joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe35b26
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [ecx + 0x10]
lea esp, [esp + 4]
jae 0xe34aa9
cmp edx, 0x2e
push 0xca267835
pushfd
lea esp, [esp + 8]
jne 0xe3b389
rcr cx, 4
mov eax, dword [ebp - 0x104]
cmp ch, 0xd6
bsr ecx, esp
shld cx, bp, cl
mov ch, 0xc1
mov ecx, dword [eax + 0x30]
jmp 0xe3b815

Function at 0xe35cb4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x87a57b5d
push 0x9540f5d0
lea esp, [esp + 0x38]
jne 0xe3b389

Function at 0xe35ebf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0xf0], eax
pushfd
push dword [esp + 4]
lea esp, [esp + 0x34]
jmp 0xe371c6
test edx, edx
jmp 0xe3c1cb
lahf
rdtsc
mov eax, dword [ebp - 0x100]
lea edx, [ecx*8 - 0x28b0f28c]
seto ch
pushfd
bswap cx
mov ecx, dword [eax + 0x18]
pop eax
mov dword [ebp - 0xf8], ecx
push edi
jmp 0xe34684
setb ah
lea eax, [ebp - 0x51bf24fc]
mov eax, dword [edx + 0x20]
pushal
push edi
mov word [esp], si
jmp 0xe33994
lea esp, [esp + 8]
jne 0xe38fe0
jbe 0xe385c6
mov eax, dword [ebp - 0x100]
pushfd
not dh
lea ecx, [edi - 0x5a839e26]
setge cl
mov ecx, dword [eax + 0x18]
push edx
mov dword [ebp - 0xf8], ecx
lea eax, [ebp + 0xb0cec70]
rdtsc
mov edx, dword [ebp - 0x100]
jmp 0xe38afe

Function at 0xe36205
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x68], eax
setne ch
cwde
not dh
mov edx, dword [ebp - 8]
pushal
setl ah
pop eax
bswap ecx
mov eax, dword [ebp - 0x8c]
jmp 0xe39b8c
movzx cx, cl
push edx
mov cl, bl
mov ecx, dword [ebp - 0x68]
push 0x57cc3a15
push esp
push dword [esp + 4]
mov dword [eax + edx*4], ecx
pushfd
pushfd
lea esp, [esp + 0x38]
jmp 0xe3bc9e

Function at 0xe36257
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x50]
jbe 0xe335cd
bt ecx, ebx
mov eax, dword [ebp - 0xbc]
shr cx, cl
dec ch
add eax, dword [ebp - 0x74]
or ch, bh
call fcn.00e3c01a

Function at 0xe362aa
Capabilities:
Access peb ldr_data
Get number of processors
Packed with generic packer

Disassembly:
mov byte [esp], ah
cmc
sub ecx, ecx
add cl, 0x35
mov cl, byte [eax + 6]
cmc
pushal
clc
stc
cmp ecx, 0x2e
call fcn.00e38441

Function at 0xe3631f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x68], eax
push dword [esp]
lea eax, [esp + 0x194f32d7]
mov edx, dword [ebp - 8]
lea eax, [edi + 0x4757d8d5]
not al
push ebp
mov eax, dword [ebp - 0x8c]
pushfd
mov ecx, dword [ebp - 0x68]
pushal
mov dword [eax + edx*4], ecx
pushfd
mov word [esp + 4], sp
pushfd
lea esp, [esp + 0x38]
jmp 0xe3bc9e
call fcn.00e35b1c
Function at 0xe36356
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
pushfd
lea esp, [esp + 0x18]
je 0xe3b389
sal cl, 7
aam 0x48
mov eax, dword [ebp - 0x104]
not cl
sal cx, 1
movsx cx, dl
btc ecx, ebp
mov ecx, dword [eax + 0x30]
pushal
test dh, cl
pushfd
sub edx, edx
test cl, dl
dec dh
mov dx, word [ecx]
test ecx, 0x860d24cc
pushal
pushfd
cmp edx, 0x6b
pushfd
lea esp, [esp + 0x4c]
je 0xe363dd
sal cl, cl
ror ch, 2
mov eax, dword [ebp - 0x104]
pushfd
bsr cx, dx
ror cx, 9
shr ecx, 7
mov ecx, dword [eax + 0x30]
test bl, cl
xor edx, edx
bts dx, 0xa
mov dx, word [ecx]
push 0xd8d92c4
cmp edx, 0x4b
mov byte [esp + 4], 0x8d
lea esp, [esp + 8]
jne 0xe3b389
xor ah, dh
mov eax, dword [ebp - 0x104]
adc ecx, esp
btr cx, bp
mov ecx, dword [eax + 0x30]
pushal
bt esp, 0x1a
call fcn.00e36bb6

Function at 0xe366eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
ror dl, 1
mov dl, byte [ecx + 8]
test al, bh
call fcn.00e3caa2

Function at 0xe36881
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x2c]
jne 0xe3b389
aad 0x25
lahf
mov eax, dword [ebp - 0x104]
sar ch, 1
adc cl, bh
mov ecx, dword [eax + 0x30]
cmp si, ax
sub edx, edx
bswap dx
btc dx, sp
add dh, 0xc6
mov dx, word [ecx + 0x18]
bt sp, sp
pushal
push dword [esp + 4]
test edx, edx
mov word [esp + 4], ax
push dword [esp]
push 0x400a7250
lea esp, [esp + 0x2c]
jne 0xe3b389
bswap cx
mov eax, dword [ebp - 0x104]
sar dl, 4
movsx cx, cl
stc
lea edx, [edx - 0x6c84b299]
mov ecx, dword [eax + 0x3c]
rcr dl, cl
mov dword [ebp - 0x108], ecx
ror dx, cl
mov edx, dword [ebp - 0x104]
jmp 0xe37265
pushfd
test cx, 0x4d3a
cmp bl, al
cmp edx, 0x4c
push edx
mov word [esp + 4], ax
jmp 0xe348e0
pushfd
add edx, 0x3c
cmp sp, di
stc
test bl, dh
mov dword [esp], ebp
cmp dword [ebp - 0x108], edx
jmp 0xe3abbf
push 0xfd2e343b
lea esp, [esp + 8]
je 0xe370d0
cwde
btc eax, ecx
mov eax, dword [ebp - 0x108]
clc
test dx, bx
cmc
cmp ah, 0x3c
cmp eax, dword [ebp - 0xf8]
call fcn.00e38618

Function at 0xe36bb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
rol dl, cl
shrd dx, bx, cl
mov dx, word [ecx + 2]
clc
cmp bp, 0x5ddf
cmp edx, 0x65
jmp 0xe34027

Function at 0xe36bd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x890b31ef
pushfd
lea esp, [esp + 0x30]
je 0xe39bd1
call fcn.00e335f6

Function at 0xe36bf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e33344
mov byte [esp + 4], dh
mov dword [ebp - 0x108], eax
push 0x46d1fd73
pushfd
push esp
mov byte [esp + 4], bl
lea esp, [esp + 0x34]
jmp 0xe36ec9

Function at 0xe36d94
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], al
mov eax, dword [ebp - 0xbc]
push eax
pushfd
pushal
mov dword [ebp + 0xc], eax
call fcn.00e38de0

Function at 0xe36f20
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x54], 0xe331a4
jmp 0xe3874d
call fcn.00e36223

Function at 0xe370f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
bts dx, 2
bsf dx, ax
mov dx, word [ecx + 6]
clc
cmp dl, ah
cmc
pushfd
cmp edx, 0x4c
call fcn.00e3ac62
call fcn.00e3c1b8
Function at 0xe37287
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe3ab0c
push edi
push dword [esp]
lea esp, [esp + 0x34]
jne 0xe3b9a2
jmp 0xe33bc9
push eax
mov dword [esp], 0x8000
push ebx
push 0xea838df1
push edi
mov byte [esp + 4], 0xea
mov dword [esp + 8], 0
pushal
push 0x831b7f5c
push dword [ebp - 0x90]
pop dword [esp + 0x28]
push esi
pushfd
push dword [esp + 0xc]
mov dword [esp + 0x30], 0xe33b72
mov byte [esp + 4], bl
pushfd
jmp 0xe333e3
clc
cmp dword [ebp - 0x11c], 0
push ecx
call fcn.00e34b8b

Function at 0xe37309
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x10]
je 0xe38fe0
cmp al, 0x10
pushal
mov eax, dword [ebp - 0x100]
rol ch, cl
mov ecx, dword [eax + 0x30]
stc
xor edx, edx
dec dx
mov dx, word [ecx]
cmc
mov byte [esp + 0xc], 0x20
cmp ax, si
bt ecx, 0x14
cmp edx, 0x6e
call 0xe39e1f
test bx, cx
and edx, 4
stc
cmc
test edx, edx
pushfd
jmp 0xe32af8

Function at 0xe3742f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
push dword [esp + 0x14]
mov dword [esp + 0x34], 0xe3b1d1
pushfd
push dword [esp]
call fcn.00e36d09
pushfd
mov dword [esp + 0x2c], 0
jmp 0xe3641c

Function at 0xe374e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xe3a240
sar ecx, cl
mov eax, dword [ebp - 0x104]
shrd cx, bp, cl
mov ecx, dword [eax + 0x30]
call fcn.00e35c55

Function at 0xe37504
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + 0x18]
rdtsc
rdtsc
push dword [esp]
pushfd
mov dword [ebp - 0xf8], ecx
xchg dh, al
push 0xa8ebf59c
pop edx
movzx ax, dl
mov edx, dword [ebp - 0x100]
movzx eax, cl
mov eax, dword [edx + 0x20]
call fcn.00e34119
mov byte [esp], 0x61
cmp edx, 0x4c
mov dword [esp], 0xeaf46b0f
push edx
mov byte [esp + 8], 0x1e
lea esp, [esp + 0x4c]
jne 0xe38fe0
dec ecx
bsr cx, bx
cmp ch, 0x94
mov eax, dword [ebp - 0x100]
shl cl, 5
bts cx, 0xb
adc cx, sp
push ebx
mov ecx, dword [eax + 0x30]
cmc
push eax
cmc
cmc
sub edx, edx
sar dl, cl
clc
mov dx, word [ecx + 0x12]
pushfd
test edx, edx
pushal
mov byte [esp + 4], ah
lea esp, [esp + 0x2c]
jne 0xe38fe0
not cx
push ebx
rdtsc
mov eax, dword [ebp - 0x100]
jmp 0xe33f61

Function at 0xe37574
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ch, dh
sbb cl, cl
sub ecx, edx
mov ecx, dword [eax + 0x30]
push ebp
pushfd
xor edx, edx
cmp ch, dh
mov dx, word [ecx + 8]
pushfd
pushfd
cmc
cmp edx, 0x45
mov byte [esp + 8], bl
lea esp, [esp + 0x10]
jne 0xe3b389
ror ch, cl
adc ch, bl
mov eax, dword [ebp - 0x104]
bsf cx, ax
movsx cx, bl
mov ecx, dword [eax + 0x30]
test cl, al
stc
cmp dx, cx
cmp bp, 0x9fba
sub edx, edx
pushfd
inc dh
not dl
mov dx, word [ecx + 0xa]
call fcn.00e37282
mov ecx, dword [eax + 0x30]
mov byte [esp], 0x29
mov byte [esp], dl
xor edx, edx
add dl, 2
ror dh, cl
shld dx, sp, cl
rol dl, cl
mov dx, word [ecx + 8]
test bp, 0xd04e
bt esi, eax
cmp edx, 0x65
mov word [esp], 0x267b
lea esp, [esp + 4]
je 0xe3acd3
setae al
aas
mov eax, dword [ebp - 0x104]
jmp 0xe36170
Function at 0xe37f6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0xe39fd0
cmp ebx, edi
jmp 0xe34a40
mov dword [ebp - 0x10c], eax
cmp dl, 6
cmp dword [ebp - 0x10c], 0
jmp 0xe34594
bt di, si
mov ecx, dword [ebp - 0xdc]
xchg al, dh
btc dx, 0xa
sal dx, 7
shrd eax, eax, 7
mov dword [ebp - 0xc0], ecx
sar dl, 1
sar al, 2
mov edx, dword [ebp - 0xac]
rcl al, cl
aas
shld eax, ebx, cl
sar al, cl
add edx, 0x10002464
mov ax, bp
mov eax, dword [ebp - 0xdc]
test dl, 0x66
sub eax, edx
pushal
push ebx
stc
sub eax, 5
test bx, sp
mov dword [edx + 1], eax
test bl, bl
mov eax, dword [ebp - 0xac]
bt esi, 2
pushfd
mov dword [esp], esi
call fcn.00e33de6

Function at 0xe37f82
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor esi, esi
ror si, 1
test eax, eax
push dword [esp]
shrd si, dx, cl
mov si, word [ecx + eax*2]
bt di, 1
and esi, 0xfff
bt bx, 0xc
call fcn.00e3a17a

Function at 0xe38021
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e35544
mov dword [esp + 0x50], 0xe3a3bc
jmp 0xe33ccf
jmp 0xe37344

Function at 0xe3817b
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl bl, 5
push esi
sub bl, 0x1b
mov bl, byte [eax + 9]
bt bp, 6
pushal
test bl, bl
pushfd
push esp
lea esp, [esp + 0x30]
je 0xe33541
stc
add ecx, 0x14
pushal
pushfd
pushfd
push 0x330efa9c
lea esp, [esp + 0x2c]
jmp 0xe370b6

Function at 0xe3821f
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc al, bh
add si, 0x19d2
rol si, 5
mov dword [edx], eax
setne al
mov eax, dword [ebp - 0xac]
add si, dx
sub si, di
bsf si, ax
cmc
add eax, 0x10001012
pushal
movzx esi, bl
mov esi, dword [ebp - 0x3c]
pushfd
jmp fcn.00e36dae
lea esp, [esp + 0x3c]
je 0xe33dff
not cx
inc cl
add cl, bh
pushfd
mov ecx, dword [ebp - 0x44]
cmp bl, bh
pushal
call fcn.00e32154
pushal
call fcn.00e3a629
or ah, byte [ecx]
mov ebx, 0x512b57ed
dec esp
and ebx, dword [ebx]
jne 0xe381cf
in eax, dx
adc eax, 0xd3366dce
xor bh, byte [edi + 0xf]
invalid
jmp 0xe38202
Function at 0xe3850e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jge 0xe3b97c
pushal
lea esp, [esp + 0x20]
je fcn.00e3373a
cwde
not al
mov eax, dword [ebp - 0x44]
bt bp, 7
push 0x1fceeca3
xor ecx, ecx
rol cl, cl
shl cl, cl
test ch, bh
sub cl, 0x94
mov cl, byte [eax + 7]
cmp dl, dh
test ah, bh
cmp ecx, 0x44
push edx
pushal
lea esp, [esp + 0x28]
jne 0xe3ca25
mov ecx, dword [ebp - 0x44]
pushfd
cmp bh, 0xb2
xor edx, edx
add dl, 0xca
rcr dl, 5
mov dl, byte [ecx + 7]
cmp ax, 0xfd66
cmc
cmp bp, dx
test bh, 0x72
cmp edx, 0x64
pushal
jmp 0xe336f4

Function at 0xe386d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [ebp - 0x7c]
pop dword [esp + 0x50]
call fcn.00e390a8

Function at 0xe3872a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0xc]
je 0xe3b96e
pushal
lea esp, [esp + 0x20]
jmp 0xe38af9

Function at 0xe3873f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0x100]
clc
inc ch
call fcn.00e3b864

Function at 0xe387d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0xbc]
cmp al, bl
add edx, dword [ebp - 0x74]
pushal
cmc
clc
push dword [esp + 8]
mov dword [ebp - 0x80], edx
call fcn.00e3adb4
pushfd
bt edx, 4
test eax, eax
pushal
mov byte [esp + 0x10], bh
pushal
mov byte [esp + 8], 0x87
lea esp, [esp + 0x44]
je 0xe3b96e
pushal
push 0xddbb4205
pushfd
lea esp, [esp + 0x28]
jmp 0xe38af9

Function at 0xe38824
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe33dd1
push dword [ebp - 0xc]
pop dword [esp]
call fcn.00e322ce
jmp 0xe324b6
lea esp, [esp + 0x24]
js 0xe34275
push 4
pushfd
lea esp, [esp + 4]
je 0xe33327
push 0x3000
pushfd
jmp 0xe33400

Function at 0xe38978
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x6a
lea esp, [esp + 0x30]
jne 0xe321d4
call fcn.00e3817b

Function at 0xe38ad5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], 0
call fcn.00e320e4
lea esp, [esp + 0x20]
jne 0xe38a30
pushfd
push ebx
mov dword [ebp - 0xc], 0x2000
lea esp, [esp + 8]

Function at 0xe38b40
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x65
jmp 0xe327f5
mov eax, dword [ebp - 0x104]
sbb ch, dh
sub ch, bl
clc
mov ecx, dword [eax + 0x30]
test bh, 0x96
pushal
sub edx, edx
stc
mov dx, word [ecx + 8]
push 0x67c42945
pushfd
cmc
jmp 0xe32a9d

Function at 0xe38bba
Capabilities:
Execute anti-debugging instructions

Disassembly:
test ah, 1
pushfd
cmp bl, 0x4c
call fcn.00e35cf2

Function at 0xe38bc6
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap dx
pushfd
mov edx, dword [ecx]
pushfd
mov dword [ebp - 0xfc], edx
mov byte [esp + 4], 0xf8
push edx
pushfd
lea esp, [esp + 0x34]
jmp 0xe3ad33

Function at 0xe38c38
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
cmp edx, 0x4c
pushal
pushal
push dword [esp]
lea esp, [esp + 0x48]
jne 0xe3b389
Function at 0xe38d98
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushal
push 0x3ea6dd7
lea esp, [esp + 0x48]
jne 0xe3b389
xadd cx, ax
bts cx, bp
mov eax, dword [ebp - 0x104]
or ch, 0x81
xor cl, cl
call fcn.00e37574

Function at 0xe38de0
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ax, al
pop eax
mov eax, dword [ebp - 0x80]
call fcn.00e351e1

Function at 0xe38e4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
je 0xe3b96e
pushfd
pushal
pop ecx
mov eax, dword [ebp - 0xc]
movsx cx, dl
movzx edx, cl
call fcn.00e3a584

Function at 0xe39076
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x1c], 0
pushal
jmp 0xe384a1
mov dword [esp + 0x38], 0
call fcn.00e38b1d
mov dword [esp + 0x28], edx
not al
mov eax, dword [ebp - 0x90]
pushfd
push ebx
mov dword [esp + 0x2c], eax
push dword [esp]
push ebx
lea esp, [esp + 0x34]
jp 0xe35bfc
push 0
call fcn.00e3af03

Function at 0xe392eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + edx*4]
pushfd
cmp di, sp
stc
cmc
and ecx, 0x80000000
test dx, 0xd62b
bt ecx, esi
cmp ecx, 0x80000000
call fcn.00e3b7b8

Function at 0xe3930d
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bl, 0x8c
bt cx, di
pushfd
cmp edx, 0x6e
pushfd
lea esp, [esp + 8]
je 0xe3b2fe
add al, bh
rol ch, cl
mov eax, dword [ebp - 0x100]
inc cx
shrd cx, dx, 9
mov ecx, dword [eax + 0x30]
call fcn.00e3c7ee
pushfd
pushfd
lea esp, [esp + 0xc]
je 0xe3ca25
bswap dx
and ax, 0x661a
shl ah, 1
adc al, 0x58
mov edx, dword [ebp - 0xac]
shrd ax, cx, 0xb
push 0x91e94c08
bts ax, 6
add edx, 0x10001efc
sar ax, cl
daa
pop eax
shld ax, ax, cl
mov eax, dword [ebp - 0x7c]
bt bx, 3
jmp 0xe3b0f2
test dl, dh
movsx dx, bl
neg dh
mov dx, word [ecx]
call fcn.00e33803
bt ax, 9
mov eax, dword [ebp - 0xdc]
bt ax, 2
jmp 0xe3adee
sub edx, edx
btc dx, sp
test al, al
dec dx
sub esp, 0xfffffff8
jno 0xe39048
mov dx, word [ecx]
jmp 0xe37fa9
mov dword [edx + 1], eax
rdtsc
mov edx, dword [ebp - 0xac]
sar al, 4
shr al, cl
movsx eax, cl
add edx, 0x10001f04
sar al, 7
pop eax
not al
mov eax, dword [ebp - 0x9c]
stc
jmp 0xe3ad60
mov byte [esp], dh
test ah, 0x7a
mov dword [edx + 1], eax
movsx eax, dl
not ax
mov eax, dword [ebp - 0xc]
bt sp, 0xa
pushfd
mov byte [esp], 0xde
mov dword [edx + 6], eax
ror ax, 8
sub dl, ch
clc
mov edx, dword [ebp - 0xac]
add al, 0x3e
push dword [esp]
cmc
btc ax, 1
add edx, 0x10001f1a
shl ah, cl
sub al, 0x1b
lahf
mov eax, dword [ebp - 0xb8]
cmp esi, esp
call fcn.00e3c3c1
sub eax, edx
jmp 0xe3be47
pushal
mov dword [eax], edx
shld dx, dx, 0xf
mov edx, dword [ebp - 0xac]
shld eax, edi, 0x1a
pushfd
add edx, 0x10001f34
das
pushal
jmp 0xe39238
mov byte [esp + 4], 0x38
sub eax, 5
bt ax, 8
clc
jmp 0xe39e42

Function at 0xe393a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
call fcn.00e35713
lea esp, [esp + 0x24]
jns 0xe38612
je 0xe3ca25
bt bp, 4
push esi
mov dword [esp], 0x584870f2
cmp dword [ebp - 0x7c], 0
call fcn.00e3b292
Function at 0xe39407
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl bl, cl
mov bl, byte [eax + 1]
cmc
mov word [esp], si
pushfd
cmp bl, 0x74
pushal
lea esp, [esp + 0x2c]
je 0xe34a2e
cmp ax, 0x99fb
cmp bl, 0x54
call fcn.00e33974

Function at 0xe3942c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], 0
pushfd
call fcn.00e360d3
mov cl, byte [eax + 7]
call fcn.00e3ca6c

Function at 0xe3944c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x5b
mov ecx, dword [eax + 0x30]
mov dword [esp], 0x42266ba4
push ebx
push 0x50a6c620
lea esp, [esp + 0x14]
jmp 0xe3a517

Function at 0xe39aa4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [edx + 0x194], eax
mov byte [esp], 0x4d
push ebx
pushfd
lea esp, [esp + 0x34]
jmp 0xe359a6

Function at 0xe39e1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x2c]
jne 0xe38fe0
adc cx, 0x1023
mov eax, dword [ebp - 0x100]
neg ch
sal cl, cl
rcr cl, cl
not cl
mov ecx, dword [eax + 0x30]
clc
xor edx, edx
movzx dx, dl
movzx dx, al
bswap dx
mov dx, word [ecx + 8]
bt ecx, 0xf
cmp edx, 0x6c
jns 0xe39e1a
pushfd
mov byte [esp], 0xb5
pushfd
lea esp, [esp + 8]
je 0xe3b490
shrd eax, esp, cl
inc ah
shld ax, cx, cl
mov eax, dword [ebp - 0x100]
pushfd
jmp 0xe357cd
jmp 0xe3baef
pushal
bswap edx
lea edx, [0xd2cc90db]
movzx dx, al
mov ecx, dword [ebp - 0xfc]
call fcn.00e38bc6
call fcn.00e36897
pushal
pushfd
call fcn.00e33405
push ecx
shr cx, 6
mov eax, dword [ebp - 0x100]
bswap ecx
mov ecx, dword [eax + 0x30]
cmc
pushfd
pushal
pushfd
xor edx, edx
bswap dx
clc
shld dx, dx, 3
mov dx, word [ecx + 0xa]
pushfd
call fcn.00e3a037
pushal
pushal
call fcn.00e3922e
bt ax, sp
mov ecx, dword [eax + 0x30]
call fcn.00e3881d
push dword [ebp - 0xc8]
pop dword [esp + 0x4c]
mov word [esp + 4], 0x7048
push dword [esp + 0x4c]
ret 0x50

Function at 0xe39f2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [ebp - 0x7c]
pop dword [esp + 0x48]
lea esp, [esp + 0x48]
jns 0xe3bcab
push 0xe36d78
push ebp
mov byte [esp], al
push 0xe59cf56b
push dword [ebp - 0xc8]
pop dword [esp + 4]
pushal
push 0x4766e2c9
push dword [esp + 0x28]
ret 0x2c
pushal
pushfd
pushal
call fcn.00e33e7e
jmp fcn.00e38efe
pushal
mov dword [esp + 0x1c], 0xe36d78
push dword [esp]
pushal
lea esp, [esp + 0x40]
jle 0xe3a3e0
push dword [ebp - 0xc8]
pushal
mov byte [esp + 8], bl
push dword [esp + 0x20]
ret 0x24

Function at 0xe3a11d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x28]
je 0xe37d53
shl eax, cl
bsf ax, bx
btc ecx, edx
shl ah, cl
mov eax, dword [ebp - 0x104]
rcr cl, cl
rol ecx, cl
mov ecx, dword [eax + 0x30]
bt edi, esp
clc
pushal
sub edx, edx
adc dl, dh
stc
shl dl, 2
mov dh, bl
mov dx, word [ecx + 4]
stc
pushal
cmp edx, 0x52
pushfd
jmp 0xe37d44
mov byte [esp + 4], 0x13
lea esp, [esp + 0x44]
jne 0xe3b389
jmp 0xe37117

Function at 0xe3a22b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
jl 0xe337ab
pushfd
lea esp, [esp + 4]
jne 0xe3b389
Function at 0xe3a255
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0xe34b21
sbb cl, 0xf9
not ax
aad 1
not ax
mov eax, dword [ebp - 0x100]
shl cl, cl
dec cx
mov ecx, dword [eax + 0x30]
cmc
push 0x4781425e
sub edx, edx
dec dx
mov dx, word [ecx + 2]
pushfd
call fcn.00e35109

Function at 0xe3a302
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe3a53c
mov dword [esp], 0x66bd7f33
mov byte [esp], dh
mov dword [eax + edx*4], ecx
pushfd
pushfd
lea esp, [esp + 0x34]
jmp 0xe3bc9e

Function at 0xe3a559
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0xe321d4

Function at 0xe3a584
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe3594d
sal ch, 1
mov eax, dword [ebp - 0x104]
rcl cl, cl
shl cl, cl
bsf cx, ax
push edi
mov ecx, dword [eax + 0x30]
pushal
sub edx, edx
mov byte [esp], 0xab
bt bx, 2
shl dx, cl
shrd dx, bp, 4
mov dx, word [ecx + 0x18]
bt esi, ecx
test edx, edx
jmp 0xe3a0b6
mov byte [esp], 0xaa
push eax
pushfd
lea esp, [esp + 0x2c]
jne 0xe3b389
bt bx, 0xd
shrd cx, bp, cl
not ch
mov eax, dword [ebp - 0x104]
bts edx, edi
cmc
mov ecx, dword [eax + 0x3c]
setg dl
call fcn.00e3b99d
lea esp, [esp + 0x20]
jne 0xe36ff0
rcl bx, 6
mov ebx, dword [eax + 0xa]
push esi
test di, dx
and ebx, 0xffffff
clc
stc
mov byte [esp], al
cmp ebx, 0x6c6c
push edi
lea esp, [esp + 8]
je 0xe38588
pushal
call fcn.00e37326
movzx dx, cl
mov dword [esp + 0x20], eax
call fcn.00e39e26
pushfd
lea esp, [esp + 0x34]
je 0xe33c69
sub eax, edx
movsx ax, al
movsx ax, bl
movzx ecx, dl
mov eax, dword [ebp - 0x104]
btr cx, 7
inc cl
and cx, cx
sub ecx, ebx
mov ecx, dword [eax + 0x30]
bt esi, ebx
xor edx, edx
mov dl, al
jmp 0xe3bf41
sar dh, 1
mov dx, word [ecx + 0x16]
pushal
cmp edx, 0x4c
push dword [esp]
jmp 0xe3c4e4
push dword [esp + 4]
lea esp, [esp + 0x28]
jne 0xe3b389
pushal
neg ch
xor cl, bl
mov eax, dword [ebp - 0x104]
bts cx, cx
sub ecx, eax
bts ecx, ebp
movsx cx, cl
mov ecx, dword [eax + 0x30]
bt cx, 4
mov byte [esp], 0x20
xor edx, edx
bsr dx, si
mov dx, word [ecx + 0x18]
stc
test dl, 0xb2
test edx, edx
call fcn.00e371f9

Function at 0xe3a629
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
jmp 0xe33020

Function at 0xe3aac5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edx, 0x6e
pushfd
push eax
lea esp, [esp + 0x2c]
je 0xe35cc8
aas
ror ch, cl
daa
mov eax, dword [ebp - 0x104]
pushal
xor ch, dh
mov ecx, dword [eax + 0x30]
stc
pushal
call fcn.00e3c10a
lea esp, [esp + 0x28]
jne 0xe3b389
btr cx, 3
mov eax, dword [ebp - 0x104]
clc
mov ecx, dword [eax + 0x30]
stc
pushal
xor edx, edx
neg dl
mov dx, word [ecx + 6]
pushfd
jmp 0xe37c45