0x92dc435]
test al, 0xcb
bound ecx, qword [edx - 0x4af7dbac]
mov al, byte [0x5966ca0f]
mov dl, byte [esp + 8]
mov ch, 0xa0
bswap edx
pop cx
mov ah, byte [esp + 4]
mov dword [esp + 4], eax
jmp 0x7abc39
btr ecx, edx
mov dx, si
inc cl
mov ax, bp
mov word [esp + 1], si
mov ecx, edx
jmp 0x7abb8b
rdtsc
xchg byte [esp + 1], al
mov byte [esp + 1], al
mov dx, 0x80de
mov word [esp + 1], di
mov dl, byte [esp + 2]
jmp 0x7abc83
neg eax
xor cl, 0x14
mov al, 0xc7
cmc
mov ax, bx
pop word [esp + 1]
jmp 0x7abd91
Function at 0x7abc6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
jmp 0x7abd47
mov cl, ah
stc
xchg word [esp + 1], cx
inc ch
bts eax, ebp
std
jmp 0x7abd07
not edx
pop word [esp + 5]
rdtsc
xchg dword [esp + 6], ecx
xchg dx, cx
lea edx, [esp + edx]
jmp 0x7abc9a
push word [esp + 1]
mov byte [esp + 4], dl
push dword [esp + 6]
bt cx, si
pop eax
lea eax, [edi + edi]
jmp 0x7abcb0
stc
bswap eax
xchg byte [esp + 5], ch
mov word [esp], si
xchg word [esp + 7], ax
jmp 0x7abd20
mov eax, dword [esp + 4]
mov eax, 0xed607278
bsf ecx, edx
lea edx, reloc.MSVCRT.dll_strncpy
bswap eax
neg dx
jmp 0x7abcf1
mov dx, word [esp + 2]
neg dx
push word [esp + 9]
xchg word [esp + 2], ax
mov byte [esp + 7], cl
mov ecx, dword [esp + 6]
jmp 0x7abd79
pop word [esp + 0x17]
lea esp, [esp + 0xd]
xchg word [esp + 9], cx
mov ecx, edi
neg cx
bsr dx, bx
jmp 0x7abcda
rdtsc
mov dh, 0x91
mov cx, dx
xchg dx, ax
mov dl, byte [esp + 3]
jmp 0x7ac1bd
rdtsc
mov cl, 0xaf
pop ecx
not ah
pop ax
sbb ah, cl
jmp 0x7abd63
xchg dword [esp + 0xd], ecx
clc
pop cx
mov ax, word [esp + 0x18]
call fcn.007abdad
inc al
clc
not ch
mov cx, word [esp + 0x1d]
mov eax, 0x4dd48393
jmp 0x7abe2e
push word [esp + 0x19]
mov word [esp + 6], ax
call 0x7abe12
xchg edx, eax
lea edx, [eax + edi]
mov dx, ax
pop cx
mov ax, 0x7353
jmp 0x7abeb2
not al
mov eax, dword [esp + 0xd]
mov byte [esp + 0x27], bl
xchg byte [esp + 0x15], ch
mov al, cl
pop word [esp + 9]
jmp 0x7abe02
mov ah, byte [esp + 0x1d]
setge ah
sete ah
mov byte [esp + 0x1a], al
push esp
jmp 0x7abe86
pushfd
mov edx, edi
lea esp, [esp + 8]
sets ah
xchg word [esp + 0x15], cx
pop dword [esp + 0x17]
jmp 0x7abe45
btr dx, sp
mov edx, esi
btc cx, dx
rdtsc
jmp 0x7abe97
pop cx
lea esp, [esp + 0x17]
pop ecx
rdtsc
mov edx, 0x9dd3409e
cld
jmp 0x7abe70
lea edx, [esp - 0xfa]
lea eax, [esi - 0x13]
mov dl, byte [esp + 1]
bswap eax
not al
mov dl, bh
jmp 0x7abed8
pop edx
clc
mov dword [esp + 0x1d], edi
lea eax, [eax + edi]
mov edx, esi
bsf eax, edi
jmp 0x7abe5b
add esp, 3
not ecx
bsf cx, dx
pop eax
setne al
call fcn.007abec2
xchg dx, cx
rdtsc
dec ax
bt ecx, esi
add esp, 1
mov ah, ch
jmp 0x7abf4d
mov cl, 0xd4
xchg word [esp + 0xe], ax
shl cl, 4
push word [esp + 0x1f]
lea ecx, reloc.MSVCRT.dll_strncpy
bsf edx, ebp
jmp 0x7abdc3
lea esp, [esp + 0x1b]
push dword [esp + 0x14]
shr cx, 2
jmp 0x7abf5b
lea edx, [esp + ecx]
xchg cx, ax
inc al
push dx
pop eax
mov cx, bp
jmp 0x7abf20
sub esp, 0x1a
pop eax
setg dl
pushal
inc cx
rdtsc
jmp 0x7abf36
lea ecx, [ebx*4]
xchg byte [esp + 5], dl
mov ecx, dword [esp + 0x1c]
lea ecx, [edi + ebp]
rdtsc
call fcn.007abfb0
xchg edi, eax
add dword [ecx + reloc.MSVCRT.dll_strncpy], edx
ret 0x3750
setne dh
xchg dword [esp + 8], ecx
mov dx, bx
cld
setle ch
setl ah
jmp 0x7abf03
push word [esp + 3]
btr dx, si
bsf eax, eax
mov edx, dword [esp + 0x17]
cmc
pop word [esp + 0x1c]
jmp 0x7abf84
push word [esp + 4]
bswap edx
add esp, 6
sub esp, 1
sub esp, 0x1d
rol cx, 2
jmp 0x7abfd7
Function at 0x7abe12
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
jmp 0x7abd47
mov cl, ah
stc
xchg word [esp + 1], cx
inc ch
bts eax, ebp
std
jmp 0x7abd07
not edx
pop word [esp + 5]
rdtsc
xchg dword [esp + 6], ecx
xchg dx, cx
lea edx, [esp + edx]
jmp 0x7abc9a
push word [esp + 1]
mov byte [esp + 4], dl
push dword [esp + 6]
bt cx, si
pop eax
lea eax, [edi + edi]
jmp 0x7abcb0
stc
bswap eax
xchg byte [esp + 5], ch
mov word [esp], si
xchg word [esp + 7], ax
jmp 0x7abd20
mov eax, dword [esp + 4]
mov eax, 0xed607278
bsf ecx, edx
lea edx, reloc.MSVCRT.dll_strncpy
bswap eax
neg dx
jmp 0x7abcf1
mov dx, word [esp + 2]
neg dx
push word [esp + 9]
xchg word [esp + 2], ax
mov byte [esp + 7], cl
mov ecx, dword [esp + 6]
jmp 0x7abd79
pop word [esp + 0x17]
lea esp, [esp + 0xd]
xchg word [esp + 9], cx
mov ecx, edi
neg cx
bsr dx, bx
jmp 0x7abcda
rdtsc
mov dh, 0x91
mov cx, dx
xchg dx, ax
mov dl, byte [esp + 3]
jmp 0x7ac1bd
rdtsc
mov cl, 0xaf
pop ecx
not ah
pop ax
sbb ah, cl
jmp 0x7abd63
xchg dword [esp + 0xd], ecx
clc
pop cx
mov ax, word [esp + 0x18]
call fcn.007abdad
inc al
clc
not ch
mov cx, word [esp + 0x1d]
mov eax, 0x4dd48393
jmp 0x7abe2e
push word [esp + 0x19]
mov word [esp + 6], ax
call 0x7abe12
xchg edx, eax
lea edx, [eax + edi]
mov dx, ax
pop cx
mov ax, 0x7353
jmp 0x7abeb2
not al
mov eax, dword [esp + 0xd]
mov byte [esp + 0x27], bl
xchg byte [esp + 0x15], ch
mov al, cl
pop word [esp + 9]
jmp 0x7abe02
mov ah, byte [esp + 0x1d]
setge ah
sete ah
mov byte [esp + 0x1a], al
push esp
jmp 0x7abe86
pushfd
mov edx, edi
lea esp, [esp + 8]
sets ah
xchg word [esp + 0x15], cx
pop dword [esp + 0x17]
jmp 0x7abe45
btr dx, sp
mov edx, esi
btc cx, dx
rdtsc
jmp 0x7abe97
pop cx
lea esp, [esp + 0x17]
pop ecx
rdtsc
mov edx, 0x9dd3409e
cld
jmp 0x7abe70
lea edx, [esp - 0xfa]
lea eax, [esi - 0x13]
mov dl, byte [esp + 1]
bswap eax
not al
mov dl, bh
jmp 0x7abed8
pop edx
clc
mov dword [esp + 0x1d], edi
lea eax, [eax + edi]
mov edx, esi
bsf eax, edi
jmp 0x7abe5b
add esp, 3
not ecx
bsf cx, dx
pop eax
setne al
call fcn.007abec2
xchg dx, cx
rdtsc
dec ax
bt ecx, esi
add esp, 1
mov ah, ch
jmp 0x7abf4d
mov cl, 0xd4
xchg word [esp + 0xe], ax
shl cl, 4
push word [esp + 0x1f]
lea ecx, reloc.MSVCRT.dll_strncpy
bsf edx, ebp
jmp 0x7abdc3
lea esp, [esp + 0x1b]
push dword [esp + 0x14]
shr cx, 2
jmp 0x7abf5b
lea edx, [esp + ecx]
xchg cx, ax
inc al
push dx
pop eax
mov cx, bp
jmp 0x7abf20
sub esp, 0x1a
pop eax
setg dl
pushal
inc cx
rdtsc
jmp 0x7abf36
lea ecx, [ebx*4]
xchg byte [esp + 5], dl
mov ecx, dword [esp + 0x1c]
lea ecx, [edi + ebp]
rdtsc
call fcn.007abfb0
xchg edi, eax
add dword [ecx + reloc.MSVCRT.dll_strncpy], edx
ret 0x3750
setne dh
xchg dword [esp + 8], ecx
mov dx, bx
cld
setle ch
setl ah
jmp 0x7abf03
push word [esp + 3]
btr dx, si
bsf eax, eax
mov edx, dword [esp + 0x17]
cmc
pop word [esp + 0x1c]
jmp 0x7abf84
push word [esp + 4]
bswap edx
add esp, 6
sub esp, 1
sub esp, 0x1d
rol cx, 2
jmp 0x7abfd7

Function at 0x7ace80
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0xa]
jmp 0x7acf47
rdtsc
cpuid
cpuid
mov si, 0x8dfd
mov si, bp
not ax
push eax
cmp dh, 0x11
mov edx, 0xeed52108
inc eax
lea esp, [esp + 0x14]
jmp 0x7ace8a
Function at 0x7ad10d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [ecx + edi]
lea ebp, [eax + ecx]
jmp 0x7ad15e
lea esp, [esp + 1]
bsf eax, esi
add esp, 3
xchg word [esp + 0xc], dx
lea esi, reloc.MSVCRT.dll_strncpy
rdtsc
jmp 0x7adaa6

Function at 0x7ad47a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
lea esp, [esp + 9]
mov al, byte [esp + 4]
pop si
jmp 0x7ad498
bsr esi, eax
std
xchg bp, bx
rdtsc
bswap eax
std
jmp 0x7ad524
bsr esi, edx
neg edx
add esp, 0
xchg di, ax
pushal
mov bp, word [esp + 0x14]
jmp 0x7ad4c2
mov si, word [esp]
neg bp
lea eax, [ecx*4]
not ch
neg si
xchg ebx, ebp
jmp 0x7ad4d8
mov ebx, 0x4fd7c48d
bswap edi
lea esp, [esp + 2]
std
xchg ebx, ebp
mov ax, 0xbd37
jmp 0x7ad4ef

Function at 0x7ad634
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov bl, 5
mov di, 0x2d54
rdtsc
xchg byte [esp + 2], al
mov ch, 0xd6
jmp 0x7ad60e
mov bl, byte [esp + 6]
cmp edx, 0x9772846d
push ax
mov word [esp + 5], sp
lea ebp, [edx*4]
add esp, 9
jmp 0x7ad63e
add esp, 6
lea edx, [esi + ebp]
mov dl, ah
jmp 0x7ad5e9
mov edi, ecx
mov byte [esp], bh
sub al, dl
setb dh
sbb dl, al
xchg word [esp], cx
jmp 0x7ad67e
lea esi, [esi*4]
push edx
setns bh
neg dx
jmp 0x7ad6d2
mov dword [esp], esi
rdtsc
mov dh, 0xb1
bsf dx, ax
mov edx, esi
sub edi, ecx
jmp 0x7ad6ea
lea esp, [esp + 0xa]
pop edx
xchg word [esp + 2], bp
mov dword [esp], esi
mov cx, word [esp + 5]
rcr ebx, 0
jmp 0x7ad69d
lea ebp, reloc.MSVCRT.dll_strncpy
mov dl, bh
lea edx, reloc.MSVCRT.dll_strncpy
sub esp, 0xe
lea esi, [ebx + ebx]
xchg cx, ax
jmp 0x7ad6b3
mov edx, eax
mov dh, byte [esp + 1]
mov bp, word [esp]
mov word [esp + 2], si
shr dx, cl
mov edx, dword [esp + 1]
jmp 0x7ad732
push dword [esp + 5]
sub esp, 0x1f
xchg bp, cx
std
neg dl
mov di, dx
jmp 0x7ad71c

Function at 0x7adae2
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.007ad0ec
push bx
mov dword [esp], ebx
lea esp, [esp + 3]
lea esp, [esp + 3]
push edi
jmp 0x7adb29
mov eax, dword [eax]
jmp 0x7adb88
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7adb13
mov eax, dword [eax + 8]
push eax
jmp 0x7ad0e7
Function at 0x10015560
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a3aeb
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x10242040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
xorps xmm0, xmm0
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], 0
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], 0
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], 0
mov word [esi + 0x48], 0
mov byte [esi + 0x4a], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
movups xmmword [esi + 0x54], xmm0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0xf
mov byte [esi + 0x54], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x94], 0
mov byte [ebp - 4], 1
call fcn.10015440
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret