joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4311d6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004313c9
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call int.0043bf1e
xor ebx, ebx
cmp eax, ebx
jne 0x431384
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004313c9
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call int.00438bfd
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0048a4f2
add esp, 0x10
test eax, eax
jne 0x43129f
push esi
call fcn.0042e888
mov esi, eax
cmp esi, ebx
pop ecx
je 0x43129f
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x43128a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x43129f
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x431298
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0043d431
cmp byte [esp + 0x13], bl
je 0x4312cf
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00431406
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x43133f
push 0x14
call fcn.0048975f
cmp eax, ebx
pop ecx
je 0x4312f9
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4312fb
xor edi, edi
cmp edi, ebx
je 0x43133f
push esi
push edi
call fcn.0043092c
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004309f4
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430b1d
add esp, 0x18
call fcn.004313c9
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0043b5eb
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x431356
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x431368
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4313ab
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4313ab
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004309f4
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430b1d
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b651
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xe30e1d69
cli
push cs
jecxz 0x45b64e
movaps xmmword [eax], xmm5
or byte [edx - 0x5e], al
invalid
Function at 0x45e676
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0045e869
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004693be
xor ebx, ebx
cmp eax, ebx
jne 0x45e824
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0045e869
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0046609d
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004b7992
add esp, 0x10
test eax, eax
jne 0x45e73f
push esi
call fcn.0045bd28
mov esi, eax
cmp esi, ebx
pop ecx
je 0x45e73f
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x45e72a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x45e73f
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45e738
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0046a8d1
cmp byte [esp + 0x13], bl
je 0x45e76f
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0045e8a6
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x45e7df
push 0x14
call fcn.004b6bff
cmp eax, ebx
pop ecx
je 0x45e799
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x45e79b
xor edi, edi
cmp edi, ebx
je 0x45e7df
push esi
push edi
call fcn.0045ddcc
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0045de94
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045dfbd
add esp, 0x18
call fcn.0045e869
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call int.00468a8b
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45e7f6
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x45e808
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x45e84b
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x45e84b
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0045de94
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045dfbd
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468e08
Capabilities:
Encode data using xor

Disassembly:
pushal
mov al, byte [0x1c76f55a]
pop edx
cmc
jbe 0x468dd7
out dx, eax
scasb al, byte es:[edi]
push ebp
nop
daa
dec esp
add edx, dword [esi + edi*2 - 0x69]
in al, dx
sub ah, dl
jbe 0x468e3f
leave
cmp dword [0x50b87356], ecx
fdiv dword [edx - 0x5a8e9a6c]
std
out dx, eax
les ebx, [ebx - 0x170a899a]
in eax, 0xd9
mov al, byte [0xd372d3fb]
add al, 0xd9
add eax, 0x91b052b4
xchg esp, eax
sub byte [eax], ah
enter 0x2167, 5
and al, 0xc5
std
dec edx
cmp esi, dword [esi + 0x27eff4fe]
invalid
popfd
in eax, dx
xor eax, 0x399d9407
jb fcn.00468e08
pop es
xchg esp, eax
popfd
cmp dword [edx - 9], esi
aaa
cmp ch, ch
xor dword es:[ecx], eax
jl 0x468db5
stc
popal
iretd
fnstenv [eax]
xchg ebp, eax
stosb byte es:[edi], al
or dword [edi], ebp
or al, 0x17
xchg ecx, eax
xor dword [eax + 0x29], esi
or dword es:[edx - 0xc906cd6], 0x782286a1
mov edx, 0xb07f32f7
mov ch, byte [edx]
xchg ebx, eax
outsd dx, dword [esi]
mov eax, dword [0xba782286]
div dword [edx]
jg 0x468e0b
call 0xa01020f9
insd dword es:[edi], dx
enter 0x442a, 0xffffffffffffffc0
and bl, dh
mov bh, byte [ecx]
insb byte es:[edi], dx
scasb al, byte es:[edi]
xchg dh, dl
xchg byte [edx + 0x29f5c225], al
leave
rcr byte [ebx + 0x10], 0x83
sti
cmpsd dword [esi], dword es:[edi]
in eax, 7
stosb byte es:[edi], al
adc dword [esp + ebx*8 - 0x59], esp
push es
jmp 0x468e4d
Function at 0x47cacc
Capabilities:
Encode data using xor

Disassembly:
popfd
fidivr dword [ebp + 0x65cf2386]
jg 0x47ca6f
mov byte [0xac7cdde4], al
dec edi
popal
pop edx
sub ah, byte [esi + 0x2c5cfaef]
cmp edx, ecx
jp 0x47ca8d
or eax, 0x2d58e3fc
Function at 0x4a41c6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a43b9
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004aef0e
xor ebx, ebx
cmp eax, ebx
jne 0x4a4374
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a43b9
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004abbed
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004fd4e2
add esp, 0x10
test eax, eax
jne 0x4a428f
push esi
call fcn.004a1878
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a428f
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a427a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a428f
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a4288
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004b0421
cmp byte [esp + 0x13], bl
je 0x4a42bf
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a43f6
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a432f
push 0x14
call fcn.004fc74f
cmp eax, ebx
pop ecx
je 0x4a42e9
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a42eb
xor edi, edi
cmp edi, ebx
je 0x4a432f
push esi
push edi
call fcn.004a391c
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a39e4
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a3b0d
add esp, 0x18
call fcn.004a43b9
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004ae5db
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a4346
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a4358
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a439b
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a439b
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a39e4
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a3b0d
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x628451
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323a0
cmp edx, dword [eax]
je 0x628473
add eax, 8
inc ecx
cmp eax, 0x632430
jl 0x628464
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323a0]
jne 0x6285a1
mov eax, dword [0x636d7c]
cmp eax, 1
je 0x62857b
test eax, eax
jne 0x6284a4
cmp dword [0x6322cc], 1
je 0x62857b
cmp edx, 0xfc
je 0x6285a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6284db
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00628e30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006292c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62851e
lea eax, [ebp - 0x1a4]
push eax
call fcn.006292c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62dd6c
push edi
call fcn.0062b190
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00628e30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00628e40
lea eax, [ebp - 0xa0]
push 0x62dd4c
push eax
call fcn.00628e40
push dword [esi + 0x6323a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00628e40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b104
add esp, 0x2c
pop edi
jmp 0x6285a1
lea eax, [ebp + 8]
lea esi, [esi + 0x6323a4]
push 0
push eax
push dword [esi]
call fcn.006292c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x56d5b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xbc
jmp 0x56d5d5
mov edi, esp
mov ebx, 0x78385851
mov cl, byte [esp]
xchg ecx, ebx
bswap edx
jmp 0x56d673
rol ah, 7
bswap edx
jmp 0x56d620
mov ah, byte [esp]
rol ah, 7
bswap edx
call fcn.0056d63c
jmp 0x56d64b
lea edx, [edx*4]
push ebx
mov cx, 0x11d7
lea esp, [esp + 1]
lea ecx, [edx + edi]
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x56d686
mov ebx, ebp
stc
jno 0x56d618
mov ah, byte [esp]
jmp 0x56d602
lea esp, [esp + 4]
add ebp, 0x574a5c8b
lea edx, [edx + edx]
not cl
lea eax, [ebp*4]
jmp 0x56d6e9

Function at 0x56d63c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, ecx
cmc
jbe 0x56d625
ja 0x56d6a7
lahf
add dword [ecx + reloc.MSVCRT.dll_strncpy], edx
add ecx, dword [ebp + reloc.MSVCRT.dll_strncpy]
add byte [eax], al
lea edx, [edx*4]
push ebx
mov cx, 0x11d7
call 0x56d6ba
dec esp
fbld tbyte [esi - 0x47]
mov dl, dh
rdtsc
mov dh, bl
xchg dword [esp], edi
xchg dh, cl
jmp 0x56d6cd
cmc
rdtsc
lea edi, [edi - 0x3b]
xchg ecx, eax
xchg edx, ecx
mov dx, word [esp]
jmp 0x56d71e
not dx
push dword [esp]
ret 4
dec ch
xchg ecx, edx
xchg dword [esp], edi
not cl
mov cx, si
mov ecx, dword [esp]
jmp 0x56d6ff

Function at 0x583f85
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec bl
jmp 0x584017
push si
neg ah
lea esp, [esp + 2]
add esp, 4
je 0x583fb7
jne 0x583fb7
iretd
pop esi
jmp 0x583fe9
lea esp, [esp + 2]
jmp 0x583f95
xchg dl, dh
xchg cx, ax
xchg edx, eax
jmp 0x584039
lea edx, [edx - 0x7a]
lea ebx, [edx*4]
xchg ebx, eax
pop ebx
bsf edi, esi
jmp 0x583fff
jle 0x583fd3
xchg dl, dh
xchg cx, ax
jmp 0x58405c
jp 0x583f8d
push si
neg ah
jmp 0x583fcd
pop edi
jmp 0x56d673
xchg edx, eax
jmp 0x584039

Function at 0x645b63
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ax
lea esp, [esp + 2]
inc dx
cmc
xchg ebp, ecx
jmp 0x645b3c
Function at 0x6461c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
mov ah, 0xdb
lea ebp, [edx*4]
neg ah
jmp 0x646173
lea edi, [ecx + edx]
mov si, word [esp + 8]
lea edx, [esp + eax]
pop cx
mov byte [esp + 3], bl
bswap ebp
jmp 0x646132
mov ecx, 0x614b2b0
mov di, 0xef01
mov ebp, 0xa7864991
jmp 0x646198
lea esi, [ecx + ebx]
dec edx
setg cl
pop cx
rdtsc
cpuid
jmp 0x64615d
mov ebx, esp
cpuid
bsr bx, bp
setl bl
add dx, 0xc0ac
call fcn.006461ad
mov dword [reloc.MSVCRT.dll_strncpy], eax
bts ebx, ebp
setno cl
bts bx, bp
neg bl
rdtsc
mov ax, di
mov cx, word [esp + 4]
jmp 0x646182
xchg bx, di
mov al, bl
cld
jmp 0x646148
Function at 0x646244
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bp
jmp 0x64624d
pop ebx
mov eax, 0x26323f2b
lea ebp, [ecx*4]
pop ebp
bsf edi, ecx
pop dword [esp]
jmp 0x6462a0
xchg byte [esp], bl
setp dl
mov bx, 0x4e87
mov ax, 0x5266
adc si, bx
add esp, 2
jmp 0x646303
cld
lea eax, [ebx*4]
bsr esi, esp
bswap ecx
mov ah, dl
pop dx
jmp 0x646283
mov byte [esp], al
lea edx, [ebp*4]
sub dh, 0x7b
xchg byte [esp], bh
jmp 0x6462e0
mov cx, word [esp]
mov dl, 0x3c
mov dx, word [esp]
bswap eax
xchg dl, al
lea edi, [edi*4]
jmp 0x6462b3
clc
mov ecx, dword [esp]
xchg ecx, ebx
lea ebp, [edi*4]
mov ebp, dword [esp]
cld
jmp 0x64632a
mov bl, cl
mov cx, word [esp]
rdtsc
xchg edi, ecx
bswap ebx
bsr ecx, ebx
jmp 0x6462c9
sub esp, 9
shl di, cl
xchg byte [esp], dl
xchg bl, al
xchg dword [esp + 5], ebp
jmp 0x64633b
rdtsc
bsf cx, dx
pushal
mov byte [esp + 0x1d], bh
popal
bsf ebp, edx
jmp 0x646314
mov di, word [esp + 6]
xchg dh, dl
pop ecx
pop esi
lea esp, [esp]
mov edi, ebx
jmp 0x646413
mov bp, si
not edi
call 0x64637b
adc byte [ebp - 0x39021f75], cl
jl 0x64630d
push esp
and al, 1
xchg byte [esp + 1], bh
bswap esi
jmp 0x6463d2
cld
btr di, bp
xchg ebp, edi
lea esp, [esp + 5]
mov eax, 0x77749eeb
add esp, 7
jmp 0x646370
xchg byte [esp], bl
std
mov ebp, ecx
lea edx, [ebx*4]
rdtsc
std
jmp 0x6463e8
pop ebp
mov bp, 0x9835
lea eax, [esi*4]
inc al
add esp, 0
mov bx, sp
jmp 0x6463ab
mov eax, dword [esp]
cpuid
stc
pop ax
rcr ah, 6
xchg si, cx
jmp 0x6463fc
shr edi, 0x1f
pushal
mov ax, 0xc793
sets al
mov dl, byte [esp + 0x1a]
stc
jmp 0x64643e
mov ah, bh
mov cx, bp
add esp, 1
mov bl, byte [esp]
sub esp, 0xb
push bp
jmp 0x646396
cpuid
stc
mov byte [esp + 5], bl
mov bp, si
lea edi, [esp + edi]
mov bh, bl
jmp 0x646450
xchg bh, bl
push esp
lea ebx, [ecx + ebp]
lea esp, [esp + 0x1a]
add esp, 1
sub esp, 0xb
jmp 0x646428
mov dh, 0x93
std
bsf bp, bp
xchg ecx, eax
lea edx, [eax + ebx]
xchg al, bh
jmp 0x646d6a
sbb dx, 0x2f8d
sub esp, 0x15
pop word [esp + 0x18]
call fcn.006464c3
xor dword [eax], esi
xor ebp, dword [edx]
mov ebp, dword [esp + 6]
sub al, bl
cpuid
mov di, ax
mov ecx, 0x689aa079
pop word [esp + 7]
jmp 0x646480
pop dword [esp + 9]
mov dh, ch
mov eax, dword [esp + 0xa]
mov word [esp + 6], cx
pop word [esp + 9]
clc
jmp 0x646496
setae dh
bswap ebp
dec eax
xchg esi, eax
rdtsc
mov ch, 0x60
jmp 0x6464f4
add esp, 4
mov dword [esp + 1], esi
setg bl
cld
mov dx, word [esp + 6]
mov byte [esp + 0xf], dh
jmp 0x64654c
push word [esp + 2]
mov dh, byte [esp + 4]
inc ah
shl esi, 0
neg eax
mov eax, dword [esp + 3]
jmp 0x646814
lea ebx, [edx*4]
mov eax, dword [esp + 0x13]
cmp eax, 0xe4f61b1c
sete bl
xchg byte [esp + 0xa], dh
mov word [esp + 3], bp
jmp 0x646a8e
bsf dx, si
mov byte [esp + 0xa], bh
lea ebp, [edx + edi]
push cx
setnp bl
mov esi, 0x2b9ae90d
jmp 0x646bd7
Function at 0x64637b
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bp
jmp 0x64624d
pop ebx
mov eax, 0x26323f2b
lea ebp, [ecx*4]
pop ebp
bsf edi, ecx
pop dword [esp]
jmp 0x6462a0
xchg byte [esp], bl
setp dl
mov bx, 0x4e87
mov ax, 0x5266
adc si, bx
add esp, 2
jmp 0x646303
cld
lea eax, [ebx*4]
bsr esi, esp
bswap ecx
mov ah, dl
pop dx
jmp 0x646283
mov byte [esp], al
lea edx, [ebp*4]
sub dh, 0x7b
xchg byte [esp], bh
jmp 0x6462e0
mov cx, word [esp]
mov dl, 0x3c
mov dx, word [esp]
bswap eax
xchg dl, al
lea edi, [edi*4]
jmp 0x6462b3
clc
mov ecx, dword [esp]
xchg ecx, ebx
lea ebp, [edi*4]
mov ebp, dword [esp]
cld
jmp 0x64632a
mov bl, cl
mov cx, word [esp]
rdtsc
xchg edi, ecx
bswap ebx
bsr ecx, ebx
jmp 0x6462c9
sub esp, 9
shl di, cl
xchg byte [esp], dl
xchg bl, al
xchg dword [esp + 5], ebp
jmp 0x64633b
rdtsc
bsf cx, dx
pushal
mov byte [esp + 0x1d], bh
popal
bsf ebp, edx
jmp 0x646314
mov di, word [esp + 6]
xchg dh, dl
pop ecx
pop esi
lea esp, [esp]
mov edi, ebx
jmp 0x646413
mov bp, si
not edi
call 0x64637b
adc byte [ebp - 0x39021f75], cl
jl 0x64630d
push esp
and al, 1
xchg byte [esp + 1], bh
bswap esi
jmp 0x6463d2
cld
btr di, bp
xchg ebp, edi
lea esp, [esp + 5]
mov eax, 0x77749eeb
add esp, 7
jmp 0x646370
xchg byte [esp], bl
std
mov ebp, ecx
lea edx, [ebx*4]
rdtsc
std
jmp 0x6463e8
pop ebp
mov bp, 0x9835
lea eax, [esi*4]
inc al
add esp, 0
mov bx, sp
jmp 0x6463ab
mov eax, dword [esp]
cpuid
stc
pop ax
rcr ah, 6
xchg si, cx
jmp 0x6463fc
shr edi, 0x1f
pushal
mov ax, 0xc793
sets al
mov dl, byte [esp + 0x1a]
stc
jmp 0x64643e
mov ah, bh
mov cx, bp
add esp, 1
mov bl, byte [esp]
sub esp, 0xb
push bp
jmp 0x646396
cpuid
stc
mov byte [esp + 5], bl
mov bp, si
lea edi, [esp + edi]
mov bh, bl
jmp 0x646450
xchg bh, bl
push esp
lea ebx, [ecx + ebp]
lea esp, [esp + 0x1a]
add esp, 1
sub esp, 0xb
jmp 0x646428
mov dh, 0x93
std
bsf bp, bp
xchg ecx, eax
lea edx, [eax + ebx]
xchg al, bh
jmp 0x646d6a
sbb dx, 0x2f8d
sub esp, 0x15
pop word [esp + 0x18]
call fcn.006464c3
xor dword [eax], esi
xor ebp, dword [edx]
mov ebp, dword [esp + 6]
sub al, bl
cpuid
mov di, ax
mov ecx, 0x689aa079
pop word [esp + 7]
jmp 0x646480
pop dword [esp + 9]
mov dh, ch
mov eax, dword [esp + 0xa]
mov word [esp + 6], cx
pop word [esp + 9]
clc
jmp 0x646496
setae dh
bswap ebp
dec eax
xchg esi, eax
rdtsc
mov ch, 0x60
jmp 0x6464f4
add esp, 4
mov dword [esp + 1], esi
setg bl
cld
mov dx, word [esp + 6]
mov byte [esp + 0xf], dh
jmp 0x64654c
push word [esp + 2]
mov dh, byte [esp + 4]
inc ah
shl esi, 0
neg eax
mov eax, dword [esp + 3]
jmp 0x646814
lea ebx, [edx*4]
mov eax, dword [esp + 0x13]
cmp eax, 0xe4f61b1c
sete bl
xchg byte [esp + 0xa], dh
mov word [esp + 3], bp
jmp 0x646a8e
bsf dx, si
mov byte [esp + 0xa], bh
lea ebp, [edx + edi]
push cx
setnp bl
mov esi, 0x2b9ae90d
jmp 0x646bd7
Function at 0x64662f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
mov ch, ah
xchg dword [esp], edi
sub esp, 0
cmp bl, al
dec ax
jmp 0x646634
sub esp, 0x12
jmp 0x646619
pop cx
lea ebp, [ebx + esi]
mov cl, 0x7c
inc dl
cpuid
mov edx, dword [esp + 0xa]
jmp 0x64670d
pop word [esp + 0x16]
bsf di, ax
mov word [esp + 2], di
pop ecx
mov word [esp + 0x17], dx
push word [esp + 0x10]
jmp 0x646673
inc ax
xchg ebx, edi
neg cl
clc
xchg word [esp + 0x10], bx
mov dx, sp
jmp 0x646689

Function at 0x64674e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0xffecf6ef
mov edx, 0xe4290eea
jmp 0x64678d
rdtsc
mov esi, dword [esp]
lea esp, [esp + 3]
mov dl, bl
push dword [esp]
jmp 0x6467df
mov ax, sp
sete bl
pop word [esp + 2]
bsr ebp, esp
xchg word [esp + 2], si
bswap ecx
jmp 0x646777
mov edi, 0xc8d10f87
cpuid
mov al, byte [esp + 1]
mov ah, 0x87
jmp 0x6467f3
bsr di, si
mov eax, ebp
setnp bh
mov word [esp + 2], dx
add esp, 4
cmc
jmp 0x6467c9
lea esp, [esp + 1]
xchg di, bp
bswap ebp
lea eax, [edx*4]
rdtsc
neg ebp
jmp 0x646a10
xor al, 0xd4
mov edi, 0x3bc8a939
xlatb
lahf
aam 0xbf
cmp dword [ecx - reloc.MSVCRT.dll_strncpy], ebp
sbb cl, byte [eax - 0xc0ce511]
jg 0x6469f3
mov bh, byte [ecx + 0x65]
fist dword [eax - 0x3a]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
das
lea esi, [edx + esi]
rdtsc
not dx
not ecx
pop word [esp]
call fcn.0064687d
cmp al, 0xb4
sub cl, byte [ebp - 0x44]
push 0x5031a12a
mov dword [reloc.MSVCRT.dll_strncpy], eax
pop ss
loop 0x646a41
scasb al, byte es:[edi]
daa
mov bh, 0xd2
and ebp, ecx
aam 0x58
into
test eax, 0xb53ab358
and eax, 0x345ebf4c
cmpsb byte [esi], byte es:[edi]
cmp dh, byte [ebp + 0x5ebf4c25]
xor al, 0xa6
xor al, 0x53
scasb al, byte es:[edi]
dec esp
inc esi
fisttp dword [ebx + 0x2e]
fnsave dword [edx]
lodsb al, byte [esi]
cmp al, 0xd2
mov ch, 0x44
jecxz 0x6469f4
or dword [ecx + reloc.MSVCRT.dll_strncpy], ebx
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
pop ds
pop esi
iretd