joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450d40
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00450e90
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x450d60
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x450d41
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00450e90
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x450d60
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x450d90
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x450de7
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x450dfd
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00450e20
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x450e20
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x450eb0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x450ef9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x451370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x474880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00450f20
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00450fa0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00450fa0
lea ecx, [esi + 0xc]
call fcn.00465e76
lea ecx, [esi + 0x10]
call fcn.00465e76
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004537d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004537d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004537d0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00465eeb
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00465eeb
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x452018
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x474aa8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x452028
call fcn.00452540
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x45210b
cmp byte [edi], 0
je 0x45210b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x45204d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00450d40
test eax, eax
jne 0x45206d
push 0x55f7c8
lea ecx, [esi + 0x38]
call fcn.00466028
jmp 0x45210b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00450d90
test eax, eax
jne 0x45209c
mov ecx, esi
call fcn.00450e90
push edi
add esi, 0x38
push 0x55f7a4
push esi
call fcn.00463e87
add esp, 0xc
jmp 0x45210b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00452dc0
test eax, eax
je 0x452104
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004521e0
test eax, eax
jne 0x452120
push edi
lea eax, [esi + 0x38]
push 0x55f780
push eax
call fcn.00463e87
add esp, 0xc
mov ecx, esi
call fcn.00452540
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4521c8
mov ecx, dword [0x55fa38]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00463e87
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00450e40
test eax, eax
jne 0x45218a
push 0x55f764
lea ecx, [esi + 0x38]
call fcn.00466028
jmp 0x45219a
push 0xfa
mov ecx, esi
call fcn.00452dc0
test eax, eax
jne 0x4521b7
mov ecx, esi
call fcn.00452540
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00465eeb
jmp 0x45210b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00465eeb
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x46828f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4682c7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00466346
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046631e
jmp 0x4682d3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x469981
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4699c3
call fcn.0046f4f4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4699c3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4699ba
xor eax, eax
jmp 0x4699cb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004699d1
pop edi
pop esi
pop ebx
ret 4

Function at 0x46fa24
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46fa52
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46fa70
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046f98a
jmp 0x46fa70
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46fa70
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046f98a
test edi, edi
mov eax, edi
jne 0x46fa5a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4bd995
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4bd9be
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x4bd9f6
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x4bd9eb
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0x10], ecx
jae 0x4bd9eb
mov eax, dword [ebp - 4]
jmp 0x4bd9f8
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x4bd9b5
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bda45
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x4bda7a
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp + 0x18], 0
jne 0x4bda91
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4bdbde
mov ecx, dword [ebp + 8]
and ecx, 0xfffffffe
je 0x4bdaaa
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4bdbde
cmp dword [ebp + 0xc], 0
je 0x4bdab6
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4bdac7
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4bdbde
mov edx, dword [ebp + 8]
and edx, 1
sete al
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4bdafa
cmp dword [ebp + 0x14], 0
ja 0x4bdafa
jb 0x4bdae9
cmp dword [ebp + 0x10], 0x40
jae 0x4bdafa
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4bdbde
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x4bdb18
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4bdbde
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4bdb77
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x14]
ja 0x4bdb6c
jb 0x4bdb46
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
jae 0x4bdb6c
cmp dword [ebp - 0x10], 0xffffffe7
jae 0x4bdb6c
mov edx, dword [ebp - 0x10]
add edx, 0x18
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp + 0x14]
jb 0x4bdb77
ja 0x4bdb6c
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0x10]
jb 0x4bdb77
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4bdbde
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [0x13050]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx]
jae 0x4bdbc1
mov eax, dword [0x13050]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
jb 0x4bdba4
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4bdbde
mov edx, dword [ebp - 8]
add edx, 0xf8
mov eax, dword [0x13050]
cmp edx, dword [eax]
jb 0x4bdbc1
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4bdbde
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x4bdbd7
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4bdbde
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jl 0x4bdbec
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d8ee6
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004d9096
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4d8fe4
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4d8f87
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4d8fca
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4d8f9e
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4d8fb9
test al, 0x40
je 0x4d8fb0
mov ecx, dword [edi + 0x20]
jmp 0x4d8fb7
test al, 0x80
je 0x4d8fca
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4d8fca
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4d8f56
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4da9e8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4daa11
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x4daa49
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x4daa3e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0x10], ecx
jae 0x4daa3e
mov eax, dword [ebp - 4]
jmp 0x4daa4b
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x4daa08
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4daa98
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x4daacd
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp + 0x18], 0
jne 0x4daae4
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4dac31
mov ecx, dword [ebp + 8]
and ecx, 0xfffffffe
je 0x4daafd
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4dac31
cmp dword [ebp + 0xc], 0
je 0x4dab09
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4dab1a
mov dword [ebp - 0x14], 0xc000000d
jmp 0x4dac31
mov edx, dword [ebp + 8]
and edx, 1
sete al
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4dab4d
cmp dword [ebp + 0x14], 0
ja 0x4dab4d
jb 0x4dab3c
cmp dword [ebp + 0x10], 0x40
jae 0x4dab4d
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4dac31
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x4dab6b
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4dac31
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4dabca
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x14]
ja 0x4dabbf
jb 0x4dab99
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
jae 0x4dabbf
cmp dword [ebp - 0x10], 0xffffffe7
jae 0x4dabbf
mov edx, dword [ebp - 0x10]
add edx, 0x18
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp + 0x14]
jb 0x4dabca
ja 0x4dabbf
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0x10]
jb 0x4dabca
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4dac31
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [0x13050]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx]
jae 0x4dac14
mov eax, dword [0x13050]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
jb 0x4dabf7
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4dac31
mov edx, dword [ebp - 8]
add edx, 0xf8
mov eax, dword [0x13050]
cmp edx, dword [eax]
jb 0x4dac14
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4dac31
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x4dac2a
mov dword [ebp - 0x14], 0xc000007b
jmp 0x4dac31
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jl 0x4dac3f
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x58545e
Capabilities:
Check for trap flag exception

Disassembly:
mov ebx, edi
mov edx, dword [esp + 0xe]
mov ebx, dword [esp]
mov bx, word [esp]
mov bl, bh
xchg bl, bh
jmp 0x585f7d
mov bx, 0xc23d
bswap edx
xchg edx, ebx
lea edx, [ecx + ebx]
not ebx
mov bx, sp
jmp 0x585419
mov edx, ecx
mov ecx, dword [esp + 5]
mov bl, byte [esp]
jmp 0x58543f
push edx
lea esp, [esp + 4]
jmp 0x56f977
setb bl
pushal
mov bl, 0x80
bswap ebx
mov ebx, dword [esp + 0x42]
lea esp, [esp + 0x4c]
jmp 0x58556e

Function at 0x695c2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
xchg ebx, ecx
xchg dh, al
neg bh
lea esp, [esp]
neg eax
jmp 0x695bfa
mov al, 0xfe
xchg dh, al
mov cl, 0x32
mov dl, dh
mov ecx, dword [esp]
xchg byte [esp], cl
jmp 0x695b4f
xchg dh, al
mov di, bx
mov di, 0x6ef9
neg bp
btc ecx, ebx
neg esi
jmp 0x695b6d
mov edi, esi
pop di
mov edx, dword [esp]
add esp, 2
bsr di, bp
and ebx, ecx
jmp 0x695b8b
lea esi, [eax*4]
xchg si, bp
sub esp, 0xe
inc dx
mov si, sp
mov ah, byte [esp + 1]
jmp 0x695c0c
mov ebx, 0xe5185c5e
btc ebp, ebx
inc si
rdtsc
xor dl, ch
mov edi, dword [esp]
jmp 0x695bb6
inc cl
mov bl, 0xa8
not di
lea ebx, [esp + ecx]
add esp, 0
add esp, 0
jmp 0x695bdc
mov cx, di
mov bh, byte [esp + 2]
inc di
mov dword [esp + 3], esi
xchg dword [esp + 1], eax
pushal
jmp 0x695c5c
lea ecx, [esp + ebp]
pop word [esp + 1]
not si
mov si, word [esp + 2]
jmp 0x695ba4
mov dword [esp + 6], esi
clc
inc edi
rdtsc
xchg cx, bx
mov ax, word [esp + 6]
call fcn.00695c40

Function at 0x69610e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x1c]
not di
bswap ebp
shl cx, cl
jmp 0x696135
Function at 0x696bdd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 4]
mov byte [esp + 7], ch
push dword [esp + 8]
mov ax, word [esp + 8]
add esp, 0x12
jmp 0x69698d
xchg di, bp
lea esp, [esp + 1]
btr edi, edx
xchg byte [esp + 2], dl
mov byte [esp + 3], ah
add esp, 1
jmp 0x696919
pop word [esp + 0x29]
mov ax, word [esp + 5]
not dh
pop ecx
lea esp, [esp + 0x16]
add esp, 4
jmp 0x696933
sub esp, 8
xchg word [esp + 8], cx
mov ax, word [esp + 8]
cpuid
mov bl, 0xb8
cld
jmp 0x6969b9
xchg cx, si
and dx, 0x45d2
cld
cpuid
mov byte [esp + 1], ch
jmp 0x696966
bswap eax
lea eax, [ebx*4]
push dword [esp + 4]
pushal
bswap ecx
setg bh
jmp 0x696950
xchg byte [esp], dl
push dword [esp + 2]
push dword [esp + 0xa]
setns ch
not ah
xchg ecx, ebp
jmp 0x696a52
bswap esi
push edx
stc
cmc
xchg bh, cl
mov dl, dh
jmp 0x6969a4
mov ebx, dword [esp + 3]
pop dword [esp]
xchg byte [esp + 2], dl
push edx
xor dl, ch
btr ecx, edx
jmp 0x696ad4
rdtsc
bswap edx
mov word [esp + 6], di
mov ebp, 0x1ac4d8b6
bsr cx, cx
lea esp, [esp + 6]
jmp 0x6969e9
mov dh, byte [esp + 0xd]
add si, 0x5b0e
btr esi, esp
mov bh, byte [esp + 8]
btr ebx, esp
mov ebx, dword [esp + 0xc]
jmp 0x696a0b
add esi, ebp
rdtsc
pop si
bswap edx
xchg ebp, ebx
pop word [esp]
jmp 0x696a35
lea esp, [esp + 9]
mov esi, ecx
mov ecx, dword [esp]
bsf si, si
xchg bx, ax
rdtsc
jmp 0x696aaf
xchg byte [esp + 4], al
pop ebx
not ah
sub esp, 2
inc ebx
xchg esi, ebx
jmp 0x696a62
mov ebx, eax
cld
shl ax, cl
push dword [esp + 8]
cmc
xchg word [esp + 1], dx
jmp 0x696a7d
mov dx, 0x431d
setbe bh
xchg byte [esp], bl
pop bp
shr ah, 1
mov di, sp
call fcn.00696aee
retf
mov dh, byte [esp + 6]
mov ebp, 0xbe675982
xchg cx, bp
mov bx, word [esp + 5]
mov word [esp + 4], dx
xchg ecx, ebp
jmp 0x696a9d
mov byte [esp + 5], bh
push word [esp + 8]
cld
bsr bx, bp
not si
lea eax, [ebp + 0x87]
jmp 0x6969de
xchg bh, cl
pushal
lea esp, [esp + 0x1e]
mov bl, bh
xchg word [esp], si
pop word [esp + 5]
jmp 0x696b11
mov bh, byte [esp + 6]
mov cx, 0xf66f
lea edx, [edx + ebp]
setae ch
xchg byte [esp], al
jmp 0x696b83

Function at 0x698c5a
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 4], di
push word [esp + 4]
mov byte [esp + 9], bh
jmp 0x698cfb
mov byte [esp + 5], ch
pop word [esp + 2]
pop word [esp + 2]
lea esp, [esp + 3]
mov dword [esp + 0x54], esp
call fcn.00698cb6
jae 0x698d82
test dword [edi], esi
dec edi
aad 0x45
sub al, 0xdf
push 0xffffffffffffffdf
inc esi
aam 0xb3
dec esi
leave
ja 0x698df4
mov eax, dword [0x30]
and al, 0x5c
xchg ebx, eax
js 0x698d8c
adc al, byte [eax + 0x15f212e7]
xchg edi, eax
pop es
bound edx, qword [ecx - 0x61f7728f]
stc
or cl, ah
sub eax, 0xaf5c35a5
dec edi
pop ebp
salc
inc esp
and ebx, esi
jns 0x698de2
dec ebx
fstp xword [esi - 0x139a60b3]
bound eax, qword [0xf9751bf4]
imul ecx, dword [eax], 0xbb5817fb
xchg edx, eax
or eax, 0x840fef9c
jge 0x698e22
invalid

Function at 0x698cb6
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 1], ch
pop dword [esp]
mov word [esp], bx
mov dword [esp + 0x54], ebp
push esp
jmp 0x698cd3
push dword [esp]
jmp 0x698c9f
Function at 0x698cbb
Capabilities:
Parse pe header

Disassembly:
push edx
lea esp, [esp + 0x29]
call fcn.00698ce2
fimul dword [edi - 0x21]
mov edx, 0xe070be49
jbe 0x698ce0
loopne 0x698d18
popfd
in al, dx
push word [esp + 3]
pushal
mov dword [esp + 0xf], esi
call fcn.00698cbb
invalid

Function at 0x698d2d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0069809c
mov word [esp], sp
pop word [esp]
lea esp, [esp + 2]
push esp
jmp 0x698dcd
mov eax, dword [eax + 8]
jmp 0x698db4
mov eax, dword [eax]
jmp 0x698d61
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x698d78
push eax
jmp 0x698097
push word [esp + 3]
mov word [esp + 1], sp
push word [esp + 4]
lea esp, [esp + 1]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
jmp 0x698d8f
Function at 0x4092eb
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x40930d
mov eax, 0xfffffffd
jmp 0x409385
mov ebx, dword [0xd401b0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x409353
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0xd401b0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x40937b
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x409385
mov esp, ebp
pop ebp
ret 4
Function at 0x412107
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret