joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d220
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.004279d0
test eax, eax
je 0x42d30f
mov ecx, edi
call fcn.004279d0
mov ecx, eax
call fcn.00425040
test eax, eax
jne 0x42d30f
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42d30f
mov eax, dword [0x576c48]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x42d282
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
push 1
push ecx
mov ecx, dword [edi + 0x44]
lea edx, [esp + 0x1c]
shr ecx, 4
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
and ecx, 1
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.004279d0
mov ecx, eax
call fcn.00425270
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, eax
jne 0x42d30f
cmp ebx, eax
jne 0x42d30f
cmp dword [esp + 0x10], eax
jne 0x42d2f5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push eax
mov ecx, edi
call dword [edx + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x42ff40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x465b18
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x42ff79
inc eax
mov dword [esi + 0x10], eax
jmp 0x43008c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x42ff8d
mov eax, 0xffffffc7
jmp 0x43008e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x42ff9e
cmp dword [esi + 8], eax
jne 0x42ff8d
cmp dword [esi + 8], eax
jne 0x42ffb7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x42ffb7
mov eax, 0xffffffc7
jmp 0x43008e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x42ffcb
push eax
mov ecx, ebx
call fcn.0042f770
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00402550
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x42fffc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00402570
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0042eee0
test eax, eax
mov dword [esp + 0x38], eax
je 0x43002f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x54c9e0
call fcn.00402750
mov eax, dword [esp + 0x38]
jmp 0x43008e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0042fda0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x430073
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0042fdc0
mov esi, eax
test esi, esi
jne 0x4300a3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0042fda0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x430045
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x54c9e0
call fcn.00402750
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x54c9e0
call fcn.00402750
mov eax, esi
jmp 0x43008e

Function at 0x433170
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4331d0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4331d0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4331d0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4331d0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x433210
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4390e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x466148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0045f202
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00438a80
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0045f130
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0045b9f4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0045b9f4
push 1
push 0
push 0
mov ecx, esi
call fcn.0045b99c
push 1
push 0
push 1
mov ecx, esi
call fcn.0045b99c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045f274
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x439260
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x466168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0045f202
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00438a80
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0045f130
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x439324
cmp dword [esp + 0x40], 1
jne 0x439322
cmp ecx, eax
jge 0x439324
mov eax, ecx
cmp eax, 0xc8
jge 0x439330
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.004390e0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045f274
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x439ab0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4661d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00459e14
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0045f4aa
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004609c6
test eax, eax
je 0x439bcc
mov ecx, dword [esp + 0x3c]
call fcn.0045f4d7
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x439b90
push edi
mov ecx, esi
call fcn.0045cb3b
mov ecx, esi
call fcn.00439d30
cmp dword [esp + 0x38], 1
jne 0x439bc5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045cc76
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43c5f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43c623
push esi
call fcn.0043f6e0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43c61c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43c6a9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43c692
mov eax, dword [esi + 8]
test eax, eax
je 0x43c647
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43c68e
cmp eax, 2
je 0x43c692
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43c63a
cmp eax, 3
je 0x43c66d
cmp eax, 1
jne 0x43c63a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43c63a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43c63a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043c6d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43c6b8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043c6d0
add esp, 4
pop esi
ret

Function at 0x45ac0a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45ac42
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00458cbe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00458c96
jmp 0x45ac4e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45c2f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45c33a
call fcn.00461db1
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45c33a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45c331
xor eax, eax
jmp 0x45c342
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045c348
pop edi
pop esi
pop ebx
ret 4

Function at 0x4622e1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46230f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46232d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00462247
jmp 0x46232d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46232d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00462247
test edi, edi
mov eax, edi
jne 0x462317
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4f55f3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4f562b
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4f5619
mov al, 1
jmp 0x4f5675
cmp dword [ebx + 0x54], ecx
jne 0x4f5622
mov al, 2
jmp 0x4f5675
cmp dword [ebx + 0x7c], ecx
jne 0x4f5675
mov al, 3
jmp 0x4f5675
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4f5640
mov al, 4
jmp 0x4f5675
cmp ecx, 5
jne 0x4f5660
cmp ebx, 0
jne 0x4f564e
mov al, 5
jmp 0x4f5675
cmp ebx, 1
jne 0x4f5657
mov al, 6
jmp 0x4f5675
cmp ebx, 2
jne 0x4f5660
mov al, 7
jmp 0x4f5675
cmp ecx, 6
jne 0x4f566c
cmp ebx, 0
jne 0x4f566e
mov al, 8
jmp 0x4f5675
cmp ebx, 1
jne 0x4f5675
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
je 0x4021af
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4021af
mov eax, dword [esi + 0x3c]
xor edi, edi
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov ebp, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x1c]
add ecx, esi
add edx, esi
add eax, esi
mov dword [esp + 0x18], edx
test ebp, ebp
mov dword [esp + 0x10], eax

Function at 0x4021d0
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
jne 0x4021db
xor eax, eax
ret
mov eax, dword [edx + 0x3c]
push ebx
push esi
push edi
mov eax, dword [eax + edx + 0x78]
add eax, edx
mov ecx, dword [eax + 0x20]
mov esi, dword [eax + 0x24]
mov ebx, dword [eax + 0x1c]
mov edi, dword [eax + 0x18]
add ecx, edx
add esi, edx
add ebx, edx
test edi, edi
jbe 0x40228e
push ebp
mov ebp, ecx
mov dword [esp + 0x14], edi
xor ecx, ecx
mov edi, dword [esp + 0x1c]
mov cx, word [esi]
mov eax, dword [ebx + ecx*4]
mov ecx, dword [ebp]
add eax, edx
add ecx, edx
cmp dword [0x4065b8], 0
jne 0x40223e
cmp byte [eax], 0xb8
jne 0x402278
cmp byte [eax + 9], 0xcd
jne 0x402278
cmp byte [eax + 0xa], 0x2e
jne 0x402278
mov eax, dword [eax + 1]
cmp eax, edi
jae 0x402278
jmp 0x402271
cmp dword [0x4065b8], 1
jne 0x402278
cmp byte [eax], 0xb8
jne 0x402278
cmp byte [eax + 5], 0xba
jne 0x402278
cmp byte [eax + 6], 0
jne 0x402278
cmp byte [eax + 7], 3
jne 0x402278
cmp byte [eax + 8], 0xfe
jne 0x402278
cmp byte [eax + 9], 0x7f
jne 0x402278
mov eax, dword [eax + 1]
cmp eax, edi
jae 0x402278
mov edi, dword [esp + 0x18]
mov dword [edi + eax*4], ecx
mov eax, dword [esp + 0x14]
add esi, 2
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x402208
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x5f593f
Capabilities:
Encrypt data using aes

Disassembly:
mov ebp, dword [esp + 1]
btc ebp, ebx
xchg byte [esp], bl
jmp 0x5f596d

Function at 0x5f5a8f
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea ebp, [ebp + 0x7c2249e7]
lea esp, [esp + 3]
jmp 0x5f5ac5
and edi, esi
mov ebp, edx
sub esp, 6
lea esp, [esp + 2]
jmp 0x5f5aaf

Function at 0x5f5b4d
Capabilities:
Encrypt data using aes

Disassembly:
btc ebp, ebx
lea esp, [esp + 4]
movzx edi, byte [edi*4 + 0x5d1cec]
bsf bp, ax
sub esp, 0x1c
jmp 0x5f5b5c
mov edi, edx
shr edi, 0x18
stc
dec bp
jmp 0x5f5b19
mov bp, word [esp + 2]
xor eax, edi
mov edi, edx
bsf di, si
jmp 0x5f5b35
xor eax, edi
mov edi, edx
mov bp, 0xb645
lea ebp, [edx*4]
jmp 0x5f5b87

Function at 0x5fbd01
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
lea esp, [esp + 1]
jmp 0x5fbd52
shl edx, 8
clc
or edx, edi
call fcn.005fbd0a

Function at 0x5fbd0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], sp
call fcn.005fbd36

Function at 0x5fbd36
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl edx, 8
call 0x5fb487
lea esp, [esp + 4]
movzx ebp, byte [eax + 2]
sub esp, 4
sub esp, 0xc
mov byte [esp + 9], bh
jmp 0x5fb60a
or edx, ebp
mov bp, word [esp]
lea ebp, [eax - 0x3b86f4f7]
lea ebp, [edx + edx]
lea ebp, [esp + edi]
jmp 0x5fb7e1
lea esp, [esp + 8]
mov dword [esp + ecx*4 + 0x10], edx
cmc
jmp 0x5fbd3c
and eax, 0x648dc754
and al, 4
movzx edi, byte [eax + 2]
call fcn.005fbd01
mov word [esp], di
jmp 0x5fbd13
add ecx, 2
pushal
jmp 0x5fbd78
lea esp, [esp + 0x20]
add eax, 8
cmp ecx, 0xe
pushal
call fcn.005fbd5d
arpl di, sp
ja 0x5fbd9e
loope 0x5fbdeb
wait
sbb byte [esi - 0xa26e717], cl
in al, 0x17
jle 0x5fbd26
and al, 0x30
movzx ebp, byte [eax + 3]
shl edx, 8
push 0x8e2c103
push esp
jmp 0x5fbc80
pop ebx
mov dh, 0x72
cmp ebx, eax
push ebx
lds eax, ss:[edi]
add dword [edx + ebx - 0x4ec67383], eax
mov al, 0xb3

Function at 0x5fbdfd
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx edx, byte [esi + 0xa]
call 0x5fbda9
mov byte [esi + 0x5a], dl
mov dl, 0xa4
mov dl, 0xec
movzx eax, byte [esi + 0xb]
mov ch, byte [esp]
jmp 0x5fbe06
btc ecx, edi
lea esp, [esp + 4]
jmp 0x5fbdcf
mov di, 0xb06d
jmp 0x5fbe5b
movzx ecx, byte [esi + 0xc]
mov dh, ch
sub dh, ah
lea edx, [ebp - 0x8f]
jmp 0x5fbe26
mov byte [esi + 0x5b], al
rcr ch, 5
mov di, dx
rcl cx, cl
setg ah
jmp 0x5fbe42

Function at 0x5fc2d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 1]
jmp 0x5fc43a
push edx
pop edi
mov di, word [esp]
mov di, 0x2857
push edx
call fcn.005fc349
mov edi, 0x6e1d87f2
pop word [esp]
mov edi, dword [esp]
mov di, word [esp]
not di
jmp 0x5fc41c
mov edi, dword [esp]
call fcn.005fc479
lea esp, [esp + 0x30]
jmp 0x5fc44f
lea esp, [esp]
lea esp, [esp + 2]
push esp
lea esp, [esp + 3]
mov dword [esp], edi
mov di, word [esp]
jmp 0x5fc3dc
lea esp, [esp + 4]
Function at 0x5fc349
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
xchg edx, edi
mov word [esp], bx
lea edx, [esi + 0x2d]
lea edi, [ebp + 0x37]
jmp 0x5fc3b9
mov di, 0xfef7
mov di, bx
not dh
bswap edx
mov edi, 0xc461711a
jmp 0x5fc31c
mov dx, 0x51a7
jmp 0x5fc332
mov dl, 0x74
setns dh
mov dl, dh
mov dx, 0xcc7d
bswap edi
mov dh, ch
jmp 0x5fc405
xchg edi, edx
mov eax, dword [esp + 0x20]
mov edi, 0xc815289c
mov dx, word [esp]
bswap edi
mov edi, 0xce6464b0
jmp 0x5fc34f
lea edi, [eax - 9]
pushal
not dx
xchg ah, dh
mov dl, 0xc4
mov ah, byte [esp + 9]
jmp 0x5fc376
mov edx, dword [esp]
mov dh, byte [esp]
lea esp, [esp + 3]
push eax
mov dx, 0x72cd
lea edi, [ebx*4]
jmp 0x5fc39e
mov edi, 0xd54a7c36
mov edx, dword [esp + 0x24]
mov edi, dword [esp]
mov di, 0x43f1
push esp
mov word [esp], bx
jmp 0x5fc3ec

Function at 0x5fc479
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, 0x3a47aafe
bswap edi
xchg word [esp + 1], di
lea esp, [esp + 2]
mov edi, dword [esp + 0x2c]
jmp 0x5fc424

Function at 0x6a3344
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
jmp 0x6a33e8
push dword [esp + 0xa]
xchg cx, bx
mov si, dx
xchg byte [esp + 0x17], cl
push dword [esp + 0x12]
lea eax, [ecx - 0xdb]
inc ebx
mov bx, dx
lea esi, [esi - 0xa5]
mov word [esp], bx
mov ax, word [esp + 0x16]
xchg byte [esp], al
jmp 0x6a33c5
Function at 0x6a3c24
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
xchg dword [esp], edx
lea edi, [ecx + 0xab]
lea esp, [esp + 1]
add esp, 3
jmp 0x6a3b9b
lea esp, [esp + 1]
mov eax, ecx
mov ebp, dword [esp]
xchg byte [esp], cl
mov edx, 0x834480be
mov eax, ecx
jmp 0x6a3b85
xchg word [esp + 4], di
not edx
mov bl, 0x78
not ebx
jmp 0x6a3b5e

Function at 0x6a7464
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 9], esi
push word [esp + 0x15]
not ah
pop dx
rcr dh, 7
xchg bx, ax
jmp 0x6a73e9
mov bl, 0xd8
rdtsc
mov dword [esp + 0xd], eax
mov ax, 0x13bf
push dword [esp + 0x32]
bswap ebx
jmp 0x6a7371
mov dword [esp + 0x2c], ecx
mov dx, word [esp + 0xa]
push word [esp + 0x2d]
mov word [esp + 0x27], dx
push dword [esp + 0x2b]
pop ax
jmp 0x6a7391
stc
lea ecx, [ecx + ebx]
neg cx
mov dl, byte [esp]
mov al, byte [esp]
mov si, di
jmp 0x6a73f9
rcr eax, 0x13
pushal
lea esp, [esp + 0x5d]
not edi
xchg ah, bl
xchg bp, ax
jmp 0x6a73c4
xchg ecx, ebp
sub esp, 0xe
mov bp, bx
add esp, 1
lea esp, [esp + 9]
bsf ax, ax
jmp 0x6a744a
btr eax, esp
rdtsc
xchg dword [esp + 0x1c], edi
lea ecx, [edx + edi]
lea ebp, [esp + ecx]
clc
jmp 0x6a73a9
lea ebx, [edi*4]
push dword [esp + 3]
neg bp
sete ah
mov word [esp + 5], di
mov cx, word [esp + 5]
jmp 0x6a74c8
lea esp, [esp + 1]
lea ebx, [esi + 0xc5]
push word [esp + 2]
jmp 0x6a7425
sub esp, 0xe
mov word [esp + 0x32], di
mov dword [esp + 0x21], ebp
not bh
jmp 0x6a7413
lea esp, [esp + 1]
mov byte [esp + 3], dh
mov bx, sp
bsf di, ax
jmp 0x6a74a3
xchg word [esp + 3], cx
mov cx, dx
mov bx, word [esp]
pop word [esp + 2]
cpuid
mov dl, 0x8c
jmp 0x6a7474
mov ch, byte [esp + 5]
xchg ecx, eax
neg edx
pop cx
xchg ah, bl
pop edi
jmp 0x6a74db
not dx
clc
sub dx, 0x5128
setae ch
mov bl, bh
lea ecx, [esp + ebp]
jmp 0x6a748c
neg edx
lea eax, [esp + ecx]
mov edx, 0x35a530a6
inc edi
call fcn.006a74b1
xchg ebx, eax
or ah, byte [ebp + 0x66ee47d4]
pop word [esp + 1]

Function at 0x6a74f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg esi
cpuid
pushal
setno ch
sub esp, 0x12
sub esp, 4
add esp, 0x17
lea esp, [esp + 2]
pushal
cld
jmp 0x6a7170
pop word [esp + 1]
mov byte [esp + 1], ch
lea esp, [esp + 1]
jmp 0x6a7193

Function at 0x6a75f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, ebp
xchg ch, dl
setnp dh
cpuid
lea ebp, [esi - 0x4792f9e3]
jmp 0x6a763e
mov dx, 0x4ee9
btr esi, edx
jmp 0x6a75e2
sub bl, ah
cpuid
push word [esp + 7]
bsf cx, si
rdtsc
and ecx, ecx
jmp 0x6a7622

Function at 0x6a76b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
add al, dh
lea ecx, [ebx + ebx]
mov si, di
jmp 0x6a76e1

Function at 0x6a786f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 6], ch
rdtsc
mov al, ah
rdtsc
mov di, 0xcc85
jmp 0x6a7820