joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b370
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46a523
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045e10a
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004637a2
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00464cbe
test eax, eax
je 0x43b48c
mov ecx, dword [esp + 0x3c]
call fcn.004637cf
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43b450
push edi
mov ecx, esi
call fcn.00460e3c
mov ecx, esi
call fcn.0043b5f0
cmp dword [esp + 0x38], 1
jne 0x43b485
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00460f77
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43dec0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43def3
push esi
call fcn.00440fb0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43deec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43df79
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43df62
mov eax, dword [esi + 8]
test eax, eax
je 0x43df17
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43df5e
cmp eax, 2
je 0x43df62
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43df0a
cmp eax, 3
je 0x43df3d
cmp eax, 1
jne 0x43df0a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43df0a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43df0a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043dfa0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43df88
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043dfa0
add esp, 4
pop esi
ret

Function at 0x449ab0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x449b53
test eax, eax
jbe 0x449b53
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x449b53
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x449afe
xor esi, esi
jmp 0x449b04
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x449b2f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0044ba50
add esi, eax
push esi
mov ebx, esi
call fcn.0044ba50
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x449b10
pop ebp
test edi, edi
pop edi
jne 0x449b53
test ebx, ebx
je 0x449b53
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0044dec0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x449c95
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x449dad
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x449dad
mov eax, dword [esi + 0x3c]
push eax
call fcn.0045e55c
mov esi, eax
test esi, esi
je 0x449dad
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x449dad
mov ecx, esi
call fcn.00449c00
cmp edi, eax
jge 0x449dad
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x449d33
mov dword [esp + 0x34], 1
jmp 0x449d8e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x449dad
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00449200
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x45eeff
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45ef37
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045cfb6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045cf8e
jmp 0x45ef43
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4605f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x460636
call fcn.004660a9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x460636
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46062d
xor eax, eax
jmp 0x46063e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00460644
pop edi
pop esi
pop ebx
ret 4
Function at 0x4665d9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x466607
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x466625
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046653f
jmp 0x466625
mov eax, dword [esi + 0x14]
test eax, eax
je 0x466625
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046653f
test edi, edi
mov eax, edi
jne 0x46660f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6730f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x28]
jb 0x8b8bc5
pushal
pushfd
mov byte [esp + 0xc], bl
lea esp, [esp + 0x24]
jmp 0x8bd514

Function at 0x6743fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
lea esp, [esp + 0x34]
je 0x8b8bbd
test cx, 0x710f
add eax, edi
push ebx
cmp bx, si
cmc
push ebx
cmp eax, edx
mov byte [esp + 4], 0xe5
lea esp, [esp + 8]
jb 0x8b8bc5
pushfd
lea esp, [esp + 4]
jmp 0x8bd514
test sp, ax
clc
cmp eax, dword [ebp - 0x10]
pushfd
pushfd
call fcn.008b73e3
xchg ebp, eax
sub dh, byte [edx + ecx*8 - 0x2bb563eb]
test al, 0x93
inc ebx
inc ecx
sahf
sbb dword [ebp + 0xbca3dc5], eax
mov esi, 0x6cec40a1
invalid
lea edi, [ecx + 0x7bec11dc]
sub eax, eax
lea ebx, [esi*4 + 0x38cadd7f]
xchg dh, bh
pushal
mov edx, dword [esp + 0x20]
not bl
jmp 0x8ba8e3
push esi
mov ebx, dword [esp + 0x28]
pop edi
mov dword [esp], 0x3c78b4d9
mov edi, dword [esp + 0x28]
pushfd
call fcn.008bc6c8
push edi
out dx, al
fsubr st(0)
das
xchg edx, eax
punpckhdq mm6, qword [edx + 0x3ef49d38]
sub byte [esi + edx*4], 0xa
mov al, 0x24
nop
stosb byte es:[edi], al
in al, 0xe2
fdivr qword [0xe9b0a081]
call 0xef1002d6
shufps xmm7, xmmword [ebx], 0x9b
pop ecx
mov ebp, dword [edx + 0x5b0d9bbe]
and dl, ch
sub dword [esi - 0xd5297cf], ebp
push edx
add eax, 0xb7e8e9b0
invalid
clc
jmp 0x8a5d45

Function at 0x674949
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edi + ecx*2]
shld di, dx, cl
xor di, bx
mov edi, dword [edx + 0x1c]
bt cx, si
pushfd
add edi, eax
bt edx, 0x11
pushal
call fcn.008a39e7
push ebp
dec ebx
lds esp, [ebx]
mov fs, word [edx - 0x2d]
sal dword [ecx], 1
and ecx, dword [esi + 0x31d1d362]
fdivp st(0)
push 0xffffffffffffffc2
pop esp
in al, dx
jle 0x67494d
jb 0x67496b
pushal
invalid

Function at 0x6760fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x40], ebx
jmp 0x8a6c6d
jmp 0x8bfdd5
mov word [esp], ax
lea esp, [esp + 0x40]
call fcn.0066f1cd
push 0x33cee6e2
mov esp, esi
pushfd
lea esp, [esp + 4]
jmp 0x8b8bc5

Function at 0x6789ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx ax, bl
shr ah, 2
mov eax, dword [ebp + 8]
cmc
test eax, eax
jmp 0x67875f
shr al, 4
pushfd
mov dword [esp], ebx
bts ax, 1
shr al, cl
shrd ax, bp, 3
setge al
push edx
xor al, 0xb9
jmp 0x673f19
pushfd
lea esp, [esp + 4]
je 0x8b8bbd
sal edx, cl
test bh, 0x58
bsf dx, di
mov esi, dword [eax + 0x3c]
ja 0x8bab79
sbb dh, 0x21
shrd dx, sp, cl
add esi, eax
adc dx, 0x7368
dec edx
stc
adc dh, 0xa4
mov edx, dword [esi + 0x78]
cmc
jmp 0x678fc6
lea ebp, [esp + 4]
das
das
shld ax, dx, 8
sub esp, 0xc
daa
test dx, bx
bsf ax, bp
neg ax
push esi
bt ebx, esp
push edi
jmp 0x676c5c
test edx, edx
pushal
call fcn.008bdad7
mov eax, 0x1cd9953b
mov bl, 0xe4
outsd dx, dword [esi]
adc eax, 0xf77bbe15
jmp 0x67903d
inc ebp
pushfd
invalid
add esi, eax
cmc
mov edx, dword [esi + 0x78]
bt di, 0xa
cmp cl, 0x21
clc
test edx, edx
pushfd
lea esp, [esp + 4]
je 0x8b8bbd
shld cx, si, cl
call fcn.0066f6ac
btr dx, di
jmp 0x8a2d15
Function at 0x679b6a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x8bd9fe
pushfd
lea esp, [esp + 0x4c]
jb 0x8b8bc5
push esi
pushfd
pushal
lea esp, [esp + 0x28]
jmp 0x8bd514
lea esp, [esp + 0x34]
je 0x8b8bbd
pushfd
cmc
test bl, al
pushal
add eax, edi
mov word [esp + 8], si
jmp 0x8bf392
pushal
test bp, cx
cmp eax, edx
push 0xbc840806
jmp 0x8ba168

Function at 0x8a8149
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
call fcn.0066f1cd
jmp 0x67442e
jmp 0x6794bb
mov esp, esi
pushal
pushal
lea esp, [esp + 0x40]
jmp 0x8b8bc5
pushfd
jmp 0x6707e9

Function at 0x8b6460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test esi, eax
cmp cl, 0xb
cmp sp, 0x5a14
cmp dword [ebp + 0x14], ecx
pushal
mov word [esp + 0x10], di
lea esp, [esp + 0x20]
ja 0x8bd550
movsx ebx, dl
lea ecx, [ebx - 0x358da476]
movzx edi, dl
pushal
mov esi, dword [esp + 0x20]
jmp 0x677d11
dec ecx
mov byte [esp + 4], cl
lea esp, [esp + 0xc]
jne 0x8bd5ab
rcl cl, 3
mov ecx, dword [ebp - 4]
jb 0x676c20
bt ebx, ebp
cmp dword [ebp + 0x14], ecx
jmp 0x8a317f

Function at 0x8b73e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jae 0x8b8bc5
sbb di, sp
mov ebx, eax
bsr cx, bx
bts di, sp
mov edi, eax
ror cx, cl
mov ecx, 0x104
test dh, 0x29
pushfd
xor al, al
stc
test bl, bl
pushal
cmc
repne scasb al, byte es:[edi]
mov byte [esp], ah
lea esp, [esp + 0x24]
jne 0x8b8bbd
cmp bh, 0xb1
rol si, cl
sub si, 0x90aa
or ecx, 0xfaf011cf
mov ecx, edi
call fcn.008bd676
hlt

Function at 0x8b8f07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov byte [esp + 8], al
mov dword [esp + 0x24], ebx
push eax
lea esp, [esp + 0x28]
call fcn.0066f1cd
pushal
mov esp, esi
pushfd
pushfd
lea esp, [esp + 8]
jmp 0x8b8bc5
jmp 0x67a5be

Function at 0x8b8f92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edx
je 0x8b8fd9
xchg ebx, eax
mov ebx, 0x452e3696
stc
stc
stc
pushal
or edx, edx
pushfd
lea esp, [esp + 0x3c]
je 0x8a318e
push 0xb721e9d7
clc
mov bh, 0xf8
push dword [esp]
or ecx, ecx
push 0x8cc88f5e
pushal
call fcn.008bd51a
sub al, 0xb9
cmc
mov word [esp], 0xb475
stc
rol al, 5
push esp
test ax, ax
call fcn.008bf12b
pop eax
inc esi
les esi, [eax - 0x7ba2e891]
sar bl, cl
and byte [eax - 0x5df57dfc], bh
push cs
xchg edx, eax
adc al, 0x84
add al, 0x82
or ah, byte [edx - 0x7beb6df2]
pop ss
jb 0x8b8f87
adc al, 0x9b
in al, dx
xor ecx, dword [edx]
add al, 0xd3
stosb byte es:[edi], al
mov eax, dword [0xd7bbdcb8]
sub al, 0x4e
les eax, [edi - 0x290a293]
dec esp
xchg ebx, eax
mov dl, 0x21
rcl bh, 1
enter 0xffffffffffff90b0, 0xffffffffffffffa9
imul edi, dword [ebp + 0x32], 0x2a
pop ds
jp 0x8b8fa5
pushal
sbb ch, byte [0x35d17b47]
mov bh, 0x90
xchg bh, dh
mov eax, dword [0x32aab729]
sub bl, byte [esi]
fistp dword [edi + eax*2 + 0x60]
cli
xor al, 0x70
jnp 0x8b9092
jmp 0x5e5cf6e3
mov ebx, 0xd903483d
salc
sub eax, 0x8ff5b0bd
dec ebp
movsd dword es:[edi], dword [esi]
jbe 0x8b910c
aad 0xd6
invalid
add byte [ecx + 0x37], al
or eax, 0x37917aee
or byte [eax], al
ret

Function at 0x8ba61f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
cmp eax, edx
jmp 0x8bd50a
lea esp, [esp + 0x28]
jb 0x8b8bc5
Function at 0x8bb4c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ah, 0x82
pushal
add eax, edi
call fcn.008bfdfd
scasd eax, dword es:[edi]
push esp
invalid
lea esp, [esp + 0x40]
je 0x8b8bbd
jmp 0x8b958e

Function at 0x8bc610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
cmp ecx, dword [edx + 0x14]
mov word [esp + 4], cx
jmp 0x8b8d0f
sub ecx, dword [edx + 0x10]
cmc
pushal
jmp 0x8a6f28

Function at 0x8bd51a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
lea esp, [esp + 0x34]
je 0x8a318e
aad 0x33
shrd ecx, ecx, cl
shrd ecx, edi, cl
sal cx, 4
xor ebx, ebx
dec al
add ah, 0x4a
mov dword [ebp - 4], ebx
btr cx, 7
btr ax, bx
bsr ax, dx
mov eax, edx
and cx, ax
shr eax, 0x10
Function at 0x48ffb3
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.0048db86
jne 0x490002
pushal
jmp 0x48db81
lea esp, [esp + 4]
cmp dword [esp + 4], 0
jmp 0x48ff88
jmp 0x490041
inc dword [esp + 8]
popfd
ret 4

Function at 0x49878e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x48242a
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x482446
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x482432
jmp 0x482451
ret
lea esp, [esp + 4]
jmp 0x48241f
lea esp, [esp + 4]
push edx
jmp 0x498765

Function at 0x5c7092
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x5c7099
add esp, 0x13
lea edx, [ecx*4]
mov bh, byte [esp + 7]
mov dl, 0xcc
jmp 0x5c70fa
not bh
sete ah
add esp, 5
add esp, 5
push word [esp + 1]
mov edx, dword [esp + 2]
jmp 0x5c7127
mov word [esp + 3], bx
rcl bx, cl
pop eax
neg ebx
mov edx, dword [esp + 3]
rdtsc
jmp 0x5c70d2
rdtsc
mov dh, byte [esp + 6]
neg eax
mov dword [esp + 1], esi
lea esp, [esp + 8]
jmp 0x5c71e2
mov eax, ebx
mov dword [esp], ebp
bsf bx, ax
push dword [esp]
mov dword [esp + 1], ecx
mov eax, dword [esp]
jmp 0x5c710d
bsf dx, si
call 0x5c7165
lea esp, [esp]
xchg byte [esp + 2], bl
setp ah
xchg byte [esp + 4], dh
pop dword [esp]
push word [esp + 2]
jmp 0x5c71c3
pop word [esp + 9]
lea ebx, [esi + 0x35]
lea edx, [ecx + edi]
setl dh
lea esp, [esp + 0xc]
ror ebx, 0xf
jmp 0x5c717c
mov bl, bh
mov dx, 0xec7b
in al, dx
xchg bh, dh
call fcn.005c7249
popfd
sbb cl, byte [eax - 0x205e511]
jg 0x5c71c8
mov bh, byte [ecx + 0x69]
ror byte [ebp - 0x24], cl
das
and dword ss:[esi - 0x45], esp
add edx, dword [ebx + ecx*4]
fmul dword [edi]
xchg esp, eax
invalid
mov bx, 0x1403
mov ebx, eax
sete ah
neg edx
sub esp, 0xe
mov byte [esp + 1], ah
jmp 0x5c71ac
Function at 0x5c7249
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 4
mov bx, 0x1df5
pop word [esp + 2]
mov dh, byte [esp + 3]
xchg word [esp], dx
btr eax, ebx
jmp 0x5c7233
shl ax, cl
bsf dx, ax
lea ebx, [esi + 0x3d]
mov dl, dh
mov dword [esp + 2], eax
cld
jmp 0x5c71f6
lea esp, [esp + 3]
lea esp, [esp + 1]
clc
and ax, 0x89d0
jmp 0x5c7334
bt edx, edx
cld
mov word [esp + 1], di
jmp 0x5c7220
bswap edx
lea edx, [edx + edi]
lea ebx, [edx*4]
mov ebx, esi
mov ebx, 0x9032ae6
neg eax
jmp 0x5c72c8
bsr dx, cx
mov bx, ax
rcr ah, 1
mov eax, dword [esp]
stc
neg eax
jmp 0x5c7254
mov dl, 0xd4
rol bx, cl
mov ax, sp
mov ebx, esp
rdtsc
adc ax, 0x83c
jmp 0x5c7275
sub esp, 4
push word [esp + 1]
xchg ah, bl
mov dh, ch
xchg dh, al
pushal
jmp 0x5c731c
xchg bx, ax
mov ebx, edx
xchg edx, eax
clc
lea eax, [esi + 0xad]
mov bl, 0x40
jmp 0x5c72a6
xchg dh, dl
rol bx, cl
pushal
lea esp, [esp + 0x43]
mov eax, 0xf390a848
btc eax, ebx
jmp 0x5c7294
mov bh, byte [esp + 2]
xchg edx, eax
add esp, 0
mov ebx, dword [esp + 3]
push word [esp + 0xe]
pop eax
jmp 0x5c73d6
mov dword [esp + 0x15], esi
xchg word [esp + 3], bx
lea esp, [esp + 0x15]
xchg dword [esp + 0xb], ebx
jmp 0x5c7300
neg esi
sub dword [eax - 0x45], ecx
scasb al, byte es:[edi]
inc esi
sal esi, 1
mov ebx, 0xf6d146ae
pushal
pop edx
xchg byte [esp + 0x1a], dl
pop dword [esp + 2]
sub esp, 0xa
jmp 0x5c72ec
mov dh, ch
mov eax, esp
rdtsc
neg eax
stc
clc
call fcn.005c7369
push ds
mov byte [esi], bl
jns 0x5c7330
cmp eax, 0xdcb525b0
das
test ah, dl
inc edi
out dx, al
stc
mov dh, byte [esp]
mov bx, 0x8ce7
neg ebx
mov byte [esp], ah
mov byte [esp], bh
dec eax
jmp 0x5c7394
add esp, 0xe
inc dx
cld
lea eax, [ecx - 0x774cf41d]
mov dh, byte [esp]
lea eax, [ecx - 0x8b]
jmp 0x5c73b3

Function at 0x5c7369
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp - 0x267a8b01]
mov ah, byte [esp + 3]
push edx
xchg byte [esp + 4], dh
mov dword [esp + 2], ebp
xchg bx, ax
jmp 0x5c736b
jmp 0x5c7348
mov eax, ebp
bts ebx, esp
mov dword [esp + 2], ebp
lea eax, [ecx*4]
mov dl, 0x74
mov bx, dx
jmp 0x5c747c
xchg dh, al
mov al, 0x56
pop edx
mov dh, ch
mov al, 0x66
and bx, 0xad0a
jmp 0x5c7407
mov ebx, dword [esp + 8]
setg ah
xchg dword [esp + 3], edx
mov byte [esp + 5], bh
mov word [esp + 5], sp
inc ax
jmp 0x5c741d
bsf ax, si
mov dh, 0xba
xchg dword [esp + 3], ebx
lea eax, [esp + edx]
mov word [esp + 4], dx
mov edx, 0xdbf0ed94
jmp 0x5c7437
Function at 0x5c7817
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
sub esp, 0x18
push word [esp + 1]
lea ebx, [esi*4]
pop bx
mov dx, 0x2d65
jmp 0x5c7824
rcr eax, 0x11
setnp bh
ror dh, 5
pop eax
stc
rdtsc
jmp 0x5c77da
sete dh
xchg bx, ax
lea edx, [ecx - 0x1d66d995]
jmp 0x5c77fd
or ebx, eax
cmc
push dword [esp + 8]
mov dh, 0xe2
not eax
lea edx, [edx*4]
jmp 0x5c78c6
mov bl, 0x10
not dx
rcr bh, 3
pop word [esp + 9]
mov ah, byte [esp + 7]
mov ax, si
jmp 0x5c78d6
lea esp, [esp + 7]
mov eax, dword [esp + 0x11]
clc
pop ax
inc al
inc eax
jmp 0x5c78a9
xchg word [esp + 2], bx
mov al, 0xe
push esp
mov edx, eax
mov byte [esp + 0x11], bh
add bx, 0x61a6
jmp 0x5c790f
inc edx
xchg bh, dh
rdtsc
neg bx
setnp bh
not ax
jmp 0x5c795d
sub esp, 0x18
mov al, 0xf6
mov al, 0x7e
push word [esp + 0xf]
push word [esp + 0x14]
push word [esp + 0x1f]
jmp 0x5c796f
pop edx
not ebx
mov edx, 0xed99adc4
bsf bx, ax
mov al, 0xe6
neg dh
jmp 0x5c7940
mov ah, byte [esp + 0x20]
rdtsc
shr ebx, 0xf
add esp, 2
not edx
mov edx, esp
jmp 0x5c7b51
mov eax, esp
call fcn.005c7a92
cld
not dx
neg dh
neg dx
mov dh, ch
xchg byte [esp], al
call fcn.005c7b1a
das
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
inc ebx
inc ebx
iretd
lea eax, [edi*4]
mov bx, bp
lea ebx, [eax + 0x21]
mov edx, esi
mov al, 0xbe
pop word [esp + 0xf]
jmp 0x5c7ad7
Function at 0x5c7e4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 7], ah
pop dword [esp + 2]
mov dl, 0x54
neg ebx
pop dword [esp + 2]
jmp 0x5c7fcd
mov ax, word [esp + 0xe]
push word [esp + 0xf]
xchg byte [esp + 4], al
mov dx, di
stc
mov byte [esp + 0xa], ah
jmp 0x5c7fa4
mov ah, byte [esp + 5]
mov byte [esp], ah
mov word [esp], bx
lea ebx, [esi + 5]
btr edx, edx
xchg dword [esp + 0xa], ebx
jmp 0x5c7e8f
neg bx
not dx
push dword [esp + 2]
mov dx, word [esp + 8]
push word [esp + 9]
cmp ax, 0x8bd2
jmp 0x5c7eb2
pop dword [esp + 8]
inc dx
mov al, ah
lea ebx, [esi - 0x9d]
push dword [esp]
pop bx
jmp 0x5c7f40
inc edx
rol dx, cl
mov al, ah
btc ebx, edi
not ebx
xchg byte [esp + 5], dl
jmp 0x5c7ef3
mov dh, ch
mov ax, word [esp]
neg bh
mov byte [esp], ch
cmc
shl bx, cl
jmp 0x5c7f7e
pop word [esp + 0xd]
xchg word [esp + 5], dx
rcr edx, 9
pop eax
add esp, 7
pop eax
jmp 0x5c7f24
mov byte [esp], dh
bsr bx, bp
lea ebx, [esi*4]
stc
mov byte [esp], ch
bsf dx, ax
jmp 0x5c8038
bswap edx
xchg dh, al
lea esp, [esp]
lea esp, [esp]
sbb edx, ebp
bsr ax, cx
jmp 0x5c7f54
mov dh, byte [esp + 0x11]
mov bx, dx
lea ebx, [edi*4]
mov word [esp + 0x10], sp
xchg ah, bl
mov eax, esi
jmp 0x5c7f13
rdtsc
pop word [esp + 1]
push word [esp + 7]
mov bx, 0xc149
bswap eax
mov dword [esp + 3], eax
jmp 0x5c7ed9
lea esp, [esp]
bsr ax, cx
mov dh, byte [esp]
dec edx
xor dl, ch
jmp 0x5c8072
neg ax
sub bl, ah
clc
mov byte [esp], ch
mov dx, word [esp]
xchg bx, ax
jmp 0x5c7fe8
lea edx, [edi*4]
xchg bh, dh
add esp, 0
mov ebx, dword [esp]
rdtsc
add esp, 0
jmp 0x5c8000
lea esp, [esp]
not dx
bts eax, edi
sete ah
btr eax, esp
neg ax
jmp 0x5c801a
sub bl, ah
mov eax, dword [esp]
mov ebx, dword [esp]
cld
mov ah, byte [esp]
btc edx, edi
jmp 0x5c8084
mov eax, 0xc9798b38
mov dh, 0x7a
inc bl
inc ebx
xchg ah, bl
mov dx, 0x8f25
jmp 0x5c804c
sub esp, 0x18
rdtsc
mov eax, dword [esp + 6]
lea esp, [esp + 9]
mov edx, esi
mov dword [esp + 1], ebp
jmp 0x5c8102
xchg dx, bx
lea esp, [esp + 9]
mov dh, byte [esp + 3]
push dword [esp + 2]
mov edx, 0xcb6f9b0a
rcr ah, 1
jmp 0x5c80b6
mov ebx, esp
xchg word [esp + 6], dx
bswap ebx
mov dx, 0x6289
xchg dx, bx
xchg bh, dh
jmp 0x5c80cf