joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4114db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x18], 2
push edi
je 0x44f210
cmp dword [ebp + 0x18], 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 1
jne 0x411514
push 0x400
call dword [0x490258]
test eax, eax
je 0x41151b
add eax, 0xfffffffe
pop edi
pop ebp
ret 0x14
push 0x409
jmp 0x411502
xor eax, eax
jmp 0x41150f
add bl, ch
add dword [ecx + 0x66], eax
cmp dword [edi + ecx*2], edx

Function at 0x41153b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
cmp eax, 1
jg 0x44f279
mov eax, dword [edi + 4]
push 2
pop esi
add eax, esi
cmp dword [edi + 8], eax
jb 0x411584
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov ax, word [ebp + 8]
mov word [ecx + edx*2], ax
inc dword [edi + 4]
xor edx, edx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x41c2
jae 0x44f2bf
add eax, eax
push eax
mov dword [edi + 8], eax
call fcn.00411c65
xor ecx, ecx
mov dword [edi + 8], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420f95
cmp dword [edi], 0
mov esi, eax
pop ecx
je 0x4115d3
mov ecx, dword [edi + 4]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi]
push esi
call fcn.00421070
push dword [edi]
call fcn.004230a0
add esp, 0x10
mov dword [edi], esi
jmp 0x41155f
dec edi
Function at 0x411680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
test edi, edi
je 0x4116f1
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ecx + 4]
cmp esi, ecx
jae 0x4116f1
cmp edi, 0xffffffff
jne 0x44f32f
mov edi, ecx
sub edi, esi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, 1
jg 0x411765
mov eax, dword [ebx + 4]
inc eax
add eax, edi
cmp dword [ebx + 8], eax
jb 0x4116fc
mov ecx, dword [ebx + 4]
lea eax, [edi + edi]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea eax, [eax + esi*2]
push eax
mov eax, dword [ebx]
lea eax, [eax + ecx*2]
push eax
call fcn.00421070
add dword [ebx + 4], edi
add esp, 0xc
mov ecx, dword [ebx + 4]
xor edx, edx
mov eax, dword [ebx]
mov word [eax + ecx*2], dx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x41c2
jae 0x44f33f
add eax, eax
mov dword [ebx + 8], eax
test eax, eax
je 0x4117d6
add eax, 7
and eax, 0xfffffff8
xor ecx, ecx
mov dword [ebx + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420f95
mov edx, dword [ebx]
add esp, 4
mov dword [ebp + 0xc], eax
test edx, edx
je 0x41175e
mov ecx, dword [ebx + 4]
lea ecx, [ecx*2 + 2]
push ecx
push edx
push eax
call fcn.00421070
push dword [ebx]
call fcn.004230a0
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov dword [ebx], eax
jmp 0x4116c5
dec eax
push 4
mov dword [ecx], eax
call fcn.00420fe6
add esp, 4
test eax, eax
je 0x4117cb
mov dword [eax], 1
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 4]
inc eax
add eax, edi
mov dword [ebx + 8], eax
je 0x4117cf
add eax, 7
and eax, 0xfffffff8
xor ecx, ecx
mov dword [ebx + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420fe6
mov ecx, dword [ebx + 4]
mov esi, eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebx]
push esi
call fcn.00421070
mov dword [ebx], esi
add esp, 0x10
mov esi, dword [ebp + 0xc]
jmp 0x4116c5
xor eax, eax
jmp 0x41177c
mov eax, 8
jmp 0x411790
mov eax, 8
jmp 0x41171a
hlt
add eax, 0x4589c203
clc

Function at 0x4117e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
cmp esi, dword [ebp + 8]
je 0x44f401
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
call fcn.00411680
pop esi
mov esp, ebp
pop ebp
ret 4
xor byte [ecx], al
add byte [eax], al
Function at 0x411805
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
inc eax
cmp dword [esi + 8], eax
jb 0x44f422
pop esi
mov esp, ebp
pop ebp
ret 4
inc esi
or al, 0x89
push eax
inc esp
mov eax, dword [esi + 0xc]
mov dword [eax + 0x48], 4
mov eax, dword [esi + 0xc]
mov dword [eax + 0x4c], ecx
xor ecx, ecx
mov eax, dword [esi + 0xc]
inc ecx
mov word [eax + 0x50], cx
mov eax, dword [esi + 0xc]
pop ecx
push 0x10
mov word [eax + 0x52], cx
call fcn.004113e6
pop ecx
mov ecx, dword [esi + 8]
xor edx, edx
push 0x48
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
pop ecx
push 0x13
mov eax, dword [eax + 8]
mov word [eax + 4], cx
mov ecx, 0x4013
mov eax, dword [esi + 8]
mov eax, dword [eax + 8]
mov word [eax + 0xc], cx
mov eax, dword [esi + 8]
mov eax, dword [eax + 8]
mov dword [eax], edx
mov eax, dword [esi + 8]

Function at 0x41453d
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x414565
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x414557
pop edi
pop esi
pop ebp
ret 4
Function at 0x44f1b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
call dword [0x4901ac]
mov dword [ebp - 0xc], eax
xor ecx, ecx
push 2
add eax, 6
pop ebx
mul ebx
seto cl
neg ecx
or ecx, eax

Function at 0x4502f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi

Function at 0x45915d
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c5190]
jne 0x45916a
call fcn.00459244
mov eax, dword [0x4c8ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c8ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x4591a2
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c5190]
jne 0x4591b4
call fcn.00459244
mov eax, dword [0x4c8ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c8ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x4591f7
fadd qword [0x4bcac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bcaa0]
mov esp, ebp
pop ebp
ret

Function at 0x459207
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c8530], ecx
inc esi
mov ecx, 0x4c8530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c8eec
jl 0x459218
mov dword [0x4c5190], esi
mov dword [0x4c8518], esi
pop esi
ret
Function at 0x459244
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c8518], 0
push esi
push edi
mov esi, 0x4c8530
jne 0x459263
push 0
call fcn.0041582a
pop ecx
mov ecx, eax
call fcn.00459207
mov dword [0x4c5190], 0x270
mov edi, 0xe3
mov dword [0x4c8ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x459278
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x4592ad
mov ecx, dword [0x4c8530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, edx
mov dword [esi], eax
pop esi
ret

Function at 0x459ac4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.0045991a
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.00459960
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x459b08
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.00459a98
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x459af2
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45f949
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
ja 0x45f92e
sub esp, 7
lea esp, [esp + 3]
jmp 0x46012e
lea esp, [esp + 4]
sub esi, 0x41
jmp 0x45f8ee

Function at 0x4600a8
Capabilities:
Encode data using base64

Disassembly:
cmp bl, 0x2f
jmp 0x460121
call 0x45f86a
pop esi
jmp 0x45f8ee
pushfd
jmp 0x4600af
pop dword [esp]
lea esp, [esp + 4]
cmp bl, 0x2b
jmp 0x4600f7
lea esp, [esp + 4]
push 0x3e
jmp 0x45f8b3
jne 0x45f862
pushfd
mov word [esp + 1], ax
push bx
lea esp, [esp + 2]
jmp 0x4600de
jne 0x45f89d
push 0x3f
jmp 0x45f8b3

Function at 0x46010b
Capabilities:
Encode data using base64

Disassembly:
jmp 0x460144
push dword [esp + 2]
jmp 0x4601af
cmp bl, 0x5a
call fcn.0045f949
lea esp, [esp + 8]
ja 0x45f944
add esi, 4
jmp 0x45f8ee
Function at 0x470ef6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jbe 0x470a39
cmp dword [ebp - 4], ebx
call fcn.00470f9e
push es
inc ecx
je 0x470af1
in al, 0x5b
mov al, byte [0xfac36dd]
xchg esi, eax
add ecx, ebp
jmp 0x471045
mov bl, 0x58
xor ebx, dword [edx + reloc.MSVCRT.dll_strncpy]
add al, 0x7f
clc
daa
jnp 0x470a48
rol byte [ebx + 0x648d153a], 0x24
xor byte [edx - 0x16eec5f0], cl
sub edi, esi
invalid
in al, dx
mov byte [esp + 3], dl
lea esp, [esp + 8]
jne 0x470a72
je 0x470e19

Function at 0x4cb4af
Capabilities:
Execute anti-debugging instructions

Disassembly:
setnp al
clc
jmp 0x4cb4b9
mov eax, ecx
lea edx, [edi*4]
mov dword [esp + 3], ecx
inc dx
cld
rdtsc
jmp 0x4cb626
lea edx, reloc.MSVCRT.dll_strncpy
setg dh
setp al
dec ecx
pop ax
mov dword [esp + 8], edi
jmp 0x4cb518
rdtsc
push word [esp + 4]
pop word [esp + 0x15]
mov byte [esp + 0xe], ch
xchg ecx, eax
inc ah
jmp 0x4cb4e1
pop cx
xchg dword [esp + 0x15], ecx
mov word [esp + 3], di
or cx, 0xe9db
mov dl, dh
mov edx, edi
jmp 0x4cb5c0
cmc
cld
setb al
mov cl, byte [esp]
btc dx, dx
pushal
jmp 0x4cb502
neg dx
mov byte [esp + 0xb], ah
pop ax
sub esp, 2
mov byte [esp + 0x11], al
mov byte [esp + 3], bh
jmp 0x4cb59b
xchg byte [esp + 8], ch
stc
xchg dword [esp + 0xa], eax
mov dx, 0xb2ac
mov dx, word [esp + 0xb]
mov dx, 0x5e0c
jmp 0x4cb54a
cld
pop eax
bswap edx
lea esp, [esp + 3]
xchg edx, eax
xchg cx, dx
jmp 0x4cb5ee
setp dl
lea esp, [esp + 0xb]
dec dl
mov dl, byte [esp + 6]
mov edx, ebp
pop word [esp]
jmp 0x4cb585
rdtsc
lea edx, [ebp*4]
ror ax, cl
pop ax
xchg dword [esp + 0xc], eax
pop dword [esp + 0xa]
jmp 0x4cb56d
lea ecx, [eax + edi]
xchg byte [esp], cl
mov ah, byte [esp]
mov ch, 0x9b
cld
neg ch
jmp 0x4cb602
mov cx, word [esp]
rcl dx, cl
cmc
xchg byte [esp], ah
xchg word [esp], ax
xchg byte [esp], al
jmp 0x4cb5d8
setns cl
ror cx, 6
lea ecx, [esi*4]
lea eax, [ecx + ebp]
sets ch
mov cx, word [esp]
jmp 0x4cb6ed
clc
clc
mov edx, 0xc2c65c42
rdtsc
mov ecx, 0xb15a2cce
clc
jmp 0x4cb53b
sub esp, 0x13
lea ecx, [esi + ebp]
setnp al
mov dx, sp
mov ah, dh
call fcn.004cb68b
mul cl
and byte [esi - 0x654f03f], al
xchg cl, al
bts ecx, edi
lea esp, [esp + 1]
mov ax, 0x7225
mov cx, bp
bsr ecx, ecx
jmp 0x4cb63a
neg al
mov dh, byte [esp + 1]
xchg byte [esp], ch
xchg byte [esp], al
rdtsc
sub esp, 0
jmp 0x4cb650
Function at 0x4cb68b
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
sete cl
inc dl
add esp, 8
xchg dx, ax
rcr ch, 3
jmp 0x4cb6a7
rdtsc
mov al, 0x59
add esp, 9
stc
push word [esp]
xchg dword [esp], ecx
jmp 0x4cb690
lea ecx, [ebx + ebp]
jmp 0x4cb665
mov dword [esp], esp
bswap edx
mov dx, word [esp + 3]
lea eax, [eax*4]
jmp 0x4cb6cf
setae al
mov byte [esp + 5], ch
sete al
pop edx
inc ch
setle ch
jmp 0x4cb675
inc edx
lea eax, reloc.MSVCRT.dll_strncpy
add esp, 0
btr dx, bx
not ecx
jmp 0x4cb719
xchg al, dh
pop ecx
and ax, ax
not ecx
bsr ax, si
mov byte [esp], cl
jmp 0x4cb6b9
not al
mov eax, dword [esp]
neg ch
xchg byte [esp], dl
mov edx, dword [esp]
mov al, 0x15
jmp 0x4cb78e
lea esp, [esp]
mov al, byte [esp]
xchg dl, al
neg ah
lea esp, [esp]
mov dx, word [esp]
jmp 0x4cb703
xchg ah, cl
mov edx, dword [esp]
rdtsc
rol dx, 2
xchg byte [esp], dh
jmp 0x4cb775
dec ax
neg cx
lea esp, [esp]
mov ax, 0xdca
bswap eax
not ch
jmp 0x4cb74d
mov cl, byte [esp]
mov byte [esp], al
xchg byte [esp], al
mov cl, dl
lea eax, [edx + ebp]
push eax
jmp 0x4cb7b6
not ch
bts eax, ebx
xchg cl, dl
lea esp, [esp]
std
mov ecx, 0xc1c51c90
jmp 0x4cb763
lea ecx, [esp + edx]
xchg ch, cl
not ecx
xchg dx, cx
cld
jmp 0x4cb7ca
lea eax, [esp + 0x66]
push word [esp + 3]
xchg byte [esp + 3], ch
rdtsc
cmp ch, cl
pop eax
jmp 0x4cb7a0
lea eax, [edx*4]
sub esp, 0x1c
rdtsc
bswap ecx
lea eax, [ebp*4]
mov ax, word [esp + 0x1b]
jmp 0x4cbabb
mov dword [esp + 0x14], edi
bswap edx
rdtsc
lea edx, [edi*4]
mov dx, word [esp + 9]
mov dx, di
call fcn.004cb9b0
pop cx
bts ax, di
pop dword [esp + 3]
lea ecx, [esi + ebp]
bswap eax
jmp 0x4cbb67
bt cx, cx
setnp dl
lea ecx, reloc.MSVCRT.dll_strncpy
jmp 0x4cbb74
pop dword [esp + 0x1e]
mov word [esp + 0x19], bx
shl al, 3
lea edx, [esi*4]
mov edx, ecx
jmp 0x4cbb35
xchg dx, ax
pop ecx
pushal
mov byte [esp + 0x1d], cl
xchg ecx, eax
push esp
jmp 0x4cbb4b
mov ax, word [esp]
xchg byte [esp + 0xd], cl
add esp, 0x1f
rcl eax, cl
bswap edx
mov cl, byte [esp]
jmp 0x4cbd55
xchg dl, cl
sbb ch, 0x52
cmc
xchg cx, dx
call fcn.004cbbd6
lcall 0x1cbc, 0x17e49d0d
outsd dx, dword [esi]
add esp, 4
lea esp, [esp + 9]
bswap eax
xchg ah, al
add dl, bh
mov ax, word [esp]
jmp 0x4cbbad
pop dword [esp + 3]
xchg word [esp + 7], cx
cmp eax, 0x182a1794
mov byte [esp + 1], bl
push dword [esp + 7]
mov edx, 0x5d68837b
jmp 0x4cbbc3
mov ecx, dword [esp + 2]
xchg word [esp + 1], ax
mov ah, 0x82
push ebp
xchg word [esp + 5], cx
sub esp, 2
jmp 0x4cbbf3
not edx
setp cl
mov dl, 0xd4
rol cl, cl
mov cl, byte [esp + 7]
pop word [esp + 5]
jmp 0x4cbc36
Function at 0x4cb9b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
setge cl
mov dword [esp + 7], ebp
rdtsc
cld
mov ax, word [esp + 6]
jmp 0x4cb90e
add esp, 8
bswap ecx
stc
pop dword [esp + 4]
and dx, si
not dx
jmp 0x4cb802
pushal
lea esp, [esp + 0x43]
pushal
pop edx
pop dword [esp + 1]
mov dword [esp], esi
jmp 0x4cb818
cmc
btr ecx, eax
xchg dx, ax
push dword [esp + 0xe]
btc ecx, edx
jmp 0x4cb884
bts ecx, edi
std
mov ecx, esi
mov byte [esp + 6], cl
rdtsc
lea eax, [ecx + ebp]
jmp 0x4cb847
xchg ecx, eax
stc
xchg ah, ch
push dword [esp + 0xe]
mov edx, ebx
xchg ecx, eax
jmp 0x4cb8a0
lea edx, [edx*4]
bts ecx, eax
bswap edx
mov edx, dword [esp + 0xd]
mov dh, byte [esp + 1]
lea edx, [ebp - 0xd5]
jmp 0x4cb86e
mov edx, esi
btc dx, cx
xchg byte [esp + 0x16], dl
add esp, 0xa
bswap eax
jmp 0x4cb8e2
mov ecx, ebx
push word [esp + 0xb]
mov byte [esp + 0xb], bh
rcr dl, 7
lea eax, [ebx + ebp]
push si
jmp 0x4cb85d
pop ax
mov dword [esp + 2], eax
rdtsc
pop edx
mov dx, 0xb619
jmp 0x4cb978
not ax
bsr edx, esi
lea ecx, reloc.MSVCRT.dll_strncpy
mov ch, 0x5c
mov eax, 0x95067c56
mov ah, byte [esp + 8]
jmp 0x4cb8cc
mov dx, 0x39dc
rdtsc
xchg dword [esp + 3], ecx
mov eax, 0xac1d6e8e
xchg word [esp + 7], dx
setns al
jmp 0x4cb8b7
push dword [esp + 9]
lea eax, [esi*4]
push dword [esp + 0xb]
jmp 0x4cb951
mov ecx, dword [esp + 0xd]
mov ah, ch
mov word [esp + 0xc], cx
std
lea esp, [esp + 4]
mov eax, edi
jmp 0x4cb927
mov dword [esp + 7], ebp
mov byte [esp + 0xa], dl
rdtsc
mov ah, bh
push dx
pushfd
jmp 0x4cb98a
pop dx
lea edx, reloc.MSVCRT.dll_strncpy
mov word [esp + 0x13], cx
jmp 0x4cba70
mov byte [esp + 1], bl
xchg ecx, eax
neg al
sub esp, 5
sub esp, 2
mov al, 0x2e
jmp 0x4cb93d
push word [esp + 0x18]
mov ch, dh
mov eax, dword [esp + 0x18]
mov ch, byte [esp + 9]
bsf dx, ax
mov dword [esp + 0x10], edi
jmp 0x4cb962
jmp 0x4cb837
pop edx
cld
lea eax, reloc.MSVCRT.dll_strncpy
bswap edx
shl cx, 0xe
rdtsc
jmp 0x4cb9e2
inc ah
cmc
xchg word [esp + 0xc], ax
lea ecx, reloc.MSVCRT.dll_strncpy
mov dl, byte [esp]
xchg byte [esp + 5], dl
jmp 0x4cb9b5
xchg word [esp + 0xc], cx
setle ah
sub esp, 3
mov dword [esp + 7], esp
jmp 0x4cba12
bts ecx, ecx
neg ax
mov word [esp + 0x11], sp
xchg dword [esp + 0x14], ecx
mov cl, byte [esp + 0x19]
bts ecx, esp
jmp 0x4cb9cb
mov edx, 0xb2f09970
inc dx
mov cx, word [esp + 1]
mov word [esp + 0xb], bp
call fcn.004cba56
mov ah, 0xa7
bsr dx, di
setl ch
sete ah
xchg cl, ch
mov cx, 0x2f1
mov dword [esp + 8], ebx
jmp 0x4cb9fa
xchg word [esp + 0xd], cx
lea edx, [eax + edi]
mov ax, 0x5d27
bsf ax, bx
push word [esp + 0x18]
bt dx, sp
jmp 0x4cba2a
Function at 0x4cbc1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx*4]
btr eax, eax
jmp 0x4cbc10
sbb ecx, eax
not al
bsr eax, ebx
call 0x4cbc1d
xchg edi, eax
mov cl, byte [esp + 4]
xchg ecx, edx
neg edx
jmp 0x4cbce9
lea esp, [esp + 8]
not dh
setno al
xchg cx, dx
mov ah, ch
jmp 0x4cbcaf
inc ax
push eax
push dword [esp + 3]
rdtsc
xchg byte [esp], cl
mov edx, 0x5529e1eb
jmp 0x4cbc4c
pop dx
bt edx, ebp
rdtsc
bsr ax, dx
mov eax, dword [esp]
xchg ecx, edx
jmp 0x4cbc62
pushal
mov byte [esp + 0x19], cl
neg eax
mov cx, word [esp + 8]
xchg word [esp + 2], ax
pop ax
jmp 0x4cbcc1
lea esp, [esp]
btr eax, ebp
xchg ecx, eax
mov ah, byte [esp]
neg edx
setle al
jmp 0x4cbc96
mov dx, word [esp + 0xc]
pop cx
mov ah, byte [esp + 0x12]
mov cx, word [esp + 2]
cmp ax, si
pop ecx
jmp 0x4cbd18
pop dword [esp]
pop dx
lea edx, [edx*4]
mov edx, esp
mov ax, word [esp + 2]
mov dl, byte [esp + 1]
jmp 0x4cbc84
std
xchg byte [esp + 8], ch
mov word [esp + 0x18], sp
push word [esp + 6]
cmc
jmp 0x4cbd2d
mov dh, 0xeb
mov dx, sp
btc ecx, esi
lea esp, [esp + 3]
sub esp, 0xd
lea esp, [esp + 1]
jmp 0x4cbd02
mov ah, al
mov edx, 0x5aafd468
mov dword [esp + 6], edi
std
mov edx, 0x7b7f4d7e
bsf eax, eax
jmp 0x4cbde4
sub esp, 2
btr ecx, esp
call fcn.004cbd86
not ch
lea ecx, [eax + edx]
rdtsc
mov cx, word [esp]
push ebp
push word [esp + 1]
jmp 0x4cbf68
push eax
clc
neg eax
push word [esp + 2]
lea esp, [esp + 7]
mov dl, al
jmp 0x4cbdb5
bsf eax, edx
push dword [esp + 1]
pop word [esp + 3]
call fcn.004cbeee
rdtsc
btc dx, sp
mov edx, dword [esp + 1]
cmc
mov cx, di
jmp 0x4cbfb4
xchg edx, eax
rcr ax, cl
xchg cl, dl
xchg byte [esp + 1], dh
mov al, 0x19
cld
jmp 0x4cbf79
xchg byte [esp + 1], al
push word [esp + 4]
call fcn.004cbf9e
pop ds
mov ds, word [ebx + edi*2]
xchg esi, eax
mov esp, dword [bp + di]
mov bl, 0xd6
and eax, 0x8f11e696
add al, 0x24
mov dword [esp], esi
inc edx
xchg dword [esp], edx
or cx, 0x172a
mov byte [esp + 2], ah
jmp 0x4cbf8f
Function at 0x4cbeee
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
sub esp, 0x10
bswap edx
mov dword [esp + 8], esp
xchg cx, ax
lea eax, [esi*4]
jmp 0x4cbe3b
xchg edx, ecx
add esp, 7
rdtsc
add esp, 1
cmc
mov dx, bp
jmp 0x4cbdf5
xchg word [esp + 4], cx
pop word [esp]
xchg cx, dx
mov eax, ecx
jmp 0x4cbe4d
btr eax, edx
pop eax
pop ecx
push word [esp + 3]
lea esp, [esp]
setnp dl
jmp 0x4cbe25
push dword [esp + 5]
lea eax, [edi + 0xe7]
push ax
xchg al, dh
bts cx, ax
rdtsc
jmp 0x4cbebc
xchg word [esp + 2], cx
setg cl
neg dh
bsr eax, eax
pop ax
mov word [esp + 2], bp
jmp 0x4cbe15
lea eax, reloc.MSVCRT.dll_strncpy
shl dh, cl
mov ecx, 0x4736bd2f
not dh
jmp 0x4cbed1
xchg word [esp + 5], cx
mov ecx, eax
neg eax
setp cl
xchg dx, ax
mov word [esp + 4], si
jmp 0x4cbe86
mov ah, ch
adc eax, 0x785d9704
mov word [esp + 2], ax
bsf ecx, esp
xchg ch, ah
rdtsc
jmp 0x4cbe9c
mov dx, word [esp + 0xd]
pop ecx
std
mov dl, 0x7b
xchg word [esp + 5], dx
push word [esp + 9]
jmp 0x4cbf15
lea esp, [esp + 1]
mov ch, byte [esp + 5]
mov byte [esp + 1], cl
jmp 0x4cbe70
add esp, 0
pop ax
bswap ecx
rcl eax, 0x1b
neg ecx
bsf ax, di
jmp 0x4cbf3f
mov ax, word [esp + 3]
mov dword [esp + 6], ecx
mov dh, 0xef
mov dx, si
bswap eax
not ch
jmp 0x4cbeff
mov edx, dword [esp + 7]
rdtsc
pop cx
xchg cx, ax
xchg dx, cx
jmp 0x4cbfd0
mov dl, ch
sete ah
rcl dl, 7
lea ecx, [esi*4]
add cx, di
mov edx, 0x86dd4a36
jmp 0x4cbf29
pop dword [esp]
Function at 0x4cbf9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, dl
bswap ecx
lea edx, [eax + edx]
lea eax, [esi + edi]
jmp 0x4cbfe5
mov dx, sp
xchg ah, al
cmc
inc ecx
xchg dx, ax
xchg dword [esp + 2], eax
jmp 0x4cc680
pop word [esp + 0xe]
rdtsc
pop dx
xor eax, 0xfc6eb198
mov ecx, dword [esp + 0x10]
push word [esp + 0x1f]
jmp 0x4cc0fb
mov dx, word [esp + 0x19]
pop dword [esp + 9]
rdtsc
cld
rdtsc
mov ecx, dword [esp + 1]
jmp 0x4cbff9
dec dx
pushfd
pop dx
call fcn.004cc095
push dword [esp + 1]
clc
add esp, 6
pushfd
neg ax
push dword [esp + 1]
jmp 0x4cc12a
mov ecx, 0xd3e6ce0
mov edx, dword [esp + 8]
mov ax, si
jmp 0x4cc259
sub esp, 3
add esp, 3
pop ecx
mov dl, 0x5a
sub esp, 0x18
mov cx, word [esp + 0x17]
jmp 0x4cc1aa
neg edx
stc
mov cl, ah
xchg byte [esp + 2], al
lea ecx, [edx - 0x4b]
neg al
jmp 0x4cc155
rdtsc
push word [esp + 0xf]
push word [esp + 0x10]
call int.004cc168
mov byte [esp + 3], cl
push dword [esp + 2]
xchg dx, cx
pop dword [esp]
xchg word [esp], cx
xchg dword [esp + 2], ecx
jmp 0x4cc181
xor ecx, 0xc9f65402
pop dword [esp]
clc
mov dword [esp], ecx
std
push word [esp + 3]
jmp 0x4cc1ec
xchg byte [esp + 9], al
lea eax, reloc.MSVCRT.dll_strncpy
pop ecx
push si
pop ecx
mov dx, word [esp + 0x23]
jmp 0x4cc018
mov byte [esp + 1], dh
xchg dword [esp + 0x12], edx
mov word [esp + 8], cx
add esp, 7
rcl dx, cl
pushal
jmp 0x4cc290
lea ecx, [edx + ebp]
pop eax
mov byte [esp + 0xc], bh
rdtsc
stc
xchg cx, ax
jmp 0x4cc2d4
mov al, 0x61
mov dword [esp + 6], edi
xchg byte [esp + 0x14], ah
mov ax, word [esp + 7]
btr ecx, esi
mov ax, word [esp + 0x15]
jmp 0x4cc303
xchg byte [esp + 0xe], dh
bsr edx, edi
mov edx, dword [esp + 0x18]
mov eax, ebx
xchg ecx, edx
rdtsc
jmp 0x4cc46a
push dword [esp + 0x15]
lea esp, [esp + 0x12]
bsr ecx, esi
clc
push word [esp + 2]
mov eax, dword [esp + 0xd]
jmp 0x4cc4de
pop word [esp + 4]
pushal
mov dx, cx
setp al
mov ah, ch
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x4cc630
Function at 0x4cdfc8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov dword [esp + 0xc], esi
push dx
push word [esp + 1]
call fcn.004cdfb2