joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43278d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00433445
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004328ed
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4328d7
test ebx, ebx
jl 0x43287b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce8bf1
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43289c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x43288e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0043425d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0043425d
add esp, 8
mov ebx, 0x80070057
jmp 0x43287b
Function at 0x448fcd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00449c85
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0044912d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x449117
test ebx, ebx
jl 0x4490bb
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcff431
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4490dc
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4490ce
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044aa9d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044aa9d
add esp, 8
mov ebx, 0x80070057
jmp 0x4490bb
Function at 0x45f82d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004604e5
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f98d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f977
test ebx, ebx
jl 0x45f91b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd15c91
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f93c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f92e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004612fd
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004612fd
add esp, 8
mov ebx, 0x80070057
jmp 0x45f91b
Function at 0x47642d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004770e5
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0047658d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x476577
test ebx, ebx
jl 0x47651b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c891
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47653c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x47652e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477efd
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477efd
add esp, 8
mov ebx, 0x80070057
jmp 0x47651b
Function at 0x48db9d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048e855
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048dcfd
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48dce7
test ebx, ebx
jl 0x48dc8b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd44001
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48dcac
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48dc9e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048f66d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048f66d
add esp, 8
mov ebx, 0x80070057
jmp 0x48dc8b
Function at 0x4a485d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a5515
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a49bd
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a49a7
test ebx, ebx
jl 0x4a494b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5acc1
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a496c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a495e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a632d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a632d
add esp, 8
mov ebx, 0x80070057
jmp 0x4a494b
Function at 0x4b8745
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c13a0
cmp edx, dword [eax]
je 0x4b8767
add eax, 8
inc ecx
cmp eax, 0x4c1430
jl 0x4b8758
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c13a0]
jne 0x4b8895
mov eax, dword [0x4c5d3c]
cmp eax, 1
je 0x4b886f
test eax, eax
jne 0x4b8798
cmp dword [0x4c12c8], 1
je 0x4b886f
cmp edx, 0xfc
je 0x4b8895
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b87cf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9130
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b95c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b8812
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b95c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bdab4
push edi
call fcn.004bb490
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9130
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9140
lea eax, [ebp - 0xa0]
push 0x4bda94
push eax
call fcn.004b9140
push dword [esi + 0x4c13a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9140
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bb404
add esp, 0x2c
pop edi
jmp 0x4b8895
lea eax, [ebp + 8]
lea esi, [esi + 0x4c13a4]
push 0
push eax
push dword [esi]
call fcn.004b95c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7dbcc8
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push word [esp + 7]
jmp 0x7dbce3
Function at 0x7dbda9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07cd1e8
jmp 0x7dbde1
lea esp, [esp + 2]
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
jmp 0x7dbdbe
lea esp, [esp + 0xc]
jmp 0x7dbdf7
pushfd
jmp 0x7dbccf

Function at 0x7e0164
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07cd1e8
jmp 0x7e01e0
pop word [esp + 9]
push word [esp + 0x1c]
mov dword [esp + 0x1c], edx
pushal
jmp 0x7e0149
pop dword [esp + 0x10]
mov byte [esp + 6], bl
mov word [esp + 7], di
push dword [esp + 7]
jo 0x7e00da
jno 0x7e0123
pushal
mov byte [esp + 0x1b], al
jmp 0x7e014d
push edi
mov byte [esp], dh
mov dword [esp], edx
push word [esp + 3]
jmp 0x7e027c
pop word [esp + 9]
push word [esp + 0x1c]
mov dword [esp + 0x1c], edx
jmp 0x7e0105
push dword [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x3c], ebp
push bx
jmp 0x7e01a6
mov byte [esp + 0x1b], al
mov byte [esp + 0x17], al
mov dword [esp + 0x38], ebx
push edi
mov dword [esp + 0x38], esp
jmp 0x7e010c
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 3]
push ecx
pushal
jmp 0x7e00f0
lea esp, [esp + 1]
jmp 0x7e01ce
mov dword [esp + 0x3c], esi
push dx
push word [esp]
jb 0x7e0176
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x7e01b8
lea esp, [esp]
mov word [esp], cx
mov word [esp], bx
push ecx
lea esp, [esp + 2]
jmp 0x7e018c
lea esp, [esp + 1]
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x7e01de
lea esp, [esp + 2]
lea esp, [esp + 1]
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x7e020a
mov dx, 0x7409
lea ebp, [ebp - 0xd0]
clc
jmp 0x7e0210
mov edi, dword [esp + 0x2c]
add bx, bp
ja 0x7e024a
jbe 0x7e0234
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
push 0x2542cc5c
aam 0x66
fnstcw word [eax]
pushfd
jmp 0x7dfcdc
js 0x7e01f1
jns 0x7e01f1
or byte [edi + 0x13996a0f], bl
invalid
mov dword [esp + 0x3c], ebp
push bx
lea esp, [esp]
jmp 0x7e01a9
push ecx
xchg word [esp + 1], dx
jmp 0x7e0250
push ecx
xchg word [esp + 1], dx
lea esi, [esp + 4]
rdtsc
jmp 0x7e025c
bswap ebx
mov ah, byte [esp]
rcr bp, cl
jbe 0x7e02a2
ja 0x7e02a2
xchg ebp, eax
add byte [esi + 0x25c200f1], dl
mov ebp, 0x71c7342d
adc eax, 0x967b1c8e
sub byte [edi - 0x4e7df01a], bl
invalid
jb 0x7e0133
push dword [esp + 1]
lea esp, [esp + 2]
jmp 0x7e0226
mov ebp, esp
cpuid
lea ebx, [esi*4]
lea edx, [ebp + ebp]
jmp 0x7e02c0
sub esp, 0xbc
jmp 0x7e028c
mov eax, 0x4311d94a
Function at 0x7f6978
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esp, ebx
pushfd
lea ebp, [ecx + ebx - 0x40]
call 0x7f6978
pop ss
push cx
push word [esp + 1]
pop word [esp]
lea esp, [esp + 2]
xchg dword [esp], ebp
jmp 0x7f69a7
lea esp, [esp + 1]
lea esp, [esp + 3]
sub ebx, ecx
push di
lea esp, [esp + 2]
jmp 0x7f696b
sub esp, 5
push dword [esp + 3]
lea esp, [esp + 1]
lea ebp, [ebp - 0x22]
stc
cmc
jmp 0x7f69e1
pushfd
jmp 0x7f6995
xchg dword [esp + 8], ebp
call 0x7f69cb
mov edi, ebx
pushal
and dx, ax
jg 0x7f6a21
bsf edi, esp
rdtsc
lea ebx, [esi*4]
jmp 0x7f6b39
bsf edi, esp
rdtsc
lea ebx, [esi*4]
jmp 0x7f6a23
jmp 0x7f6a0b
mov dword [esp + 0x18], ecx
popal
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x7f6aa5
pop edi
pop esi
popfd
jmp 0x7f2c2f
mov ecx, esi
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp 0x7f6a2d
mov dword [esp + 0x18], ecx
popal
call fcn.007f6a9c
Function at 0x7f709d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 4], ecx
mov ax, 0x2c10
lea edx, [eax + edi]
lea eax, [eax + edi]
xchg dx, ax
jmp 0x7f70c1
push ebp
bswap edx
push di
not dx
lea esp, [esp + 2]
jmp 0x7f7087
lea ecx, [ecx + 0x3f]
sub dh, 0xb3
mov ah, byte [esp]
call fcn.007f70ab
popfd
adc byte [esi + 0x1da510e1], al
lea ebx, reloc.KERNEL32.dll_VirtualQuery
out dx, eax
div bh
fmul dword [ebp + reloc.KERNEL32.dll_VirtualQuery]
outsd dx, dword [esi]

Function at 0x7f7125
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], ax
push dword [esp + 3]
jns 0x7f7145
js 0x7f714d
insd dword es:[edi], dx
cld
xchg edx, eax
cmc
add al, 0xb0
dec ecx
call 0xf200d749
push esi
call fcn.007f7125
not eax
jmp 0x7f718b
Function at 0x8bbc46
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
pushal
xchg esi, eax
lea ecx, [esi*4]
bsr ebp, ebp
jmp 0x8bbc50
mov byte [esp + 2], bl
clc
add esp, 3
jmp 0x8bbc30
setl ah
not dh
shr ebx, 0x1d
rdtsc
mov dh, cl
sub esp, 0x1e
jmp 0x8bbc94
push sp
mov cx, 0x8f8f
mov word [esp + 2], bx
mov bl, 0xc7
neg esi
jmp 0x8bbcba
bswap ebx
pop si
mov ch, 0x67
mov dx, si
add esp, 0x19
xchg cx, ax
jmp 0x8bbc7e
xchg byte [esp], ah
add esp, 0
setbe ch
lea esp, [esp]
mov cl, byte [esp]
jmp 0x8bbce4
mov bx, di
mov bp, di
pop word [esp]
push word [esp]
add esp, 4
cmc
jmp 0x8bbca4
btc edi, edi
lea edi, reloc.KERNEL32.dll_VirtualQuery
mov ebx, 0xa064b90e
jmp 0x8bbde9
neg ebp
cpuid
mov cl, dh
neg dl
add esp, 0
mov si, word [esp]
jmp 0x8bbcce
push dword [esp + 0xe]
dec di
clc
bsr bx, bx
mov ebp, edx
mov ebx, edi
jmp 0x8bbd70
stc
xchg dl, bh
lea ebp, [ebx + esi]
push dword [esp + 0x13]
mov dword [esp + 3], ebp
rol ch, 1
jmp 0x8bbd11
pop edi
btc ax, di
lea edx, reloc.KERNEL32.dll_VirtualQuery
lea eax, [edx + edx]
lea ebx, [ebx*4]
cmc
jmp 0x8bbd27
bsf edx, ebp
lea edi, [ebp*4]
lea ecx, reloc.KERNEL32.dll_VirtualQuery
jmp 0x8bbd8b
sub esp, 0xb
xchg byte [esp + 0x27], dl
lea ebp, [ebx + 0xae]
mov ebx, 0xc2259ac2
mov dl, 0xef
mov bx, word [esp + 9]
jmp 0x8bbd5a
lea ebp, reloc.KERNEL32.dll_VirtualQuery
pop dword [esp + 8]
bts bx, dx
push cx
setnp dh
mov cl, 0xa5
jmp 0x8bbdbf
pop edx
xchg byte [esp + 6], al
push word [esp + 0x14]
mov ax, si
xchg si, di
mov ebp, ebx
jmp 0x8bbd42
bsr bp, cx
pop dword [esp + 0xe]
dec ah
mov edx, esi
cpuid
mov di, word [esp + 0x25]
jmp 0x8bbe65
and esi, 0x4fac3d87
pushal
xchg dword [esp + 0x13], ebx
xchg word [esp + 0xb], bp
pop cx
xchg word [esp + 0x11], ax
jmp 0x8bbdab
xchg bx, dx
mov si, word [esp + 0x19]
pop word [esp + 0x15]
xchg esi, ecx
jmp 0x8bbe40
push dword [esp]
mov cl, byte [esp + 1]
xchg dword [esp], edi
rdtsc
mov cl, 0x4f
cmp edi, ebp
jmp 0x8bbe02
cpuid
xchg ebp, eax
cpuid
bswap eax
mov ah, byte [esp + 9]
jmp 0x8bbe90
lea eax, [ebx + edi]
add esp, 0x1f
pop edx
lea ebp, [esp + esi]
sub esp, 0x17
xchg ebp, edx
jmp 0x8bbe2a
stc
pop bx
setns ah
xchg dword [esp + 9], edi
mov cx, di
lea eax, reloc.KERNEL32.dll_VirtualQuery
jmp 0x8bbe18
mov eax, 0x35c72cc7
call fcn.008bbe7a
inc ecx
leave
pop ecx
cmp bl, cl
sub esp, ecx
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffcd
or esp, dword [edx + reloc.KERNEL32.dll_VirtualQuery]
in al, 0x33
movsb byte es:[edi], byte [esi]
out dx, eax
retf 0x2e00