joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f57e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x4f18dc
push 0xfffffffffffffff0
call dword [0x100e14bc]
cmp ax, 0xffff
jmp 0x497f96
jmp 0x5417c5
call dword [0x100e14c8]
mov edi, dword [0x100e15d0]
jmp 0x4fa795
push 2
jmp 0x521611
push ebp
mov ebp, esp
cmp bl, 0xfb
sub esp, 0x10
cbw
movzx eax, cx
push esi
not ah
mov ax, 0x497b
lea eax, [ebp + 0xc]
jmp 0x50a2ae
lodsd eax, dword [esi]
dec edx
add dword [eax], eax
push 5
jmp 0x52ec7b
push dword [ebp + 8]
jmp 0x4e9f66
sub eax, eax
movzx edi, bx
pop edi
jmp 0x51c3d4
push edi
push eax
jmp 0x4fe2d0
ret 0xc
pop esi
leave
jmp 0x51af95
push esi
jmp 0x4e399f
push dword [ebp + 8]
jmp 0x5417c5
call edi
mov esi, eax
test ebx, 0x69b44756
test esi, esi
je 0x5097d2
push esi
jmp 0x4cf1e5

Function at 0x4f89b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, eax
add dword [edx], eax
add byte [eax + 0x14790ee9], al
add byte [edi], cl
xchg bh, ah
add eax, 0xe88b0016
jmp 0x658fa8
xor byte [eax], cl
jmp 0x4bba4a

Function at 0x505370
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x4ebdd0
cmp byte [ebx], 0xa
jmp 0x506703
mov dword [ebp - 8], ecx
jmp 0x4e05ba
jae 0x69a3c6
cmp eax, ecx
jmp 0x4989d5
and al, 0xfb
cmc
mov byte [ecx], al
cmp cl, 0x48
neg ax
shl ch, cl
mov eax, dword [ebp + 0xc]
movzx cx, dl
movzx ecx, bp
mov ecx, dword [ebp - 8]
test sp, 0x1cb3
mov dword [ebp + 0x10], eax
lea ecx, [ecx + eax]
jmp 0x4e72e8
cmc
neg ch
lea ecx, [eax + esi + 4]
test esi, esp
mov al, byte [eax + esi + 4]
test bh, 0x8c
test al, 0x80
jmp 0x5213f9
jne 0x4ebdd0
or al, 4
jmp 0x4ebdd3
invalid
invalid
je 0x69a3d2
test edx, edx
jmp 0x474a46
out 0x14, eax
mov al, 0x4a
cmp esp, edx
and dword [eax + 0x29a45cb5], esp
sub eax, 0x3a60347e
mov dword [edi], esp
or eax, ebx
out dx, al
test byte [edx - 0x4d], cl
mov bl, 0xa9
invalid
mov bl, 1
aaa
salc
out dx, eax
mov eax, 0x6afe3e99
imul eax, dword [edi - 0x7c], 0xb4590205
mov ebx, 0xc559064b
sbb dh, dl
dec esi
push ss
mov al, 0x41
mov al, 1
mov byte [0x28516b74], al
sbb dl, ch
inc ebp
inc eax
pop edi
ret
jecxz 0x69a34d
out 0x3b, al
shl byte [ecx], 0xc7
sub al, 0x92
mov esi, 0x47622a56
sub ah, byte [edx + 0x47]
jns 0x69a43d
sahf
push ebx
loope 0x69a413
cmp eax, 0x2670d700
sal byte [edx + 0x4b], cl
lea edx, [ecx + 0x38]
add ebx, edi
imul ebp, esi, 0xa729fea7
mov edi, 0x29fcaf25
adc al, 0x27
sahf
xchg ebx, eax
sal esi, 0xcb
or byte [ebp + 0x64], dl
fstp st(6)
inc esi
int3
int3
popfd
loop 0x69a473
dec ebp
xor bl, ch
push 0xffffffffffffffff
sub dword [edx], edi
add dl, byte [ecx - 0x7d6eca4]
push ds
mov dword [ebx], esi
js 0x69a3fd
xchg byte [esi + 6], al
retf 0xc0c8
and al, 0x68
sti
ror byte [edi], cl
sti
adc ebx, dword [ebx + 0x2a7b33b9]
dec ebp
aaa
invalid
Function at 0x50a510
Capabilities:
Execute anti-debugging instructions

Disassembly:
add cl, ch
insd dword es:[edi], dx
clc
sbb eax, 0x45850f00
ret 0x1f
push 0xffffffffffffffff
lahf
cmovg edx, eax
push 0x100de018
mov eax, dword fs:[0]
mov dx, si
movsx edx, cx
push eax
bswap eax
seto dl
mov dword fs:[0], esp
push ecx
cmovns eax, eax
mov eax, dword [0x101813dc]
push esi
mov dl, ah
push edi
mov dword [esp + 8], eax
setge ah
xchg cl, dl
movzx dx, cl
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
cbw
push ecx
movsx eax, bp
lahf
push edx
lea eax, [esp + 0x10]
push 0x101766c0
jmp 0x614b2a
jne 0x614b2c
nop
nop
nop
mov eax, 5
and bl, 0xa5
cpuid
test si, bp
cmp ecx, 0x4bcf30f8
lea eax, [eax - 0x66989622]
lea ecx, [ecx + 0x66c9cabe]
cmp ax, sp
jmp 0x60e568
jne 0x60974a
nop
bts dx, di
cdq
bt ax, bp
nop
nop
movzx ax, cl
nop
sal dx, 0x7c
rdtsc
clc
cmp eax, 0x75290933
jmp 0x60ee9e
jne 0x60e595
nop
movzx eax, cx
nop
btc dx, 0x77
cmovbe ax, di
nop
shrd edx, ebx, 0x39
nop
shld edx, ebp, 0xfd
rdtsc
test ebp, ecx
cmp eax, 0x61816123
jmp 0x5f07aa
cmp eax, ecx
jne 0x5d418b
nop
add cx, 0x6c3e
nop
cwde
rol ch, cl
nop
xor ch, 0x51
sbb cx, dx
xadd ecx, ecx
nop
adc eax, eax
bts cx, bx
shr cl, 0x4f
nop
not cx
shl ax, cl
mov eax, 0x23749382
test ecx, 0x5fd709ee
rol cx, 0x3c
add ch, 7
mov ecx, 0x36342202
jmp 0x62411e
jne 0x5f07c5
nop
cwd
nop
or edx, esp
nop
btr ax, dx
rdtsc
test ebp, 0x15ad5f62
cmp bp, 0x86d
clc
cmp eax, 0x8694853
jmp 0x621992
mov esp, 0x2982b8c3
adc dword [eax], ebp
mov eax, 0x28112982
sar ch, cl
add cl, ah
mov ecx, 0x51595702
cmp eax, ecx
jmp 0x5d4182
jne 0x6219a4
nop
nop
bt ecx, edi
btc cx, 0xfb
nop
test sp, 0x2f89
nop
nop
nop
shrd eax, ecx, 0x56
mov eax, 0x36461593
or cl, 0x3d
bts ecx, ebx
movsx ecx, si
mov ecx, 0x60045411
cmc
cmp eax, ecx
jne 0x61f8cb
nop
bt bp, bx
xadd bp, bp
bts ebp, ecx
nop
test di, 0x2395
dec bp
nop
nop
mov ebp, 0x93411231
mov esp, 0x8815151
cmp ebp, esp
jmp 0x498a0e
jne 0x60eeaf
nop
nop
neg dh
nop
cwd
sar eax, 0x97
or edx, ebp
rdtsc
cmc
test sp, 0x3147
cmp bp, 0x76bb
cmp edx, 0x33068673
jmp 0x61f8ae
add eax, ecx
cmp eax, ecx
jmp 0x60972c
Function at 0x515afb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 4]
jmp 0x627b89
add eax, 0xba0f7292
clc
mov edi, 0x310f9090

Function at 0x517400
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
cmc
cmp edi, edi
test dh, 0xf6
sub esp, 0x18
jmp 0x6079ea
and eax, 0x5055ffff
mov ecx, esi
call fcn.005d824c
mov edi, eax
mov cx, bp
mov ecx, 0x53555b5
not cx
mov ecx, dword [esp + 0x18]
push ecx
bswap cx
mov ecx, esi
call fcn.00612210
mov ecx, esi
jmp 0x4976ea

Function at 0x524b6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add al, byte [ebx - 0x397c003d]
add dword [ebx + 0x404f01c5], eax
mov ebx, dword [ebp - 4]
jmp 0x4d45f4
pop esp
add al, byte [eax]
add cl, ch
fdivr st(7)
adc eax, 0x38ae900
add eax, 0x451fe900
adc eax, 0x24a48d00
aam 0xfb
invalid
push 0x101689f8
jmp 0x6121ee
push dword [ebp + 8]
jmp 0x500b41
jne 0x609f0a
push dword [ebp + 0x18]
jmp 0x533168
sub al, 0xe9
out 0x6a, eax
idiv edi
push dword [ecx + 0x1c]
jmp 0x60f5f1
push dword [ebp + 0xc]
jmp 0x4e648a
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x38]
test eax, eax
jmp 0x4f4ee9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
jmp 0x506dcd
je 0x6482ef
mov edx, dword [esp + 0x20]
mov ah, bh
mov eax, edi
cmp edx, 0x170254a3
movsx cx, bl
sub eax, esi
ror ch, 0xb2
sub ch, dh
cmp bp, 0x5dfc
mov ecx, edi
sub ecx, eax
test bx, ax
cmp bp, 0x55dd
push 1
jmp 0x4cb9ed
dec dword [ebx - 0x74dbdbbc]
push esp
and al, 0x1c
ror si, 0xd3
cmc
and esi, 0x14bf4786
mov esi, eax
cmp ebp, 0x6581c51
sub esi, edx
cmp edi, eax
jmp 0x5e35a3
shld ax, dx, 0xc0
cwde
rol eax, cl
lea eax, [esp + 0x10]
shl ecx, 8
clc
test di, 0x3f5a
cmp eax, esi
push eax
add ecx, edx
push edi
push esi
jmp 0x4a7914
and ecx, 3
btr ebx, 0xa9
sar bl, cl
xor eax, eax
rep movsb byte es:[edi], byte [esi]
cmovnp bx, dx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
bswap edi
jmp 0x65a6e8
sub edi, esi
jmp 0x4fc79c
mov esp, ebp
jmp 0x4cd93b
pop edi
cmovo ebx, esi
mov ebx, 0x2da343ea
pop esi
pop ebx
jmp 0x64e340

Function at 0x527ff2
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov byte [ecx - 0x54d3710a], 0x41
jmp 0x666c9d
add al, 0x66
neg edi
cmp sp, 0xf84
mov esi, dword [ebx]
and edi, edi
shl ecx, 2
adc edi, ebx
sbb edi, 0x36731b2
sbb di, bx
mov dword [esp + 0x18], eax
sub edi, ebp
sal di, 0x98
mov edi, eax
mov eax, ecx
stc
shr ecx, 2
jmp 0x4c2599

Function at 0x528574
Capabilities:
Execute anti-debugging instructions

Disassembly:
bound eax, qword [eax - 0xd8a6b8d]
jmp 0x60e8c1
mov dword [esp + 0x10], eax
jmp 0x49fb83
jmp 0x623d8b
inc eax
cmc
cmp eax, ebp
jmp 0x5f43ff
call fcn.0061cdde
mov edi, eax
bswap eax
mov eax, dword [esp + 0x10]
jmp 0x61defd
Function at 0x529cea
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006543a8
add esp, 4
not esi
pop esi
ret
mov dword [ecx + eax - 4], 0x100aeb50
jl 0x517993
mov edx, dword [esi + 0x1b4]
movsx eax, bp
movzx eax, si
lahf
push esi
cbw
mov dword [edx + 0x10], 0x100ae830
mov eax, dword [esi + 0x1b4]
jmp 0x4d50ab
mov dword [eax + 0x48], 0x100aea10
jmp 0x478a7f
adc byte [ecx - 0x16e7dbac], cl
dec ebp
xor edx, dword [ebx]
add byte [ecx - 0x16cfdbbc], cl
fdiv qword [eax + 0x18]
add byte [edx - 0x75], dl
push esp
and al, 0x24
jmp 0x6436bd
add al, 0
push edi
sete ch
movzx ecx, bp
cmovl cx, si
mov ecx, esi
jmp 0x603799
add byte [esi - 0x7b], ah
out 0x83, eax
clc
push eax
cmp eax, 0x50
jmp 0x4d34c3
mov dword [esi + 4], eax
jmp 0x69a4e2
inc esp
sbb al, byte [eax]
mov dword [esi], eax
jmp 0x4f1aa3
mov ecx, dword [esi + 0x1b4]
test esp, 0x630e630a
cmp ax, 0x64fb
test ch, al
lea eax, [eax + 4]
jmp 0x4ec4e4
jmp 0x5316bb
push esi
mov esi, ecx
jmp 0x60ac33
and edx, 0xff
jmp 0x662c19
sub edx, edx
cmp ch, 0x54
clc
test edi, edi
jmp 0x660602
call fcn.00634c1a
mov ebx, eax
cmc
add esp, 8
cmp si, 0x72aa
test ebx, ebx
jmp 0x6164c5
add byte [ecx + 0x113fe906], cl
out dx, al
inc dword [edi - 0x17]
cmp eax, 0x9000046d
nop
nop
nop
nop
test edx, 0x5b0b0501
cmp dl, 0xdc
nop
clc
test bp, cx
test si, 0x296f
nop
clc
nop
test eax, 0x223f50e8
cmc
xor ebx, 0x462d28
cmc
cmp ax, sp
jmp 0x6196c9
nop
jmp 0x4f34c9
out 0xff, eax
add byte [eax], al
add byte [ebp + 0xbd04], cl
add byte [eax], al
jmp 0x642735
jne 0x5f31df
push 0x1017d638
push ebp
call fcn.004f82bb
lea esp, [esp + 8]
cmp esi, 0x6cb94c91
pop edi
rcr bl, 0xce
pop esi
pop ebp
jmp 0x655f62
xor edi, 0x23ffd1fa
stc
test edi, ecx
xor edi, 0x7e26937e
cmp si, 0x105d
stc
cmp eax, esp
nop
test bp, 0x1154
clc
nop
nop
cmc
cmp di, 0x526e
stc
nop
sub ecx, 6
dec edi
jmp 0x607908
mov ecx, dword [esp + 0x18]
movsx edx, ax
bt edx, ebp
mov edx, dword [esp + 0x1c]
rol ax, 0x50
add al, ah
mov eax, dword [esp + 0x30]
push ebx
push ecx
rcr cl, 0x68
mov ecx, dword [esp + 0x30]
test cx, bx
jmp 0x5d9e2f
push eax
jmp 0x650abd
rol byte [ebx - 0x16fb0383], 1
jge 0x6436bb
add al, 0xe9
mov byte [eax - 1], al
nop
jmp 0x4d587e
push ebp
jmp 0x5f6585
pop ebx
add esp, 0x14
jmp 0x4ec4e0
jle 0x639e38
mov ecx, ebx
nop
mov eax, dword [esp + 0x14]
jmp 0x662499
inc esi
clc
cmc
test dx, cx
cmp esi, eax
jmp fcn.004b14fa
push edi
push edx
mov dx, sp
cmovnp dx, ax
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x40]
jmp 0x4d5436
invalid

Function at 0x52eb6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x6138f2
push esi
mov esi, ecx
jmp 0x50d672
out dx, al
mov ch, 0
add byte [edi], cl
mov word [ecx + 0xf000201], ds
invalid
Function at 0x5314b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sal dl, cl
lea esp, [esp - 8]
btc eax, 0x6f
mov eax, dword [ebp + 0x10]
setno dl
push ebx
add dl, 0x47
rol dl, cl
push esi
rcl esi, 0x4b
push edi
mov cl, byte [eax + 0x100]
rcr esi, 0xfe
mov dl, byte [eax + 0x101]
sal edi, 0x49
shld esi, edx, 0xa5
dec edi
mov dword [ebp - 8], eax
or di, 0xdad
test di, sp
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
bswap cx
or di, dx
sar cl, 0x90
xor ebx, ebx
mov bl, byte [ebp - 1]
sub edx, edx
bts ecx, edi
mov dl, byte [ebp - 2]
and edi, 0x4b447731
mov esi, dword [ebp - 8]
cmc
mov edi, dword [ebp + 8]
shrd ecx, edx, 0xaf
sal cx, 0xe4
sub eax, eax
and ecx, ebp
shl ch, cl
or ch, bh
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jmp 0x65540a
pop ebx
add ah, byte [esi - 0x57]
aam 0x69
add esi, 0x20
cmp esp, edx
test bp, 0x618f
cmp edi, eax
jmp 0x49caca
Function at 0x53d30b
Capabilities:
Execute anti-debugging instructions

Disassembly:
iretd
jmp 0x51f38b
add bh, bh
jne 0x4efa34
jmp 0x6062c2
mov dword [0x64568bf2], eax
sub edx, ecx
jmp 0x510c64
call fcn.004d9343
add esp, 0x2c
jmp 0x53f7e1
inc esp
and al, 0x30
mov dword [esp + 0x34], eax
jmp 0x4f2266
xchg dword [ebx + 0x14], eax
add byte [ebx - 0x4616d7ad], cl
and al, byte [edx]
add byte [eax - 0x17], al
sbb dword [ebp - 0x7aa6ffec], 0xffffffc0
jmp 0x511f93
push edx
jmp 0x65f3dd
add al, 0x89
dec esp
and al, 0x3c
and al, dl
jmp 0x62813b
je 0x68c610
push 1
push edi
jmp 0x60b1ce
push ebx
jmp 0x618f5b
jmp 0x6106f8
ret
mov esp, ebp
cmova bp, bx
jmp 0x5f9528
mov dl, byte [eax - 1]
test bp, di
stc
mov cl, byte [eax]
cmc
clc
lea eax, [eax + 4]
cmp di, bx
cmp ch, 0x14
shl ecx, 8
clc
test ebp, 0x77374f4e
cmp ecx, 0x6cc15d92
or ecx, edx
sub edx, edx
dec dl
mov dl, byte [eax - 6]
cmc
add esi, 4
test ebp, 0x51b48e0
stc
shl ecx, 8
test bl, 0xc6
or ecx, edx
test ax, bp
mov dword [esi - 4], ecx
lea ecx, [edi + eax]
cmp ecx, ebp
jmp 0x6104cd
pop ebp
jmp 0x50b0aa
cdq
invalid
jmp 0x4b8e09
jb 0x610708
pop edi
pop esi
pop ebp
jmp 0x511f3a
cwde
btr di, 0xa1
mov edi, 0xfffffffe
lea eax, [ecx + 2]
sub edi, ecx
xor ecx, ecx
not cl
sub edx, edx
mov ch, byte [eax + 1]
shl dl, cl
jmp 0x5f1506
bt eax, 0x89
mov eax, dword [ebp - 0x15c]
cmp si, bp
cmp ecx, eax
jb 0x4fee24
lea edx, [ebp - 0x1d0]
jmp 0x49d80f
fmul qword [0x10161998]
jmp 0x636f7b
sbb dword [esi], edx
adc byte [ebp - 0xfba2225], al
add esp, 0xc
jmp 0x6551af
fnstsw ax
jle 0x64efe3
fld qword [ebp - 8]
test si, 0x3420
test ah, 1
jmp 0x4efa24
fdivp st(1)
jmp 0x5d0ee7
fld qword [ebp - 8]
cmp si, bx
stc
test ah, 1
je 0x61984d
fchs
jmp 0x61984d
fnstsw ax
test ah, 1
jne 0x6551c6
fadd qword [0x101619a8]
mov bx, di
cmp di, ax
fld dword [ebp + 8]
adc bx, ax
fcomp dword [0x10161988]
btr bx, 0xcf
test esi, esi
mov si, 0x688c
movzx ebx, si
pop esi
mov ebx, 0x597d1355
bswap ebx
pop ebx
jmp 0x62e103
mov eax, 0x28112982
mov cx, 0x4079
movzx cx, bl
mov ecx, 0x51595702
push ecx
cmp sp, dx
clc
cmp eax, ecx
jne 0x65f3cc
nop
movzx bx, bh
sar al, 0x3b
rol eax, 0xa5
nop
movsx ebx, bp
nop
bsf dx, dx
not ch
mov eax, 5
cmp ch, 0x7e
bts bx, sp
xchg bx, bx
cpuid
stc
cmp esp, ebx
cmp esp, 0x1a56705e
lea eax, [eax - 0x66989622]
lea ecx, [ecx + 0x66c9cabe]
stc
cmc
cmp eax, ecx
jmp 0x4e0241

Function at 0x53db00
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, 0x83c03390
rol byte [ecx], 0x3d
pushal
add byte [edi + 0x38], al
push esi
mov esi, ecx
xadd ecx, ecx
sub eax, eax
push edi
mov ecx, dword [esi + 4]
btc di, 0x74
mov edi, dword [0x100e1140]
test si, 0x569d
jmp 0x611812
clc
cmp bh, al
mov dword [ebx + 0x1c], ebp
bt ebp, esp
stc
mov dword [ebx + 0x20], edx
test edi, 0x26246eb
mov edx, dword [esp + 0x14]
mov ebp, dword [esi]
mov dword [esi + 4], edx
movsx edx, di
mov edx, edi
stc
clc
jmp 0x4b6262
Function at 0x541fc4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
ret
jne 0x4ea2a1
mov eax, dword [esi + 0x1c]
test eax, eax
jmp 0x61112f
push esi
not al
mov esi, edi
mov esi, ecx
cbw
movzx eax, bp
lahf
lea eax, [esi + 0x20]
jmp 0x53340d
push eax
call dword [0x100e1184]
test eax, eax
jmp 0x5064a5
jmp 0x52c463

Function at 0x548def
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40eb8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x30], 0x48
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x2d], 0x70
mov byte [ebp - 0x2c], 0x46
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x40], 0x4b
mov byte [ebp - 0x3f], 0x45
mov byte [ebp - 0x3e], 0x52
mov byte [ebp - 0x3d], 0x4e
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x4c
mov byte [ebp - 0x3a], 0x33
mov byte [ebp - 0x39], 0x32
mov byte [ebp - 0x38], 0x2e
mov byte [ebp - 0x37], 0x64
mov byte [ebp - 0x36], 0x6c
mov byte [ebp - 0x35], 0x6c
mov byte [ebp - 0x34], 0
push 0x45adc8
push 0x45add4
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x48
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
push ecx
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x24], eax
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x548f01
mov dword [ebp - 0x48], 0x63
push 0x410070
lea eax, [ebp - 0x48]
push eax
call fcn.0054ab27
jmp 0x548f1a
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x549554
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40eba8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x48], 0x4b
mov byte [ebp - 0x47], 0x45
mov byte [ebp - 0x46], 0x52
mov byte [ebp - 0x45], 0x4e
mov byte [ebp - 0x44], 0x45
mov byte [ebp - 0x43], 0x4c
mov byte [ebp - 0x42], 0x33
mov byte [ebp - 0x41], 0x32
mov byte [ebp - 0x40], 0x2e
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], 0x6c
mov byte [ebp - 0x3d], 0x6c
mov byte [ebp - 0x3c], 0
mov byte [ebp - 0x30], 0x56
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x75
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x41
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0
push 0x45ae88
push 0x45ae98
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x20], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
lea ecx, [eax + ecx + 0x18]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x549644
mov dword [ebp - 0x4c], 0x50
push 0x410070
lea eax, [ebp - 0x4c]
push eax
call fcn.0054ab27
jmp 0x54975d
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x549775
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ebb2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x45aea8
push 0x45aeb4
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
mov byte [ebp - 0x30], 0x56
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x75
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x50
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0
push 0x45aec4
push 0x45aed4
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x18]
mov dword [ebp - 0x18], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x549851
mov dword [ebp - 0x4c], 0x40
push 0x410070
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0054ab27
jmp 0x5499b3
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x549fc7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ebda
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x45aee4
push 0x45aef0
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x40], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov byte [ebp - 0x3c], 0x4b
mov byte [ebp - 0x3b], 0x45
mov byte [ebp - 0x3a], 0x52
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x4c
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x6c
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x75
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x20], eax
push 0x45af00
push 0x45af10
call dword [0x40f004]
push eax
call dword [section.Unlockn__1]
mov dword [ebp - 0x24], eax
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
nop
nop
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x54a0d3
mov dword [ebp - 0x48], 0x44
push 0x410070
lea ecx, [ebp - 0x48]
push ecx
call fcn.0054ab27
jmp 0x54a1af
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5cee06
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor byte [edx + 0x4447748], 0x40
sbb al, 0x5e
scasd eax, dword es:[edi]
sahf
aaa
or eax, 0x24673d27
jb 0x43f2e2
sub edx, dword [esi]
nop
test dword [ebx + 0x5e], ecx
inc edi
rcr byte [edx + 0x4f43940c], 0x58
pop ss
mov ebp, gs
stosd dword es:[edi], eax
enter 0xffffffffffff8ab4, 0x1a
enter 0xfffffffffffffb9d, 0xffffffffffffffad
pushal
pop ds
jo 0x43f300
inc ecx
mov dh, 0x83
invalid
ljmp 0xbeaf:0xca843b99
not dword [edi - 0x72764cdc]
xor al, byte [eax + 0x6e3ee278]
cmp cl, ch
push cs
pop es
add dword [edi + esi], esp
mov esi, 0x35e034f9
jg 0x43f31c
cmp al, 0x76
cmp cl, bl
sbb byte [esi + ebp*8 - 0x74], cl
sub eax, dword [ebp - 0x2f57fed0]
clc
and eax, 0x9b1951ec
mov dl, 0xf2
cmp byte [esi + 0x62177fc3], cl
stosb byte es:[edi], al
loopne 0x43f2ca
bound ebp, qword [edx - 0x432c3920]
adc al, 0xc2
cvtps2pd xmm4, qword [edi + 0x4b]
sar dword [esp + edx + 0x675a0fc2], cl
dec ebx
daa
invalid
jo 0x43f2c1
mov ah, 0x32
xchg edi, eax
fild qword [eax]
mov ecx, esp
or dword [eax - 0x76], edi
push eax
sbb al, 0x21
loopne 0x43f339
aaa
je 0x43f393
pop esp
call [ecx - 0x29]
sbb al, 0xfd
invalid
inc ecx
mov ch, 0x65
std
scasb al, byte es:[edi]
arpl bp, si
xchg dword [ebx], edi
xchg esi, eax
fcomp dword ss:[ebp + 0x2a15133d]
mov cl, 0x26
add dword [0x68698e82], esi
adc edx, dword [0x126b12a]
xor eax, 0x68698e82
movsd dword es:[edi], dword [esi]
sbb eax, 0x3e94c2f3
das
pop ecx
cwde
xchg esp, eax
dec edi
invalid
push edi
pop eax
sahf
js 0x43f347
mov edx, ebx
popfd
sub al, ch
invalid
jmp 0x2124104
adc al, 0
mov byte [esi + 0x162], 1
jmp 0x63fd8c
push esi
mov esi, ecx
mov eax, dword [esi]
shl cx, 5
not cl
movzx ecx, bx
lea ecx, [eax - 0xc]
stc
cmp ecx, dword [0x101813e0]
je 0x43f282
add eax, 0xfffffff4
jmp 0x665766
mov ecx, dword [eax + 0x14]
call dword [ecx + 0x10]
add esp, 8
bts eax, eax
pop edi
xor al, ch
pop esi
xchg bx, bx
pop ebp
btc ax, 0x91
xadd al, bl
neg ebx
mov eax, 1
bsr ebx, esp
btc ebx, 0x99
pop ebx
test esi, 0x6a2c4ea6
add esp, 0x10
jmp 0x4abd29
mov dword [ebx + 4], esi
jle 0x607c2d
mov eax, dword [esp + 0x24]
push ebp
xchg ch, cl
mov cx, sp
push eax
movzx ecx, ax
jmp 0x607c21
test ebp, ebp
mov dword [ebx], edi
jmp 0x608b20
jmp 0x617b8d
and eax, 0x88f8ffe0
test dword [eax], ebp
add dword [eax], eax
add cl, al
in eax, 0x42
mov ebp, dword [esp + 0x18]
test bp, 0x1858
stc
add esp, 8
jmp 0x61fb75
push eax
jmp 0x50062e

Function at 0x5d03ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ds
add byte [eax], 0
add byte [eax], al
mov eax, 0x100e0ac4
jmp 0x662c4a
call fcn.004eac6a
push ecx
jmp 0x4c6979