joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ea14
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
dec cl
jmp 0x24f5b
pushfd
mov byte [esp], ah
mov cl, byte [eax]
pushal
pushfd
jmp 0x25b2c
jmp 0x28274
inc eax
pushal
push ebx
test cl, cl
pushfd
call fcn.00020111
bt si, 9
test cl, cl
push 0x78f2f50b
mov byte [esp], dh
lea esp, [esp + 0x28]
jne 0x1b7c5
clc
cmc
sub eax, edx
pushfd
call fcn.0002a7dc
pushal
stc
pushal
cmp byte [ebp - 1], 0
call fcn.0001f103
lea esp, [esp + 4]
push 0x26138543
dec cl
mov cl, byte [eax]
pushal
inc eax
cmp cx, ax
clc
jmp 0x21df9
inc eax
mov word [esp], 0x772b
call fcn.0001cd52
mov dl, dl
push edx
setl cl
mov byte [0x182f0], 1
setge cl
pushal
not cl
push dword [esp + 4]
mov cl, byte [esi + 0x25]
push dword [esp + 8]
pushfd
mov byte [esp + 4], 0xdb
mov dl, byte [esi + 0x26]
pushfd
mov byte [esp], 0xa7
mov byte [esp], 0x1f
mov byte [ebp - 2], cl
call fcn.00020614
pushfd
call fcn.0001dc85
jle 0x1cc28
dec cl
pushfd
lea esp, [esp + 4]
jmp 0x27703
mov cl, cl
seta cl
not cl
mov cl, byte [eax]
jmp 0x1ff27
lea esp, [esp + 0x34]
call sub.ntoskrnl.exe_memcpy
shrd ax, ax, cl
bswap dx
daa
add esp, 0x18
xchg dl, cl
lea edx, [esp - 0x767b242f]
rdtsc
bswap edx
mov eax, dword [0x182e4]
pushfd
sete dh
push dword [esp]
mov eax, dword [eax + esi*8 + 8]
xchg dl, cl
mov dh, 0x7e
lea edx, [ecx + 0x1a408816]
lea edx, [eax + 1]
inc cl
pushal
lea esp, [esp + 0x28]
jne 0x27284
pushfd
lea esp, [esp + 4]
jmp 0x1d348

Function at 0x1ee0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x16
mov dword [ebp - 0x14], 0
jmp 0x21707
call fcn.0002173e

Function at 0x1eedd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
jmp 0x1f3c2
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x1342a
test sp, 0xb8a4
cmp dword [ecx], 0
jp 0x2b65f
push 0x7cbf68c8
pushal
lea esp, [esp + 0x24]
je 0x1342a
pushfd
mov dword [esp], 0x94b26e19
pop edi
not di
mov edi, dword [ecx]
call fcn.0002a3a5

Function at 0x1f5bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0001b978
lea esp, [esp + 0x28]
call sub.ntoskrnl.exe_memset
rdtsc
pushal
cdq
jmp 0x220b8
mov edx, dword [ebp - 8]
push 0x90d7c0de
lea ecx, [edx + 0x4aaf0a53]
pushal
lea ecx, [0x952da3c8]
mov eax, dword [0x182e0]
jmp 0x1d910

Function at 0x1f7da
Capabilities:
Execute anti-debugging instructions

Disassembly:
not cl
bswap edx
jmp 0x2321e
mov eax, dword [eax + esi*8 + 8]
pushfd
lea edx, [eax + 1]
call fcn.0001e3f5
push dword [esp + 4]
mov dword [esp + 0x24], 0
call 0x2323c
mov byte [esp + 0x10], bh
lea esp, [esp + 0x28]
call fcn.00015eb0
jmp 0x29aa6
stc
jmp loc.000118db

Function at 0x1fd9c
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x2661f
pushfd
cwde
rol al, 7
mov eax, dword [esi + 8]
jmp 0x26cde
push 0xfcb4e085
test eax, eax
mov byte [esp + 4], 0x64
jmp 0x26e55
Function at 0x1ff83
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x3c]
je 0x20934
call fcn.00028778
pushfd
jmp 0x2275a
mov byte [esp], bh
mov dword [esp], esi
push ecx
pushal
lea esp, [esp + 0x24]
call fcn.00011d10
or si, 0x80d2
lahf
mov eax, dword [0x182f8]
bts esi, 0x1d
rcr si, 1
clc
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
bt bx, 0xc
cmp al, 0x79
clc
pushfd
test eax, eax
pushal
lea esp, [esp + 0x24]
je 0x288b7
cmp dx, ax
cmp dl, bl
push 0x4521690a
cmp ch, 0x22
cmp dword [0x183cc], 0
pushal
push eax
pushfd
lea esp, [esp + 0x2c]
je 0x29f4c
pushfd
call fcn.00029f1b
bsf ax, bx
rcr ah, cl
mov eax, dword [0x183cc]
test cl, al
test eax, eax
jmp 0x234c2

Function at 0x1fffb
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x25a39
mov dword [ebp - 0x10], eax
stc
cmp dh, 0x9c
call fcn.0002329b
push 0xbb66492b
mov dword [esp + 0x44], 0x100080
push 0x48444db4
mov dword [esp + 0x44], esi
push dword [esp]
mov byte [esp], ah
lea esp, [esp + 0x48]
call fcn.00012740
stc
jmp 0x224ae

Function at 0x20111
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push edx
mov byte [esp + 0x10], ch
mov dword [ebp - 8], eax
push edi
lea esp, [esp + 0x30]
je 0x1cd4b
inc edi
jmp 0x1f86f
bswap di
movsx di, dl
mov edi, eax
pushfd
mov word [esp], bx
inc edi
call fcn.0002a8b8
lea esp, [esp + 0x2c]
jne 0x1b7c5
pushal
cmc
push 0xc69bbb6e
mov byte [esp], dh
sub eax, edx
jmp 0x1bb2f

Function at 0x201f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esp
cmp dword [eax + 0x78], ecx
jmp fcn.000117ab

Function at 0x205ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xd8
mov dword [ebp - 8], eax
push 0xef2a4530
lea esp, [esp + 8]
je 0x20b86
push ebp
movzx di, dl
not di
pushal
mov edi, eax
push edi
push dword [esp]
call fcn.0001e101
mov word [esp], dx
mov byte [ebx + 0xa], al
call fcn.0001f528

Function at 0x20934
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x3c]
je 0x20934
call fcn.00028778
pushfd
jmp 0x2275a
mov byte [esp], bh
mov dword [esp], esi
push ecx
pushal
lea esp, [esp + 0x24]
call fcn.00011d10
or si, 0x80d2
lahf
mov eax, dword [0x182f8]
bts esi, 0x1d
rcr si, 1
clc
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
bt bx, 0xc
cmp al, 0x79
clc
pushfd
test eax, eax
pushal
lea esp, [esp + 0x24]
je 0x288b7
cmp dx, ax
cmp dl, bl
push 0x4521690a
cmp ch, 0x22
cmp dword [0x183cc], 0
pushal
push eax
pushfd
lea esp, [esp + 0x2c]
je 0x29f4c
pushfd
call fcn.00029f1b
bsf ax, bx
rcr ah, cl
mov eax, dword [0x183cc]
test cl, al
test eax, eax
jmp 0x234c2

Function at 0x20f9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
push ebx
jmp 0x2a398

Function at 0x21064
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], 0
pushfd
jmp 0x23d71
pushal
mov dword [ebp - 0x18], 0
jmp 0x1d355
Function at 0x21164
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], ah
lea esp, [esp + 8]
jne 0x1bc47
rdtsc
or al, cl
mov ecx, dword [ebx + edi - 6]
rdtsc
sub ax, cx
push 0x52b1e0da
stc
mov eax, dword [ebx + edi - 0xa]
or dl, 0xde
clc
jmp 0x1c47b
jmp 0x1cc4a

Function at 0x214d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
mov dword [esp + 0x2c], 0x18068
call fcn.00021081

Function at 0x214e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x5ec74a2b
mov dword [esp + 0x3c], ecx
call fcn.0002644f
mov dword [esp], 0x4000a401
pushal
lea esp, [esp + 0x24]
je 0x2b1d5
bswap cx
mov ecx, dword [ebp + 8]
cwde
lea eax, [ebp + 8]
pushal
mov dword [esp + 0x1c], eax
pushal
jmp 0x1f5ad
push 0x52e851ec
lea esp, [esp + 4]
jmp fcn.0001135e

Function at 0x216db
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jb 0x23c38
push esi
call fcn.000296ca

Function at 0x2170c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x254c9
rdtsc
push 0x75ae43a0
mov edx, dword [0x182e4]
push dword [esp]
pushal
mov eax, dword [edx + esi*8 + 8]
mov dword [esp], 0xa717855c
call fcn.0001cb43
movsx ax, cl
aad 0xdc
das
mov dword [ebp - 0x10], 0

Function at 0x21b3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
mov word [esp + 4], sp
mov dword [esp + 0x20], edx
push edx
pushfd
mov dword [esp + 0x24], 0x27499
pushal
call fcn.000231e2
lea esp, [esp + 0x2c]
je fcn.0002150c
jmp loc.0001100a
mov byte [esp], cl
jmp 0x29b27
lea esp, [esp + 4]
je 0x1f0cf
not dh
pushal
mov edx, dword [ebp - 0x10]
jmp 0x1b635

Function at 0x21b92
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], 0
jmp loc.00011034

Function at 0x22034
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc eax
cmp dh, 0xb7
pushal
push ebp
test cl, cl
mov byte [esp], 0xd4
lea esp, [esp + 0x2c]
jle 0x1febb
pushal
pushal
lea esp, [esp + 0x40]
jne 0x1b7c5
pushal
sub eax, edx
jmp fcn.00011812

Function at 0x2281b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
call sub.ntoskrnl.exe_rand
sal si, cl
bts si, 4
push ebp
mov esi, eax
bt cx, 1
clc
jmp 0x21f07
clc
and esi, edi
stc
bt di, 1
cmp esi, edi
pushfd
push dword [esp + 4]
jmp 0x244c4
pushal
lea esp, [esp + 0x24]
je 0x2718c
not edi
pushal
mov edi, dword [eax]
pushfd
push edi
jmp 0x1b841
pushal
lea esp, [esp + 0x2c]
jb 0x22a01
cwde
not cx
xchg cx, ax
lea ecx, [edi + 0x60a6643]
dec esi
rdtsc
setl cl
cdq
mov cx, 0xea6e
mov ecx, dword [0x182e0]
pushfd
call fcn.0002598e

Function at 0x22b0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0001f6e8
pushal
cmp ebx, edx
push dword [esp + 0xc]
jmp 0x2051f

Function at 0x22d87
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp], 0x67
lea esp, [esp + 0x2c]
jb 0x22a01
movsx dx, al
xchg dh, ah
rdtsc
dec esi
jmp 0x229e9
Function at 0x233e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x30], edx
pushfd
pushfd
mov dword [esp + 0x34], ebx
push 0x2d2614bb
lea esp, [esp + 0x38]
call sub.ntoskrnl.exe_memcpy
or dx, 0xbe02
rcl al, cl
add esp, 0x18
mov ax, sp
push ebx
lahf
bswap ax
mov eax, dword [0x182e4]
pushal
setno dl
mov eax, dword [eax + esi*8 + 8]
pop edx
lea edx, [eax + 1]
dec cl
setbe cl
lea esp, [esp + 0x20]
pushfd
mov cl, byte [eax]
pushal
inc eax
test ch, 0xc0
cmc
test cl, cl
push 0x30700d22
mov byte [esp + 0xc], al
mov byte [esp], ch
pushfd
lea esp, [esp + 0x2c]
jne 0x1b7c5
push edx
call fcn.00026cef

Function at 0x234df
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x7a
call fcn.00025d98

Function at 0x238d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
mov word [esp], di
pushfd
cmp byte [ebp - 2], 0
mov byte [esp + 4], dh
lea esp, [esp + 0x10]
jne 0x254f8
pushfd
jmp 0x2606e
mov dword [ebp - 0x10], eax
cmc
call fcn.00026503
pushfd
call fcn.00028cab
push 0x77826551
mov dword [esp + 4], 1
pushfd
pushfd
mov dword [esp + 8], 0x100080
mov dword [esp + 4], eax
pushfd
mov dword [esp + 8], esi
push ebp
pushfd
lea esp, [esp + 0x10]
call fcn.00012740
cmc
jmp 0x238c7

Function at 0x24495
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
mov dword [esp + 8], 0x26231
call fcn.00011abd
jmp 0x1f7a6
Function at 0x24a2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x221db
pushfd
pushfd
push dword [esp + 4]
pushal
mov dword [esp + 0x28], 0
mov dword [esp], 0x99239c12
jmp 0x24d10
mov dword [0x18304], eax
mov byte [esp], 0x9e
lea esp, [esp + 0x20]
jmp fcn.0002150c
call fcn.00027ca4
pushal
push 0x19ec2cf6
mov dword [esp + 0x20], 0x28cda
mov byte [esp], 0x8e
call fcn.000289e0
jmp 0x1edf7
pushfd
push 0xf8f4730e
lea esp, [esp + 0xc]
jne 0x1b661
not ax
adc ax, 0x7b3e
mov eax, dword [0x182fc]
clc
test eax, eax
pushal
push dword [esp + 4]
push ebx
pushfd
lea esp, [esp + 0x2c]
je 0x2895b
pushfd
mov dword [esp], 0
pushfd
call fcn.00026897
jmp 0x2b525
dec cx
sub dl, dl
lea ecx, [ecx - 0x5b96b456]
mov ecx, edi
js 0x2071b
push 0x28cda
pushfd
push dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop dword [esp]
push edx
pushal
push dword [esp + 0x24]
ret 0x28
inc eax
call fcn.00026383
mov dword [ebp - 8], eax
call fcn.0002712c
not ah
pushfd
mov dword [0x182f8], 0
bsf ax, bx
adc eax, 0xbff33a70
bsf ax, di
rcl ah, 1
mov eax, dword [0x183cc]
cmc
bt cx, bx
stc
test eax, eax
pushal
jmp 0x26a30
lea esp, [esp + 0x28]
jo 0x2b23d
push 0x81536a5a
mov dword [esp], esi
pushfd
mov dword [esp], fcn.0002150c
push 0x11d22c4c
jmp 0x1cfa8
lea esp, [esp + 0x24]
je 0x297a9
pushfd
mov dword [esp], 0
pushfd
mov word [esp], sp
mov dword [esp], eax
call fcn.000299a1
pushfd
jmp 0x21498
setae al
lea eax, [ebp - 0x195e60c7]
lea eax, [ebp - 0x5b54de8f]
mov eax, dword [ebp - 0x24]
pushal
mov dword [0x182fc], esi
mov dword [esp + 4], eax
mov byte [esp + 0x10], cl
mov dword [0x18300], edi
jmp 0x1cf68
sal ah, 3
clc
mov eax, dword [0x182fc]
stc
test eax, eax
pushfd
pushal
pushal
lea esp, [esp + 0x44]
je 0x23855
jmp 0x1b155
pushfd
call fcn.0001fc34
call fcn.0001e65a
pushal
mov dword [esp + 0x1c], edi
pushfd
mov dword [esp + 0x1c], 0
push 0xc829089c
push dword [esp + 8]
pushal
mov dword [esp + 0x40], eax
call fcn.0001f646
mov dword [esp + 0x20], 0x183d0
push dword [esp + 0x14]
call fcn.00026655
lea esp, [esp + 0x28]
call fcn.00015e10
movzx eax, al
jmp 0x11c34
push eax
call fcn.00020600
call fcn.00011b83

Function at 0x24f4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.000277f9
mov dword [esp + 4], edi
pushal
mov dword [esp + 0x20], esi
jmp 0x1fff6

Function at 0x25032
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 0x24], 0
push ecx
mov dword [esp + 0x24], ebx
jmp 0x259bb
je 0x1bc47
jbe 0x207e7
pushal
pushfd
push dword [esp + 0xc]
mov dword [esp + 0x24], 0x56
pushal
call fcn.00026741
not bh
sete bl
push 0x10efb4b3
mov dword [esp], edi
setl bh
lea ebx, [edi - 0x1865c401]
mov ebx, eax
pushal
push edx
jmp 0x1b3cc
mov word [esp], si
call fcn.00029a0a
lea edx, [edi + 9]
jmp 0x2b571
mov dword [ebp - 0x14], ebx
call fcn.0001f5bb
mov dword [ebp - 0x14], 0
pushfd
jmp 0x21671
mov word [esp], ax
pushfd
mov byte [esp + 4], ah
mov dword [esp + 4], str.200_OK
pushfd
pushal
mov dword [esp + 0x24], edx
pushal
call fcn.00025651
jmp 0x1b5b4

Function at 0x2538d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
je 0x20b86
call fcn.000217e2
Function at 0x25470
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0x20e34
call fcn.0001df67
call fcn.00023be6
mov eax, dword [ebp - 0xc]
pushal
call fcn.00025db3

Function at 0x2550c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], 0x11043
call fcn.00027458

Function at 0x25747
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x27c49
mov dword [esp + 0x20], 0
mov byte [esp], 0xd7
mov byte [esp], 0x4f
pushal
push eax
mov dword [esp + 0x40], esi
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0x4c]
jmp fcn.0001e86e

Function at 0x2598e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov byte [esp + 8], ah
pushfd
inc eax
cmc
cmp cl, 0x29
test al, al
test cl, cl
push dword [esp + 8]
jmp 0x28e2e
movzx ax, dl
movzx dx, dl
mov eax, dword [ecx + esi*8 + 4]
bswap dx
xchg cl, dh
lea edx, [eax + 1]
inc cl
lea esp, [esp + 8]
push eax
pushal
not cl
mov cl, byte [eax]
jmp 0x1e406
mov byte [esp], bl
lea esp, [esp + 0x4c]
jne 0x22a28
jmp 0x20e63

Function at 0x25bd8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je fcn.0002150c
pushfd
bt di, cx
test eax, eax
jmp 0x2b4ce
pushfd
pushfd
mov byte [esp], ch
lea esp, [esp + 0xc]
je fcn.0002150c
lea edx, [edi + 0x51b0724a]
bswap dx
lea edx, [ebp - 0x1c]
call fcn.00022fd7

Function at 0x25c14
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd015a7cf
lea esp, [esp + 8]
je 0x1f0cf
call fcn.000238d6

Function at 0x25d98
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
mov dword [esp], 1
pushal
lea esp, [esp + 0x20]
jns 0x24cd9
push ecx
mov word [esp], 0xd027
mov dword [esp], 0x120116
push eax
pushal
call fcn.000110e6
push 0x35b91dcf
push dword [esp]
mov dword [esp + 4], 0x120116
push 0xd807a963
mov dword [esp + 4], esi
pushfd
pushal
call fcn.0001e697
push 0xd119d96c
lea esp, [esp + 0xc]
je 0x24286
push edi
jmp 0x221e0

Function at 0x25f13
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x1b7c5
jmp 0x228e4

Function at 0x26383
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], cl
call fcn.0002b2c2
test cl, cl
pushal
lea esp, [esp + 0x30]
jne 0x1b7c5
push 0x754919c2
cmp ah, dh
sub eax, edx
jmp 0x22660

Function at 0x265d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 0x30], 0
push dword [esp]
pushfd
call fcn.0001dbc6

Function at 0x26f32
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
je 0x20b86
push ebx
pushfd
push eax
call fcn.00027e3f
mov byte [esp + 0xc], 0x5e
lea esp, [esp + 0x38]
jne 0x1ca7d
cmc
test ah, 0x48
push 0x9a88a01f
mov dword [esp], esi
sub eax, edx
push edx
pushfd
mov byte [esp + 4], bl
mov dword [ebp - 8], eax
pushfd
jmp 0x21fc8
Function at 0x28486
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
lea esp, [esp + 0x24]
je 0x1f0cf
pushal
movsx dx, al
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x14], 0xc0cee0fd
pushal
call fcn.000204ff
cmp dword [ebp - 0x10], 0
pushal
jmp 0x1b1c8
lea esp, [esp + 0x30]
call fcn.00015e70
jmp 0x22b16

Function at 0x28ae1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x2c]
jne 0x254f8
pushal
mov dword [esp + 0x1c], 1
call fcn.0001eb43

Function at 0x28e5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x3c]
je 0x20b86
not di
dec edi
lea edi, [esi - 0x9936f13]
pushal
mov edi, eax
jmp 0x29cb1
mov dword [ebp - 8], eax
jmp 0x2435d
jmp 0x28672

Function at 0x29122
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1d954
mov dword [ebp - 8], eax
jmp 0x1e5ca
pushfd
pushfd
lea esp, [esp + 0x2c]
je 0x1cd4b
mov di, 0xfca2
pushfd
mov edi, eax
pushal
jmp 0x2a702
push dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
pop dword [esp + 0x24]
pushal
push dword [esp]
pushfd
push dword [esp + 0x4c]
ret 0x50
lea esp, [esp + 0x38]
jne 0x1b7c5
pushal
pushfd
bt bp, si
sub eax, edx
jmp 0x1b38c
inc edi
pushfd
mov dword [esp + 0x24], edi
push 0xc726eab
push esp
mov dword [esp + 0x28], 0
push dword [esp]
mov byte [esp + 0xc], 0x93
mov dword [esp + 0x28], 0x1c3d8
mov word [esp + 0x10], ax
jmp 0x224c9

Function at 0x292b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x1f6b78a8
mov byte [esp], 0xff
mov dword [esp + 8], edi
jmp 0x1ff3d
mov dword [esp + 4], 0
pushfd
push 0x366efabc
mov dword [esp + 8], 0x291bd
mov byte [esp + 4], 0x60
push dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
pop dword [esp + 4]
pushal
pushal
push 0xc56c1e6b
push ebx
push dword [esp + 0x4c]
ret 0x50
push dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
pop dword [esp + 0x3c]
mov word [esp], 0x9994
push dword [esp + 0x3c]
ret 0x40
pushfd
mov dword [esp], edi
pushal
pushal
pushfd
mov word [esp], 0xf200
mov dword [esp + 0x40], 0
mov byte [esp], 0x58
mov dword [esp + 0x3c], 0x28405
pushfd
jmp 0x22cfc
jmp 0x251e9
mov dword [esp + 4], esi
lea esp, [esp + 0x4c]
je 0x20b86
not di
mov edi, eax
js 0x2987c
pushfd
push dword [esp]
inc edi
lea esp, [esp + 8]
jb 0x2543d
push edi
pushal
mov byte [esp], 0x5d
call fcn.0001b4bf
pushfd
push 0xe9eb1add
inc edi
jmp 0x1ba42

Function at 0x296ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp], 0
push 0x2c2650ed
lea esp, [esp + 4]
call fcn.00015eb0
call fcn.0001d915
mov dword [esp + 4], eax
cmc
push esi
add ecx, esi
mov byte [esp + 4], dl
pushal
push 0xa3b34a7a
pushfd
mov dword [esp + 0x2c], ecx
pushfd
pushfd
lea esp, [esp + 0x34]
jp 0x28a26
pushal
mov dword [esp + 0x1c], 0
pushal
pushfd
mov byte [esp], 0xa
jmp 0x1ba72
Function at 0x29c6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror si, cl
or si, dx
mov esi, eax
call fcn.00029fba
push ebp
mov word [esp + 4], 0xfcaf
mov dword [esp], 0x908c3a6
mov dword [ebp - 0x20], eax
call fcn.000240b6
lea esp, [esp + 4]
je 0x1c510
shrd dx, bx, 0xa
pushal
neg dx
mov edx, dword [ebp - 0x30]
cmp bl, 0xa5
mov dword [ebp - 0x1c], edx
bt di, 9
cmp edx, 0x28
mov word [esp + 0x10], ax
pushfd
mov byte [esp], 0x8c
lea esp, [esp + 0x24]
jb 0x23c38
btc ax, 4
aad 0xfb
xor cx, 0xdd66
rcl ax, 0xd
mov eax, dword [esi + 0x14]
cmc
bsf edi, ebx
test dh, 0xe8
shr edi, cl
mov ecx, dword [esi]
and di, bp
lea edi, [ecx + eax]
call fcn.0001dff7
jmp 0x241d4
lea esp, [esp + 0x40]
call fcn.000112a0
inc si
jle 0x20288
sal si, cl
mov esi, eax
pushfd
jmp 0x2b4fd
clc
test esi, esi
jmp 0x2783b

Function at 0x2a179
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00027e4c
push edx
pushal
pushfd
call fcn.00023172
mov dword [esp], 0x56
pushfd
lea esp, [esp + 4]
jo 0x1d1b8
push edi
mov dword [esp], 0x439e1cc3
mov dword [esp], esi
jle 0x26546
push 0x18068
pushal
lea esp, [esp + 0x20]
call fcn.00015e70
clc
cmp dword [ebp - 0x10], 0
push 0x20f8f34d
lea esp, [esp + 4]
je 0x1f0cf
mov dl, 0x9b
setb dl
movzx dx, bl
mov edx, dword [ebp - 0x10]
jmp 0x239d7

Function at 0x2a3a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov word [esp], dx
push eax
lea esp, [esp + 0x28]
call sub.ntoskrnl.exe_rand
shl si, cl
movzx esi, cl
rol esi, 0x17
test ah, dl
mov esi, eax
pushfd
and esi, edi
mov byte [esp], ah
mov byte [esp], 0xfd
cmp esi, edi
mov byte [esp], al
pushfd
pushfd
lea esp, [esp + 0xc]
jb 0x285b4
setae dl
dec esi
rdtsc
rdtsc
lahf
mov edx, dword [0x182e4]
push 0xc49825c
push 0xc7186186
mov eax, dword [edx + esi*8 + 4]
pushfd
pushfd
lea edx, [edx*8 - 0x1732b44a]
lea edx, [eax + 1]
pushfd
dec cl
lea esp, [esp + 0x14]
setae cl
dec cl
mov cl, byte [eax]
pushal
push 0xb977e0ae
jmp 0x1cc11

Function at 0x2aaa8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x23c38
rcr ah, cl
cmp esp, edx
btr ax, 0xd
shld ax, di, 0xb
xor edx, edx
neg eax
mov eax, section..data
pushfd
cmc
xchg dword [eax], edx
test bh, 0x9c
push 0x59146c49
test edx, edx
call fcn.0001e18d
test dl, 0x52
cmp dword [esi + 0x18], eax
pushal
pushfd
jmp 0x1f52d

Function at 0x2afe0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0xc]
mov word [esp], bp
jmp 0x1db88

Function at 0x2b0b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x24]
jnp 0x265e2
jne 0x254f8
pushal
pushal
jmp 0x2433a
call fcn.0001eda0
test ah, cl
stc
bt bp, cx
mov dword [ebp - 0x10], 0
bt esp, ebx
cmc
cmp byte [ebp - 2], 0
pushal
jmp 0x1ea19
mov dword [esp + 0x3c], 1
push edi
call fcn.0001fffb
push edi
lea esp, [esp + 4]
jne 0x254f8
pushal
pushal
mov dword [esp + 0x3c], 1
pushfd
mov word [esp], dx
jmp 0x29200
mov dword [esp + 0x3c], 0x100080
call fcn.00026f74
lea esp, [esp + 4]
jo 0x23254
push esp
push dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop dword [esp]
pushfd
push dword [esp + 4]
ret 8