joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4246ec
Capabilities:
Encode data using xor

Disassembly:
jb 0x424732
nop
xor al, 0xb2
imul ebx, dword [ebx + 0x61], 0x6c
out 0x64, al
je 0x42475e
cld
rol dword [ebp + 0xa5d14f8], 0xf0
sub byte [edi], al
sub eax, 0x72b75a4e
cmp al, 0x74
into
inc ecx
rcr eax, cl
mov esp, 0x1ff267f8
pop ds
cmp esi, dword [edi]
cwde
add ebx, dword [edi - 0x1d]
mov edi, 0x1824e7c3
daa
cmp al, 0x78
push ds
lodsd eax, dword [esi]
jge 0x424760
mov bl, 0x41
arpl word [ebp + eax*4 - 0x3a39495], si
lcall 0x31ff, 0x6755e020
loopne 0x424789
push dword [bx + di]
sbb edx, dword [edi]
jnp 0x424745
lcall 0xb28, 0x9f03171
cmp eax, 0xea1f1173
lock or dword [eax], ebp
or edi, dword [0xea1f1173]
pop ds
ljmp 0x9f
xchg edx, eax
daa
jnp 0x424767
lahf
add byte [ebx - 0x3f753248], bh
in al, 0x3b
stosb byte es:[edi], al
cmp dl, ch
pop esp
fmul dword [edx + 0x2b]
mov cl, 0xc3
invalid
mov esi, 0xf678e263
shr byte [edx + ebp*2 - 0x45ffe0b1], 1
jecxz 0x42477d
loop 0x4247da
not al
lodsb al, byte [esi]
push 0x4f
pop ds
add byte [edx - 0x263cee1d], bh
iretd
ret
jbe 0x4247c1
jecxz 0x424713
mov bh, 0x63
movsb byte es:[edi], byte [esi]
xlatb
scasb al, byte es:[edi]
outsd dx, dword [esi]
mov byte [0x9b5c6e55], al
outsb dx, byte [esi]
pop esp
wait
lds ebp, [ebx + 0x3f]
push ecx
mov edi, 0x438b8f58
xor dl, bl
sub bl, byte [edi]
dec ebp
xchg esi, eax
jbe 0x42478a
dec ebx
xchg ebx, eax
je 0x4247a2
jns 0x42475e
mov ebx, 0x1ccf9f1b
push esi
add ch, bl
mov bl, 0xda
imul ebp
jb 0x42473e
sbb ebx, dword [edi + 0x2561ccf]
jmp 0x42475e
pop es
scasb al, byte es:[edi]
xor bh, byte [ecx - 0x4d]
mov edi, 0x5d221ca4
mov dword [0xf3cec205], eax
or cl, byte [edx]
les ebp, [ebx - 0x11]
xchg esi, eax
push ebx
arpl word [0xe024a6e0], bx
invalid
arpl word [edx + 0x2d], ax
sbb al, 9
and eax, 0x1e760c05
test dword [edi], ebx
ret 0x609
Function at 0x4b9371
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1338
cmp edx, dword [eax]
je 0x4b9393
add eax, 8
inc ecx
cmp eax, 0x4c13c8
jl 0x4b9384
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1338]
jne 0x4b94c1
mov eax, dword [0x4c5cbc]
cmp eax, 1
je 0x4b949b
test eax, eax
jne 0x4b93c4
cmp dword [0x4c1264], 1
je 0x4b949b
cmp edx, 0xfc
je 0x4b94c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b93fb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9d50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba1e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b943e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba1e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be8fc
push edi
call fcn.004bc0b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9d50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9d60
lea eax, [ebp - 0xa0]
push 0x4be8dc
push eax
call fcn.004b9d60
push dword [esi + 0x4c133c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9d60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc024
add esp, 0x2c
pop edi
jmp 0x4b94c1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c133c]
push 0
push eax
push dword [esi]
call fcn.004ba1e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3d7a2aa6
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x247c07d3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x408a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x408a3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408a41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408a30
mov eax, 1
add ebx, ebx
jne 0x408a53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408a48
jne 0x408a64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408a48
xor ecx, ecx
sub eax, 3
jb 0x408a78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408aea
mov ebp, eax
add ebx, ebx
jne 0x408a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408a90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x408ab4
inc ecx
add ebx, ebx
jne 0x408aa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x408a95
jne 0x408ab1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408a95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x408ad4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x408ac5
jmp 0x408a36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x408ad4
add edi, ecx
jmp 0x408a36
pop esi
mov edi, esi
mov ecx, 0x1f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x408af2
cmp byte [edi], 0
jne 0x408af2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x408af7
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x408b6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa804]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa898]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x408b24
mov ecx, edi
jns 0x408b53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa8a0]
or eax, eax
je 0x408b69
mov dword [ebx], eax
add ebx, 4
jmp 0x408b41
call dword [esi + 0xa89c]
mov ebp, dword [esi + 0xa8a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x408ba3
sub esp, 0xffffff80
jmp 0x401610
Function at 0x3731e7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x3731f9f
cmp esp, 0xb1a87b5e
jno 0x373524e
mov edx, dword [ebp - 0x44]
cmc
jb 0x373ba6f
clc
sub eax, eax
pushfd
cmc
cmc
jmp 0x3731f80
mov al, byte [edx + 9]
mov byte [esp], 0x1e
cmp eax, 0x4c
lea esp, [esp + 4]
jl 0x37362e9
pushal
lea esp, [esp + 0x20]
jne 0x37341da
clc
pushfd
mov edx, dword [ebp - 0x44]
pushal
clc
test ch, 0x2a
push 0x8d4e4bc4
sub eax, eax
stc
rol al, 2
cmc
mov al, byte [edx + 9]
mov byte [esp + 4], bl
cmp eax, 0x4c
mov byte [esp], ch
lea esp, [esp + 0x28]
jne 0x37341da
shr ch, 2
bswap cx
rol ch, cl
mov ecx, dword [ebp - 0x44]
call fcn.0373863d

Function at 0x3731ef2
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub eax, eax
not al
stc
and ah, cl
mov ax, word [edx + ecx*2]
adc cl, dl
and eax, 0xf000
inc ch
bswap cx
mov word [ebp - 0x5c], ax
bt edi, edi
cwde
aaa
pushfd
mov ecx, dword [ebp - 0x130]
clc
xadd dl, ah
pop eax
mov edx, dword [ebp - 0xbc]
dec ah
adc ah, 0x89
add edx, dword [ecx]
bswap cx
xor ch, 0xf9
mov eax, dword [ebp - 0xa0]
shr cl, cl
btr cx, 6
mov ecx, dword [ebp - 0xd8]
test ch, 0x38
bt sp, bx
pushfd
sub esi, esi
not si
mov si, word [ecx + eax*2]
cmc
cmp dh, ah
push dword [esp]
test ax, 0xbea
and esi, 0xfff
clc
stc
bt cx, bp
bt dx, cx
add edx, esi
call fcn.03734843
Function at 0x3731ffa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
call fcn.03736d67
jmp 0x3735cba
pushfd
lea esp, [esp + 0x2c]
jb 0x373c13f
bt eax, edx
test dh, cl
mov ecx, dword [ebp - 0xf8]
pushfd
test cl, dh
clc
bt dx, 7
add ecx, dword [ebp - 0xf0]
push edx
pushfd
clc
call fcn.03733c65

Function at 0x3732038
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x6b
pushfd
lea esp, [esp + 0xc]
call fcn.028a2480
call fcn.0373214a
stc
shrd si, di, 3
add eax, 0x10002287
mov dword [esp], 0xd78f3eb0
lea esi, [ecx - 0x608f9fd3]
push dword [esp]
mov esi, dword [ebp - 0x3c]
jmp 0x3737eac
jmp 0x3731ea9

Function at 0x37320f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
sub edx, edx
movzx dx, bl
bswap dx
cmp sp, 0x2bbb
mov dx, word [ecx + 0xe]
pushal
clc
cmp edx, 0x32
mov dword [esp + 0x18], 0x57575d05
push ecx
pushfd
mov byte [esp + 4], 0xe6
lea esp, [esp + 0x30]
jne 0x3736760
movzx ax, al
lahf
jmp 0x37323f2

Function at 0x373214a
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl si, 7
mov dword [ebp - 0xc8], eax
bswap eax
mov eax, dword [ebp - 0xac]
neg esi
stc
add eax, 0x1000229e
push 0xba062952
mov esi, dword [ebp - 0x3c]
pushal
pushfd
jmp 0x3738c92

Function at 0x3732290
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x28]
je 0x373b3be
cmp dl, dl
bt edi, 0x1f
btr cx, 0xb
mov ecx, dword [ebp - 0x44]

Function at 0x373237d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x18]
je 0x37341da
push ebp
mov edx, dword [ebp - 0xac]
or al, 0x56
bsr eax, ecx
xor ax, 0x5686
add edx, 0x10001efc
push 0x60593105
shl ah, 5
mov eax, dword [ebp - 0x7c]
stc
jmp 0x3739094
pushal
clc
mov dword [eax], edx
bswap edx
rol ah, 1
cmp al, dh
aad 6
mov edx, dword [ebp - 0xac]
xor ax, 0xae0a
test cx, 0xcc22
jmp 0x373c987
das
add edx, 0x10001f34
call fcn.03734f69

Function at 0x37323b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
xor edx, edx
shrd dx, bx, 1
sar dh, 1
call fcn.037323fe

Function at 0x37323fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [ecx]
mov word [esp], cx
cmp edx, 0xad11f0ce
cmp edx, 0x4e
pushfd
push 0x57ebb212
mov byte [esp + 8], ah
lea esp, [esp + 0x34]
jne 0x3739ec8
sbb ecx, 0x8c06ed9c
and ch, dh
jmp 0x3732cb5
mov eax, dword [ebp - 0x100]
jmp 0x373c0d4

Function at 0x373243b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x3739ec8
neg cx
bt di, bp
mov eax, dword [ebp - 0x100]
or ch, 0x41
mov ecx, dword [eax + 0x30]
pushfd
stc
cmc
cmp dl, ch
sub edx, edx
dec dh
push eax
mov dx, word [ecx + 0xa]
stc
cmp eax, 0x1cea8b0d
stc
cmp edx, 0x2e
call fcn.0373a64f

Function at 0x3732475
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ax, cl
lea eax, [ebp - 0x128]
pushfd
mov dword [esp + 4], eax
lea esp, [esp + 4]
jp 0x37389c5
push esp
mov byte [esp], bl
mov dword [esp], 0x40
Function at 0x37324a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, byte [esp]
shrd cx, si, cl
mov dword [ebp - 0x100], eax
add dl, ch
ror ch, 1
mov ecx, dword [ebp - 0x100]
push dword [esp]
bt ax, 6
bsr edx, edx
not dl
mov edx, dword [ecx + 0x34]
pushal
clc
push 0xbf63ec38
test di, 0x3890
and edx, 4
test ah, ah
pushfd
test edx, edx
jmp 0x3738054
mov dword [esp], ebx
pushfd
call fcn.037380e8

Function at 0x373268e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x24], ecx
jmp 0x3735223
pushal
pushfd
mov dword [esp + 0x44], 0x3737726
push dword [esp]
call fcn.037335a1

Function at 0x373278c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x28]
jne 0x3733424
je 0x37327bd
clc
pushal
pushfd
cmp bl, 0x4e
push 0xc4e29a90
lea esp, [esp + 0x28]
jle 0x3734873
pushal
lea esp, [esp + 0x20]
jne 0x3737b07
sub bl, 0x8a
or bl, dh
inc bl
and bl, dl
mov bl, byte [eax + 1]
clc
cmp bl, 0x74
pushfd
lea esp, [esp + 4]
jle 0x3733ad0
push eax
lea esp, [esp + 4]
je 0x373823f
cmp ax, 0x240c
cmp bl, 0x54
call fcn.03735acb
call fcn.03738dfc
pushfd
rol bl, cl
mov bl, byte [eax + 4]
pushal
call fcn.03734879
push edx
jmp 0x373b705
cmc
shl bl, cl
mov bl, byte [eax + 2]
pushal
cmp bl, 0x64
mov byte [esp + 8], 0x46
jmp 0x373aa2a
lea esp, [esp + 0x20]
je 0x373aa57
clc
test ch, al
cmp dx, 0x3354
test bl, 0xe1
cmp bl, 0x44
jnp 0x373b931
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0xc]
jne 0x3737b07
inc bl
shl bl, 6
rcl bl, cl
mov bl, ah
mov bl, byte [eax + 3]
pushal
pushfd
cmp bl, 0x6c
mov dword [esp], esp
pushfd
lea esp, [esp + 0x28]
je 0x3733aeb
cmp bl, 0x81
jmp 0x3736ee8
lea esp, [esp + 4]
jne 0x3737b07
shl bl, 6
call fcn.0373958e
or ah, byte [ecx]
mov ebx, 0xcb7bf7ed
dec edx
sar ebx, cl
or al, 7
in eax, dx
sbb eax, 0xa336c2cc
xor bh, byte [edi + 5]
sal esp, 0xfc
mov eax, dword [0x3859c63a]
ret 0xfd93
pushfd
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0x3737b07
shr bl, cl
call fcn.03739894
bt bp, ax
mov bl, byte [eax + 3]
test dl, dl
push 0x5547465
mov dword [esp], esi
cmp bl, 0x6c
call fcn.03738fb2

Function at 0x37327ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
je 0x37379ef
cwde
pushfd
btr cx, ax
mov dword [ebp - 8], 0
sal ax, 6
mov eax, dword [ebp - 8]
pop ecx
rcl cx, 8
mov ecx, dword [ebp - 0x64]
bt si, 8
stc
push eax
clc
cmp dword [ecx + eax*4], 0
push 0xfa54500f
mov dword [esp], 0x6cbda9a8
push dword [esp]
lea esp, [esp + 0xc]
je 0x3732f24
pushfd
aam 0x30
setbe ch
mov edx, dword [ebp - 8]
bts ecx, 0xa
inc ah
mov eax, dword [ebp - 0x64]
call fcn.0373a1a0

Function at 0x37328a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
je 0x37398bd
bt di, 4
stc
jmp 0x37398ae
pushfd
cmp bl, 0x4c
pushal
lea esp, [esp + 0x24]
jne 0x3737b07

Function at 0x3732a05
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x3732e8b
test ah, 0x2d
add ecx, 0x14
push edx
lea esp, [esp + 4]
jmp 0x3738d0e
Function at 0x3732a77
Capabilities:
Access peb ldr_data

Disassembly:
xadd bl, al
bsr cx, ax
stc
mov ebx, dword [ebp - 0xcc]
bt sp, 1
add ebx, dword [ebp - 0xbc]
xadd al, ch
lahf
test dh, 0xd
mov dword [edx], ebx
xadd cl, al
cmc
clc
inc bh
xor byte [edx - 1], 0x80
rcr al, cl
aas
shrd cx, di, cl
mov eax, dword [ebp - 0xac]
sub ch, ah
add eax, 0x10002395
bts edx, edi
bts ecx, 0x1a
rcr dx, cl
xadd cx, di
mov dword [ebp - 0xb0], eax
movzx ax, cl
xadd ch, dh
adc ah, 0xc7
push dword [esp + 4]
popfd
inc eax
xadd si, ax
daa
sub esp, 0xfffffff8
popal
bsr ax, bp
btc eax, 0x16
mov eax, dword fs:[0x30]
pushfd
bt dx, 8
stc
pushfd
mov eax, dword [eax + 0xc]
jmp 0x3737f59
shr cl, 1
pushal
mov eax, dword fs:[0x30]
shl dx, cl
rcr cl, 3
sbb ecx, esp
xor dl, 1
mov eax, dword [eax + 0xc]
xor cl, ch
mov dword [ebp - 0xf4], eax
stc
clc
bt ebx, edx
mov dword [ebp - 0xf8], 0
sbb ch, bl
bswap ax
shl ah, cl
mov dword [ebp - 0xf0], 0
setbe al
mov eax, dword [ebp - 0xf4]
clc
mov ecx, dword [eax + 0xc]
clc
rcr edx, 0x1b
mov dword [ebp - 0xfc], ecx
stc
mov word [esp + 4], 0x1ffe
call fcn.0373302c
push 0x6141464a
test eax, eax
push dword [esp]
lea esp, [esp + 0x10]
je 0x3734c93
jmp 0x3734e2b

Function at 0x3732d80
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
mov dword [esp + 8], edx
pushal
call fcn.0373a445
clc
test eax, eax
jmp 0x373a8f8
push edx
lea esp, [esp + 4]
je 0x373c1c1
movzx cx, bl
mov dword [ebp - 0x6c], 1
xchg dx, cx
bswap cx
pushal
mov ecx, dword [ebp - 0x7c]
movsx dx, dl
mov edx, dword [ebp - 0xdc]
call fcn.0373b23b

Function at 0x373307e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0x373a603
pushfd
cmp ch, dl
mov byte [esp], 0x9f
cmp edx, 0x6c
call fcn.03736ba1
cmc
cmp edi, esp
pushfd
sub edx, edx
pushfd
rcr dh, 1
btc dx, 1
test ch, 0xed
mov dx, word [ecx + 8]
stc
push edx
cmp edx, 0x6c
call fcn.037399cf
and ecx, 0x80000000
clc
push 0xd94f393e
cmp ecx, 0x80000000
push dword [esp]
push dword [esp]
call fcn.0373c735
lea esp, [esp + 0x10]
jne 0x3739ec8
ror ax, cl
mov eax, dword [ebp - 0x100]
sal cl, cl
shl cl, 7
btr ecx, 0x1d
mov ecx, dword [eax + 0x30]
cmc
sub edx, edx
setp dl
inc dx
btr dx, cx
mov dx, word [ecx + 6]
cmp bp, di
cmp edx, 0x6c
pushfd
push dword [esp]
pushal
mov byte [esp], bl
lea esp, [esp + 0x28]
jmp 0x3731aca
pushfd
mov word [esp], 0x8577
lea esp, [esp + 4]
jne 0x3739ec8
push edx
btc ax, 5
mov eax, dword [ebp - 0x100]
dec cl
mov ecx, dword [eax + 0x30]
jmp 0x3732723
shl cl, cl
bsr ax, ax
clc
mov eax, dword [ebp - 0x100]
not cl
lea ecx, [edi + 0x6e062893]
rcl cl, cl
mov ecx, dword [eax + 0x30]
clc
cmp ch, 0x10
xor edx, edx
shr dx, 2
btc dx, cx
mov dx, word [ecx + 8]
jmp 0x3731e2c
pushfd
lea esp, [esp + 8]
je 0x373a209
stc
shl ch, cl
cmp cx, bp
mov eax, dword [ebp - 0x100]
seto cl
dec ch
or cx, 0xe430
bt ax, 2
mov ecx, dword [eax + 0x30]
bt esi, 1
clc
test cx, 0xe63f
sub edx, edx
btc dx, bx
mov dx, word [ecx + 6]
stc
cmp edx, 0x4c
jne 0x3737112
call fcn.0373a1fc
Function at 0x3733156
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x3737b72
xchg dh, ch
mov dword [ebp - 0x6c], 1
xchg dh, cl
lea edx, [eax - 0x691399ca]
setge ch
mov ecx, dword [ebp - 0x7c]
pushfd
pop edx
mov edx, dword [ebp - 0xdc]
mov byte [esp], bl
pushfd
jmp 0x3739088
mov dword [ecx], edx
pushfd
lea esp, [esp + 0xc]
jmp 0x373c1ca

Function at 0x373319f
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0x522ac9be
pushal
call fcn.03737afd

Function at 0x37331aa
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions
Parse pe header

Disassembly:
jmp 0x3736f2c
lea esp, [esp + 8]
jne 0x3737b07
stc
not bl
sub bl, bh
mov bl, byte [eax + 6]
cmp al, 0x5a
cmp bl, 0x64
jmp 0x37331b4

Function at 0x3733303
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, dword [ebp - 0x74]
push 0x27e2ca8a
cmc
bt eax, edx
mov dword [ebp - 0x80], edx
pushfd
jmp 0x3737406
bts cx, bx
dec cl
jmp 0x373b163
cmp dword [ebp - 0x48], 0
mov byte [esp], 0x84
push 0xcc2872ee
pushfd
lea esp, [esp + 0x3c]
jbe 0x3732f99
shrd ax, dx, cl
daa
daa
daa
mov eax, dword [ebp - 0xbc]
lea ecx, [ecx + 0x1828608b]
sub ecx, edx
cmc
mov ch, 0xb8
add eax, dword [ebp - 0x74]
ja 0x3733c25
adc cx, dx
mov dword [ebp - 0x130], eax
adc cl, 0xcc
add cl, 0xa4
stc
clc
mov ecx, dword [ebp - 0x130]
test al, 0xa9
cmp dword [ecx], 0
call fcn.037377d7
lea esp, [esp + 0x24]
jne 0x3737b07
setb bl
dec bl
inc bl
mov bl, byte [eax + 4]
pushfd
test bl, 0xc7
mov byte [esp], cl
cmp bl, 0x6c
push dword [esp]
lea esp, [esp + 8]
je 0x3734d56
pushfd
cmp bl, 0x4c
push esp
pushfd
pushfd
lea esp, [esp + 0x10]
jne 0x3737b07
push 0x87e937dd
mov bl, byte [eax + 5]
cmc
cmp dh, dh
push dword [esp]
cmp bl, 0x2e
push dword [esp]
pushal
push dword [esp]
lea esp, [esp + 0x30]
jne 0x3737b07
pushfd
xor bl, dl
mov bl, byte [eax + 6]
pushfd
cmp ch, 0xd
pushal
cmp bl, 0x64
jmp 0x3738e94
mov dword [ebp - 0x130], eax
bsf ecx, ebp
mov ecx, dword [ebp - 0x130]
pushal
bt di, 0xa
pushfd
jmp 0x3735ad8

Function at 0x373353e
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
sub edx, edx
ror dh, 3
mov dx, word [ecx + 0x16]
mov byte [esp], dl
cmp edx, 0x4c
lea esp, [esp + 8]
jno 0x3732dd5
push edi
lea esp, [esp + 4]
jne 0x3736760

Function at 0x37335f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
cmp di, 0x1504
pushfd
cmp edx, 0x4c
pushal
mov byte [esp], 0xb4
lea esp, [esp + 0x2c]
jmp 0x373c879
cmp edx, 0x33
mov byte [esp], dh
lea esp, [esp + 0xc]
je 0x3734e1c
pushfd
call fcn.0373505e
jmp 0x373bab2
sub edx, edx
sub dl, 0x18
cmp ah, 0xe
mov dx, word [ecx + 0x10]
jmp 0x3732dfd

Function at 0x373364f
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x45
push 0xd4114dab
pushal
call fcn.03736672
Function at 0x373389a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [edx + 1], eax
mov byte [esp + 4], bh
jmp 0x3737689
push dword [esp + 8]
lea esp, [esp + 0x28]
je 0x373c1c1
pushal
mov dword [ebp - 0x6c], 1
mov dh, ch
not ecx
mov cx, word [esp]
xchg ecx, edx
mov ecx, dword [ebp - 0x7c]
lea edx, [ebp + 0xb77ef36]
mov edx, dword [ebp - 0xdc]
pushfd
pushfd
mov dword [ecx], edx
pushfd
push 0xbd804b69
lea esp, [esp + 0x30]
jmp 0x373c1ca
jmp 0x373494f
mov dword [edx + 1], eax
rcl al, 2
bts eax, 1
cwde
rol eax, 5
mov eax, dword [ebp - 0xc]
sub esp, 0xffffffd0
js 0x3732b82
stc
test si, 0x7b60
mov dword [edx + 6], eax
jmp 0x3739496
call fcn.03737d55
call fcn.037328a3
clc
mov dword [edx + 6], eax
rcl eax, cl
bsr dx, dx
shr dx, cl
mov edx, dword [ebp - 0xac]
das
das
aas
add edx, 0x10001f1a
shld ax, si, cl
mov eax, dword [ebp - 0xb8]
cmc
push 0x2aa11e26
mov word [esp], cx
sub eax, edx
jmp 0x373c1a9
sub eax, 5
push ebx
mov dword [esp + 4], esi
jmp 0x3731a52
mov eax, dword [ebp - 0xb8]
push ecx
sub eax, edx
stc
jmp 0x37356a3
add edx, 0x10001f04
aaa
pop eax
or ax, 0xc4d4
bts eax, esi
mov eax, dword [ebp - 0x9c]
jmp 0x37336d7
call fcn.03733ad5
pushal
pushfd
pop dword [esp + 0x1c]
pushfd
jmp 0x373c081
mov edx, dword [ebp - 0xac]
sets al
or al, 0x47
and ah, 0xc5
add edx, 0x10001f1a
or ah, bh
jmp 0x3735fab
pushal
pushfd
pushfd
push 0x52920f88
mov dword [esp + 0x28], ebx
push ebp
push 0x321c812a
mov dword [esp + 0x2c], 0x28a11a6
neg bl
mov eax, dword [esp + 0x2c]
rcl bl, cl
cmc
sub eax, 0x100010ab
not bx
mov ebx, eax
btc eax, 0x1e
dec ax
bsr eax, esp
add ebx, 0x10001036
pushfd
lea eax, [ebp + 0x7fc049ac]
bt cx, dx
inc ah
cmp dword [ebx], 0
pop eax
call 0x373c0bc
test si, 0x5273
cmc
pushal
test eax, eax
push dword [esp]
jmp 0x37320b1
mov dword [esp + 0x1c], eax
lea esp, [esp + 0x1c]
jo 0x373c01d
pushfd
mov dword [esp], ebx
call fcn.0373228a
clc
clc
test dl, dh
mov dword [edx + 1], eax
lahf
ror al, 6
xadd dh, ah
rol dl, cl
mov edx, dword [ebp - 0xac]
btr eax, 0x1e
call fcn.0373959b
call fcn.037326b8
not bh
lahf
mov ebx, dword [esp + 0x34]
pushfd
lea esp, [esp + 0x3c]
jb 0x3734403
pop eax
call fcn.0373ac83
setne cl
shr cx, cl
mov ecx, dword [eax + 0x30]
bt sp, 9
xor edx, edx
shl dx, cl
btr dx, 2
mov dx, word [ecx + 2]
call fcn.03738a42
sub eax, 5
pushal
mov dword [edx + 1], eax
mov byte [esp], cl
mov dword [esp + 0x10], ecx
jmp 0x3733895

Function at 0x3733ada
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
pushal
push 0x402eb7f8
lea esp, [esp + 0x2c]
jne 0x3737b07

Function at 0x3733e6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
sub edx, edx
bswap dx
and dh, ch
mov dx, word [ecx + 4]
cmp bl, 0xf6
test dl, 0xcb
test si, ax
cmp edx, 0x52
pushal
pushfd
call fcn.0373b39c