joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445900
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x445933
push esi
call fcn.00448a00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44592c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4459b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4459a2
mov eax, dword [esi + 8]
test eax, eax
je 0x445957
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44599e
cmp eax, 2
je 0x4459a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44594a
cmp eax, 3
je 0x44597d
cmp eax, 1
jne 0x44594a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44594a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44594a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004459e0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4459c8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004459e0
add esp, 4
pop esi
ret
Function at 0x4522a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00451e50
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00451ed0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00451ed0
lea ecx, [esi + 0xc]
call fcn.00463fde
lea ecx, [esi + 0x10]
call fcn.00463fde
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00453460
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00453460
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00453460
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00464053
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00464053
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x60251c
Capabilities:
Encode data using xor

Disassembly:
inc edi
mov dl, 0x1b
sbb ebp, dword [edi + 0x30c1a630]
xchg dword [eax + ebx*4], eax
sbb ebp, dword [edi + 0x30c1a630]
xchg dword [eax + ebx*4], eax
push cs
imul ebx, dword [eax - 0x66f669cf], 0xd8be0bf8
jp 0x60251a
invalid

Function at 0x6048f0
Capabilities:
Encode data using xor

Disassembly:
in al, 0x7a
sbb eax, 0x6ffc04ec
call [edx - 0x3fa52f97]
pop edx
rcl byte [esi + 0x31], 0xc0
pop edx
rcl byte [esi + 0x31], 0xc0
xor dword [ecx - 6], esp
push 0x484cfa0f
rol byte [esi + 0x21], 1
sar byte [ecx - 0x22], 1
inc ebp
aad 0xbc
dec edi
add al, 0x9a
or byte [edi - 0x66], ch
xor edx, dword [0x8a7f188a]
cmp eax, 0xc7a032ae
xor bl, byte [ebx - 0x4e29bf23]
inc eax
idiv dword [esi + ebx*4]
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
and dword [ebp + ecx*8 + 0x5d], ebp
and al, 0xd7
push edx
sub al, 0xae
cmp al, 0x5b
mov dh, 0x62
scasb al, byte es:[edi]
xor esp, dword [ebx + 0x76d535c6]
mul byte [ebx + eax - 2]
pop ds
sub ebp, dword [edx + 0x48aa5f38]
xor al, 0xb2
and byte [edi - 0x4e], al
pop ebx
pop ds
cwde
push cs
imul ebx, dword [eax + 0x1a840078], 0x32628c7d
mov ch, 0x25
dec esp
mov edi, 0x127cf654
jne 0x6048e5
sbb al, 0x95
xchg ebp, eax
add eax, 0x3a3a9f6c
mov dl, 0x20
inc edi
mov dl, 0x79
cmpsd dword [esi], dword es:[edi]
mov esp, 0xf0d836db
jle 0x604963
mov eax, dword [esi + 0x2ab43b62]
dec ebp
mov esp, 0xae38b45e
leave
cmp cl, dl
mov al, byte [0xf90ffc95]
pop esi
int3

Function at 0x605a3e
Capabilities:
Encode data using xor

Disassembly:
cmp dh, byte [edx + ebp + 0x3358bc4d]
mov esp, 0x26c43552
xor byte [edx + edx*2 - 0x18d23bcb], bh
push edx
xor eax, 0x6ae72dc4
clc
push edx
xor eax, 0x6ae72dc4
clc
lahf
push 0xffffffffffffff9e
or bl, byte [eax + 0x7098690e]
jae 0x605a30
jbe 0x605a63
loopne 0x605a69
mov dh, 0x26
mov ah, 0xd3
mov dword cs:[ebx + eax - 0x6d], ebp
test byte [0x28ba2cc0], 0x4f
dec edi
mov edx, 0xb121b458
shl byte [ebx], 1
retf
Function at 0x606ace
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x8c12b744
and esi, dword [ebx - 0x2e1fda2a]
inc ebp
aad 0xbc
dec edi
scasd eax, dword es:[edi]
les edx, [ecx - 0x3f]
mov al, byte [0xe470bb53]
jp 0x606b05
in al, 0x7a
sbb eax, 0x6ffc04ec
in al, dx
add al, 0xfc
outsd dx, dword [esi]
call [edx - 0x3fa52f97]
push esi
xor eax, eax
xor dword [ecx - 6], esp
push 0x484cfa0f
rol byte [esi + 0x21], 1
sar byte [ecx - 0x22], 1
inc ebp
aad 0xbc
dec edi
add al, 0x9a
mov esp, 0x9a04f24f
or byte [edi - 0x66], ch
xor edx, dword [0x8a7f188a]
cmp eax, 0xc7a032ae
xor bl, byte [ebx - 0x4e29bf23]
inc eax
idiv dword [esi + ebx*4]
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
and dword [ebp + ecx*8 + 0x5d], ebp
and al, 0xd7
push edx
sub al, 0xae
cmp al, 0x5b
mov dh, 0x62
scasb al, byte es:[edi]
xor esp, dword [ebx + 0x76d535c6]
mul byte [ebx + eax - 2]
pop ds
sub ebp, dword [edx + 0x48aa5f38]
xor al, 0xb2
and byte [edi - 0x4e], al
pop ebx
pop ds
cwde
push cs
imul ebx, dword [eax + 0x1a840078], 0x32628c7d
mov ch, 0x25
dec esp
mov edi, 0x127cf654
jne 0x606ae5
sbb al, 0x95
xchg ebp, eax
add eax, 0x3a3a9f6c
mov dl, 0x20
inc edi
mov dl, 0x79
cmpsd dword [esi], dword es:[edi]
mov esp, 0xf0d836db
jle 0x606b63
mov eax, dword [esi + 0x2ab43b62]
dec ebp
mov esp, 0xae38b45e
leave
cmp cl, dl
mov al, byte [0xf90ffc95]
pop esi
int3
Function at 0x62e0d5
Capabilities:
Encode data using xor

Disassembly:
call 0x1e4af996
into
pop esi
int3
pop esp
xchg ebp, eax
xchg bh, ah
jo 0x62e013
xor dword [eax - 0x66], 0x8bec7eea
xchg byte [esi + 0x68], ch
add edx, dword [ebx - 0x585bfa0a]
cmpsd dword [esi], dword es:[edi]
inc ebx
sal dword [esi + 0x1980b245], cl
mov eax, ebp
sbb ebp, dword [edi + 0x1a7fef71]
jmp 0x582a38af
sub eax, 0xb65b3cae
push eax
imul ebp, edi, 0x16e91a7f
aaa
mov dh, 0x24
inc ebx
mov esi, 0x69f97d5c
or bl, bh
adc byte [ecx], bh
mov esi, 0x26c64b2c
call 0x74e8c30d
lcall 0xb158, 0xa9ce58dd
dec ecx
rcl dword [ecx + 0x30], 0xc3
invalid
insb byte es:[edi], dx
loop 0x62e025
je 0x62e03c
fstp qword [eax - 0x32]
test eax, 0xc149b158
push ecx
xor bl, al
and esi, eax
jns 0x62e09a
mov byte [ebx - 0x22], bh
mov ah, 0x3c
sal byte [ebp + 0x1a938f44], cl
mov bh, ch
sbb dh, ah
mov dl, 0x3c
sal byte [ebp + 0x1e91a044], cl
mov ebx, gs
les esi, es:[ecx + 0x45b6d343]
stosb byte es:[edi], al
push ds
xchg ecx, eax
add dword [eax - 0x6d], esp
pushal
xchg ebx, eax
jmp 0x62e0f1
pushal
xchg ebx, eax
add eax, 0x9f6c0595
jne 0x62e07e
add eax, 0x9f759f6c
or al, 0x82
in eax, 0x14
loope 0x62e140
leave
pop ecx
cmp bl, cl
outsb dx, byte [esi]
xchg byte [0xde1fec85], dl
jle 0x62e0da
call 0xb4afa74
scasd eax, dword es:[edi]
aas
jle 0x62e10d
call 0x40121f03
pop edx
test eax, 0xca54c05d
lodsd eax, dword [esi]
pop esp
mov ah, 0xe9
jl 0x62e117
jne 0x62e08b
and esp, dword [esi]
mov esp, 0x35c43552
fimul word [ebx - 0x25]
mov esi, 0x7ce4fd4d
xor eax, 0xbedb4bde
dec ebp
std
in al, 0x7c
dec ebx
fstp xword [esi + 0x7ce4fd4d]
adc dh, byte [ebp - 0x7c]
jne 0x62e09d
sub eax, 0xaecb5bcc
pop ebp
in al, 0xe0
jle 0x62e10f
mov eax, dword [esi - 0x1d930cd1]
test dword [ebx + eax*8 - 0x48], esi
and al, 0xba
invalid
dec esp
ret 0x54a5
push esp
rcl ecx, cl
jb 0x62e121
loopne 0x62e0c9
xchg dword [edx - 0xb], esi
jb 0x62e139
je 0x62e13c
add edi, esi
sub bl, byte [ebx*4 + 0x43a7540d]
mov bh, 0x35
movsd dword es:[edi], dword [esi]
int3

Function at 0x63112b
Capabilities:
Encode data using xor

Disassembly:
push eax
aaa
ret 0x382b
mov ebp, 0x25c7342d
rol byte [edx + ebx*8 - 0x43], 0x4c
mov byte [0x540d9d1a], al
cmpsd dword [esi], dword es:[edi]
dec esp
sti
ja 0x631126
xor byte [ecx - 0x63], 0xd8
push ecx
shl dword [eax - 0x38b609ad], 0x57
xor al, cl
add al, 0x32
mov ecx, 0x57bb4829
xor bh, byte [ecx + 0x57bb4829]
sub ah, byte [edx + edi - 0x15b753a3]
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
mov dword [edi], esi
mov ecx, 0x50bb4829
cli
jne 0x63114e
invalid
Function at 0x40f877
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040fa27
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40f975
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40f918
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40f95b
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40f92f
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40f94a
test al, 0x40
je 0x40f941
mov ecx, dword [edi + 0x20]
jmp 0x40f948
test al, 0x80
je 0x40f95b
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40f95b
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40f8e7
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x42d3f0
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x420]
lea edi, [esi + 0x420]
test eax, eax
jne 0x42d422
lea eax, [esi + 0x424]
push eax
push edi
push 0x4c9f70
push 0
call fcn.006033db
jb 0x42d46a
call fcn.00436550
add esp, 0x10
mov edx, dword [esp + 0xc]
mov ecx, dword [edi]
pop edi
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x424]
pop esi
mov dword [ecx], eax
ret 8
Function at 0x4369d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4e0e50]
xor edx, edx
cmp eax, edx
jne 0x4369f6
xor eax, eax
mov byte [eax + 0x4e0d50], al
inc eax
cmp eax, 0x100
jl 0x4369de
mov dword [0x4e0e50], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4e0d50
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x436a87
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x436a5a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x436a28
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x436b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x436b53
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x436b3a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b4b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48c808
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x44b4e9
inc eax
mov dword [esi + 0x10], eax
jmp 0x44b5fc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x44b4fd
mov eax, 0xffffffc7
jmp 0x44b5fe
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x44b50e
cmp dword [esi + 8], eax
jne 0x44b4fd
cmp dword [esi + 8], eax
jne 0x44b527
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x44b527
mov eax, 0xffffffc7
jmp 0x44b5fe
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x44b53b
push eax
mov ecx, ebx
call fcn.0044ace0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00418560
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x44b56c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call int.00418580
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0044a450
test eax, eax
mov dword [esp + 0x38], eax
je 0x44b59f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b4208
call fcn.00418760
mov eax, dword [esp + 0x38]
jmp 0x44b5fe
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0044b310
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x44b5e3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0044b330
mov esi, eax
test esi, esi
jne 0x44b613
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0044b310
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x44b5b5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b4208
call fcn.00418760
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b4208
call fcn.00418760
mov eax, esi
jmp 0x44b5fe
Function at 0x457e10
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x457e43
push esi
call fcn.0045af00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x457e3c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x457ec9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x457eb2
mov eax, dword [esi + 8]
test eax, eax
je 0x457e67
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x457eae
cmp eax, 2
je 0x457eb2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x457e5a
cmp eax, 3
je 0x457e8d
cmp eax, 1
jne 0x457e5a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x457e5a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x457e5a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00457ef0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x457ed8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00457ef0
add esp, 4
pop esi
ret

Function at 0x5bbf01
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
jmp 0x5bbf0b
jmp 0x5ee870
lea esp, [esp + 0x20]
mov dword [eax + 0x10], 0x98badcfe
push esp
mov word [esp], dx
lea esp, [esp + 1]
jmp 0x5ee846
mov dword [eax + 0xc], 0xefcdab89
pushal
push word [esp + 5]
lea esp, [esp + 2]
jmp 0x5ee79a
mov dword [eax], 0
pushal
lea esp, [esp + 0x20]
mov dword [eax + 8], 0x67452301
jmp 0x5ee7b5
lea esp, [esp + 0x20]
ret
lea esp, [esp + 3]
mov dword [eax + 0x14], 0x10325476
pushal
mov word [esp + 0xc], sp
jmp 0x5ee815
mov dword [eax + 4], 0
pushal
mov word [esp + 0x18], di
lea esp, [esp + 0x20]
jmp 0x5ee7da

Function at 0x5c7d96
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x5c7e01
xchg dword [esp], eax
call fcn.005c7de7

Function at 0x5c809e
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ebp, ebx
mov edx, 0xa7a44200
mov cx, word [esp]
jmp 0x5c848e
lea esp, [esp + 1]
push word [esp + 1]
lea esp, [esp + 2]
push word [esp]
jmp 0x5c8117
lea esp, [esp + 1]
lea ebx, [ebx - 0x7e]
push edx
pop word [esp]
lea esp, [esp + 1]
lea esp, [esp]
call fcn.005c80f6
jne 0x5c8053
btc ebp, ebx
mov edx, 0xa7a44200
jmp 0x5c934f
btr ebp, esp
lea esi, [esp]
mov ecx, 0x248cc278
sub esp, 0x1c
jmp 0x5c818d
jmp 0x5c81d0
mov edi, dword [esp + 0x28]
lea ebp, [edi*4]
mov bp, sp
neg esi
jo 0x5c82bb
btr ebp, esp
jmp 0x5c81d3
mov cx, word [esp]
jmp 0x5c848e

Function at 0x5d32ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x5d3418
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x5bc68c

Function at 0x5d34a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp 0x5bc68c

Function at 0x5d412c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
lea esp, [esp + 4]
pushal
jmp 0x5d4156
lea esp, [esp + 0x20]
jmp 0x5bc68c
Function at 0x5d4780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.005bc66d
jmp 0x5bc68c

Function at 0x5ef1cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 4], esi
pushal
jmp 0x5ef26f
pushal
push dword [esp + 0x1e]
mov word [esp + 0x10], di
jmp 0x5ef418
jmp 0x5ef4f6
call fcn.005ef398
pop edi
pop esi
test eax, eax
call fcn.005ef381
mov word [esp], bx
mov word [esp], bx
lea esp, [esp + 3]
jmp 0x5ef3a1
pop dword [esp + 0x14]
pop dword [esp + 0xe]
mov esi, eax
lea eax, [ecx*4]
dec eax
jmp 0x5ef2d1
lea esp, [esp + 2]
jmp 0x5ef2a9
movzx eax, byte [edx]
call 0x5ef2b2
pop ss
add esp, 1
pushal
lea esp, [esp + 3]
jmp 0x5ef300
lea esp, [esp + 0x1c]
mov cl, byte [esi]
mov eax, dword [esp]
shl al, 5
sub esp, 2
jmp 0x5ef283
movzx edi, cl
sub eax, edi
jne 0x5ef239
je 0x5ef222
daa
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 1
xor eax, ebx
push ebx
lds esi, ss:[ecx + 6]
lea esp, [esp + 0x20]
push edi
jmp 0x5ef2e2
pushal
jmp 0x5ef444
lea esp, [esp + 8]
movzx edi, cl
push esp
sub esp, 8
lea esp, [esp + 9]
jmp 0x5ef3e3
mov edi, dword [esp]
mov di, 0x5a57
inc edx
sub esp, 0xa
pop di
jmp 0x5ef32f
movzx eax, byte [edx + 1]
mov edi, 0xb8f79278
inc esi
lea edi, [edi*4]
jmp 0x5ef34b
jge 0x5ef20c
sub esp, 0x1e
mov dword [esp + 0x17], eax
push word [esp + 0x13]
jmp 0x5ef3cc
sub eax, edi
je 0x5ef222
jne 0x5ef239
lea esp, [esp + 0x20]
or eax, 0xffffffff
pushal
mov dword [esp + 1], ecx
jmp 0x5ef40e
mov word [esp], dx
lea esp, [esp + 3]
jmp 0x5ef3be
mov di, word [esp]
mov cl, byte [esi + 1]
xchg edi, eax
mov al, ah
sete al
jmp 0x5ef36e
lea esp, [esp + 0x20]
ret
lea esp, [esp + 0x24]
jle 0x5ef319
call fcn.005ef499
mov ch, 0x2c
mov byte [0xb98634c5], al
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
je 0x5ef239
mov edi, dword [esp]
mov edi, dword [esp]
jmp 0x5ef3fc
lea esp, [esp + 0x20]
ret
test cl, cl
pushal
mov byte [esp + 0x13], dh
pop word [esp + 5]
mov byte [esp + 0x14], bh
jmp 0x5ef42e

Function at 0x5efbe4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp 0x5efd88
rol cl, 3
mov ebp, dword [esp + 0x2c]
mov ecx, dword [ebp + 0x3c]
clc
jmp 0x5efd70
mov dh, 0x62
xor edx, edx
jmp 0x5efd93
push esp
lea esp, [esp + 4]
sub esp, 0x24
push ebp
jmp 0x5efd5f
add ecx, ebp
setle al
mov eax, 0x10b
jmp 0x5efdc8
Function at 0x5f18e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ecx, eax
push esp
push edx
lea esp, [esp + 0xc]
mov dword [esp + 0x18], ecx
call fcn.005f1775
clc
jnp 0x5f18a8
bsf ax, ax
bsr ax, bp
stc
jmp 0x5f18aa
bsf ax, ax
bsr ax, bp
stc
jmp 0x5f18aa
jmp 0x5f188a
sub esi, 4
stc
jp 0x5f1904
xchg ah, ch
ror ch, 5
pushal
jmp 0x5f1965
add edi, 0x28
cmc
cmc
sub esp, 4
jmp 0x5f1834
lea esp, [esp + 0x20]
inc ecx
cmc
jmp 0x5f18c2
ror ch, 5
pushal
jmp 0x5f1965
xchg ah, ch
jmp 0x5f18eb
movzx ecx, byte [edi - 1]
rdtsc
call 0x5f1940
bts edx, ebx
jmp 0x5f1da9
bsr dx, bp
rcl edx, 7
setb dh
bswap edx
shr dh, 5
mov dx, 0xdf07
jmp 0x5f1de3
bts edx, esp
bsr dx, cx
bts edx, edi
jmp 0x5f1d5a
bswap edx
bts edx, esp
bsr dx, cx
bts edx, edi
bts edx, ebx
xor al, 0xff
inc dl
jge 0x5f1d5f
jl 0x5f1df9
setg dh
clc
sete dh
mov dx, 0x65f7
mov edx, 0xbd32e10a
jmp 0x5f1e47
btc edx, esp
lea ebx, [ebx - 0x2c]
mov dh, 0x3e
not edx
lea edx, [ebp - 0x5a7a2cd9]
jmp 0x5f1e30
lea edx, [esi - 0x7550f3cb]
pushal
lea edx, [edx + edi]
jmp 0x5f1e08
bsr dx, bp
rcl edx, 7
setb dh
call 0x5f1db1
lea esp, [esp + 0x20]
not al
inc dx
jle 0x5f1e7e
jg 0x5f1e89
inc eax
iretd
mov dh, byte [esp]
neg dh
jns 0x5f1d9a
bswap edx
jmp 0x5f1d79
mov edx, dword [esp]
and dx, 0xa2c8
xchg dword [esp], ebx
bts edx, ebx
call fcn.005f1ebc
inc esi
int1
xchg dword [esp], ebx
xchg dword [esp], ebx
lea edx, [ecx - 0xe3]
mov dh, byte [esp]
btr edx, ebx
sbb edx, ebp
jmp 0x5f1dc6
mov dx, 0xf98d
mov edx, dword [esp + 4]
lea esp, [esp + 3]
lea esp, [esp + 4]
not al
jmp 0x5f1e1e
add dx, 0x4776
jmp 0x5f1ea1
add dx, 0x4776
mov dl, 0xac
bsr dx, cx
add dx, 0x51a6
jmp 0x5f20f1
mov dl, 0xac
bsr dx, cx
add dx, 0x51a6
jmp 0x5f20f1
bsr dx, bp
neg dx
dec dx
jne 0x5f2013
je 0x5f2013
rol dword [eax - 0x1d4cf0bd], 0x8d
adc al, 0x9d
add byte [eax], al
add byte [eax], al
btr edx, esp
lea edx, [ebx*4]
inc edx
jmp 0x5f1ec8
dec edi
mov edx, ebp
xchg dx, ax
not eax
lea eax, [edi*4]
bswap edx
jmp 0x5f1fa1
add bl, al
rdtsc
mov edx, dword [esp]
mov dh, byte [esp]
not ax
jmp 0x5f1eed
push edx
lea edx, [ebp - 0x8f8d2c9]
mov edx, esi
jmp 0x5f1f75
jmp 0x5f1f1c
sbb eax, ebp
jae 0x5f1f82
jb 0x5f1f82
inc dx
jp 0x5f1f8b
mov edx, dword [esp]
neg dx
mov dl, dh
mov edx, dword [esp]
jmp 0x5f209a
lea esp, [esp + 4]
rol cl, 0
mov dx, word [esp]
push edx
pop edx
mov dh, 0xc3
jmp 0x5f1f3e
invalid
cdq

Function at 0x5f194b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], al
bsr ax, bp
ja 0x5f19ae
clc
setg ah
push dword [esp + 2]
call fcn.005f1997
mov ah, byte [0xb60fc754]
dec edi
dec dword [edi]
xor eax, ebp
sar bh, 1
invalid
jmp fcn.005f198d

Function at 0x5f1ebc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], dx
add esp, 3
call fcn.005f1e9f
jmp 0x5f1f0d