joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0c9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a0efc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4a0cff
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004a0764
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d600
cmp al, 1
jne 0x4a0cff
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004a0a7c
test al, al
je 0x4a0e8b
cmp dword [ebp - 8], 0
jge 0x4a0d1d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004a0764
mov eax, dword [ebp - 0x210]
call fcn.00404e58
cmp ebx, eax
jge 0x4a0d67
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004a0764
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4d43c8]
and eax, 0xff
bt dword [edx], eax
jae 0x4a0d67
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4a0d7b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a0c78
cmp ebx, dword [ebp - 8]
je 0x4a0e7d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a0da7
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404044
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d3c44]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4a0e6a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404044
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d3c44]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00468c7c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404044
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d3c44]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00468c7c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0e71
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4a0ede
cmp dword [ebp - 8], 0
jge 0x4a0e96
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004a0764
mov eax, dword [ebp - 0x218]
call fcn.00404e58
cmp eax, dword [ebp - 8]
jg 0x4a0ed0
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004a0764
mov eax, dword [ebp - 0x21c]
call fcn.00404e58
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a0c78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0f03
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404bbc
ret
Function at 0x4ba574
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x5c4], 0
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push 0xa
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 1
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push 0xa
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push 0xa
call sub.kernel32.dll_Sleep_1
push 0
lea eax, [ebx + 0x3978]
push eax
push 4
lea eax, [ebx + 0x560]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_ReadFile_1
xor eax, eax
mov al, byte [ebx + 0x560]
and eax, 2
cmp eax, 2
jne 0x4ba653
mov byte [ebx + 0x5c4], 2
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
or eax, 0xffffffff
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x4bbf10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x39be], 0
je 0x4bbfeb
cmp byte [ebx + 0x39bf], 0
je 0x4bbfeb
push 0xa
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0xe0
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push 0xa
call sub.kernel32.dll_Sleep_1
push 0
lea eax, [ebx + 0x3978]
push eax
push 8
lea eax, [ebx + 0x560]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_ReadFile_1
xor eax, eax
mov al, byte [ebx + 0x560]
mov dword [ebx + 0x39a8], eax
push 5
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0xc0
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push 5
call sub.kernel32.dll_Sleep_1
push 0
lea eax, [ebx + 0x3978]
push eax
push 8
lea eax, [ebx + 0x560]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_ReadFile_1
xor eax, eax
mov al, byte [ebx + 0x560]
mov dword [ebx + 0x39a4], eax
pop ebx
ret

Function at 0x4be134
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov byte [ebx + 0x5c4], 0x87
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0xaa
push 0
lea eax, [ebx + 0x3974]
push eax
push 1
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0x88
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0x55
push 0
lea eax, [ebx + 0x3974]
push eax
push 1
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0x87
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_Sleep_1
mov byte [ebx + 0x5c4], 0xa0
push 0
lea eax, [ebx + 0x3974]
push eax
push 1
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_Sleep_1
pop esi
pop ebx
ret
Function at 0x4bf054
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bf27a
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov dword [ebp - 0xc], 0x1e
xor eax, eax
mov dword [ebp - 4], eax
mov byte [ebx + 0x5c4], 0x55
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov byte [ebx + 0x5c4], 0x84
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebx + 0x3c8]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x44]
xor edx, edx
mov eax, dword [ebx + 0x36c]
call fcn.00462360
mov byte [ebx + 0x5c4], 0x82
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebx + 0x39ac]
cmp eax, 0x11
je 0x4bf13b
cmp eax, 0x1b
jne 0x4bf142
mov eax, 0xf
jmp 0x4bf147
mov eax, 7
test eax, eax
jl 0x4bf1ef
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
call fcn.00404b98
xor esi, esi
push 0
lea eax, [ebx + 0x3978]
push eax
push 8
lea eax, [ebx + 0x560]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_ReadFile_1
movzx edi, byte [ebx + 0x560]
mov edx, dword [ebp - 8]
shl edx, 8
lea eax, [esi + 1]
add edx, eax
mov cl, byte [ebx + 0x560]
mov byte [ebx + edx + 0x194b], cl
mov edx, dword [ebp - 8]
inc edx
imul edx, eax
dec edx
je 0x4bf1b8
mov eax, dword [ebp - 4]
add eax, edi
and eax, 0xff
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
push 0x4bf294
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.00409200
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404f18
inc esi
cmp esi, 0x100
jne 0x4bf164
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x4bf15a
mov byte [ebx + 0x5c4], 0x80
push 0
lea eax, [ebx + 0x3974]
push eax
push 4
lea eax, [ebx + 0x5c4]
push eax
mov eax, dword [ebx + 0x3e0]
push eax
call sub.kernel32.dll_WriteFile_1
movzx edi, byte [ebx + 0x194c]
cmp edi, dword [ebp - 4]
je 0x4bf229
dec dword [ebp - 0xc]
jne 0x4bf099
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
cmp edi, dword [ebp - 4]
je 0x4bf253
mov byte [ebx + 0x39f1], 1
xor ebx, ebx
jmp 0x4bf25c
mov byte [ebx + 0x39f1], 0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf281
lea eax, [ebp - 0x18]
call fcn.00404b98
lea eax, [ebp - 0x10]
call fcn.00404b98
ret
Function at 0x4cced8
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, 0x4ccf80
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
mov dword [0x4d5e74], eax
cmp dword [0x4d5e74], 0xffffffff
jne 0x4ccf22
xor ebx, ebx
mov eax, dword [0x4d3f48]
mov eax, dword [eax]
mov edx, 0x4ccf98
call fcn.00404fa4
je 0x4ccf79
mov eax, 0x4ccfa8
call fcn.0043208c
jmp 0x4ccf79
push 0
push 0x4d5ee4
push 4
push 0x4d5e80
mov eax, dword [0x4d5e74]
push eax
call sub.kernel32.dll_ReadFile_1
xor eax, eax
mov al, byte [0x4d5e80]
test eax, eax
jns 0x4ccf49
add eax, 7
sar eax, 3
cmp eax, 0x1f
jne 0x4ccf72
xor ebx, ebx
mov eax, dword [0x4d3f48]
mov eax, dword [eax]
mov edx, 0x4ccf98
call fcn.00404fa4
je 0x4ccf79
mov eax, 0x4ccfc4
call fcn.0043208c
jmp 0x4ccf79
mov dword [0x4d5e7c], eax
mov bl, 1
mov eax, ebx
pop ebx
ret
Function at 0x484034
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x489128
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x489144
shr eax, 1
xor eax, 0xedb88320
jmp 0x489146
shr eax, 1
dec edx
jne 0x489137
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x489130
pop esi
ret

Function at 0x489173
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x48917f
call fcn.00489128
push 1
push 0x40c558
call fcn.00485c94
mov eax, edi
test esi, esi
je 0x4891aa
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_DuplicateHandle]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x489185
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x60cf20
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
pushal
jmp 0x60cf0b
push esp
push word [esp + 1]
pop word [esp + 0x11]
mov byte [esp + 0x1c], bh
call 0x60cf20
lcall 0x6603, 0x2474ff66
mov dword [esp + 0x1e], ebx
jmp 0x60cfc5
pushfd
lea edi, [esi + 0x2d]
mov ebx, eax
lea eax, [edi + ebp]
lea esi, reloc.KERNEL32.dll_DuplicateHandle
jmp 0x60cf43
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp + 0x80], edi
lea esp, [esp + 0x80]
jmp 0x60cf5f
mov dword [esp + 0x21], ebp
mov dword [esp + 9], ebp
mov dword [esp + 0x84], esi
push edx
push esp
pop dword [esp]
jmp 0x60cf8d

Function at 0x60d2e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 7]
push dword [esp + 2]
pushal
lea esp, [esp + 0x45]
call fcn.0060d03b
lea esp, [esp + 3]
jmp 0x60d28d
lea edx, [edx + esi]
neg dx
jne 0x60d2d4
rol dh, 3
jmp 0x60d2ac
lea esp, [esp + 0x20]
dec al
lea edx, [ecx - 0x8b]
mov dx, word [esp]
jmp 0x60d269
inc dx
lea edx, [eax - 0x71]
bswap edx
jmp 0x60d2b9
bswap edx
jmp 0x60d2e0
rol dh, 3
inc dx
lea edx, [eax - 0x71]
bswap edx
bswap edx
call 0x60d2e6
adc cl, byte [edi]
wait
invalid
mov dword [esp], eax
pop word [esp]
pushal
push dword [esp + 0xc]
push word [esp + 0x15]
jmp 0x60d232
Function at 0x71e39a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
xchg esi, ebp
inc esi
rdtsc
pop word [esp + 4]
mov dl, dh
jmp 0x71e39e
pop cx
jmp 0x71e381
sub esp, 0x18
push dword [esp + 0x12]
mov dl, 0x84
bsf dx, ax
mov ebx, dword [esp + 0xc]
pop dx
jmp 0x71e59f
xchg word [esp + 1], ax
add esp, 1
not bp
ror ch, 5
mov al, ah
jmp 0x71e52e
cld
mov word [esp + 5], bx
xchg byte [esp], al
pop dx
mov bp, word [esp]
mov ebx, eax
jmp 0x71e3ef
mov cl, ch
mov byte [esp], bh
xchg bh, cl
neg dh
mov bp, word [esp]
btc ebx, edi
jmp 0x71e44b
xchg ah, bl
lea edi, [esp + ecx]
shl bx, cl
inc cl
bswap edi
setl ah
jmp 0x71e418
sub edi, eax
neg bh
xchg byte [esp], cl
not edx
setae ah
bsf dx, si
jmp 0x71e4cb
lea esp, [esp + 1]
inc ax
lea ebx, [ecx*4]
mov ax, word [esp + 1]
lea esp, [esp + 2]
mov cx, word [esp]
jmp 0x71e43a
not eax
lea ebp, [ecx*4]
mov ax, word [esp]
call fcn.0071e45d
rdtsc
lea esp, [esp]
mov ch, byte [esp + 4]
xchg bp, di
mov si, di
mov ebp, dword [esp + 3]
jmp 0x71e510
btc edx, edi
stc
cld
xchg dword [esp], eax
not ax
mov dl, 0x24
jmp 0x71e476
mov dword [esp], eax
btc edx, ebx
mov di, dx
mov word [esp + 1], di
pushal
mov ebx, 0xeb17fd60
jmp 0x71e544
mov byte [esp + 4], bh
mov al, ah
lea ecx, [edi*4]
mov dword [esp], ecx
pop dx
inc al
jmp 0x71e4fe
mov word [esp + 6], di
mov word [esp + 0xd], di
sub esp, 0x14
mov dword [esp + 0x10], ebp
pop word [esp + 0x22]
cpuid
jmp 0x71e585
mov ah, byte [esp + 2]
mov word [esp], bx
mov byte [esp + 1], dh
xchg word [esp], bp
lea eax, [edi*4]
push edx
jmp 0x71e405
btr ecx, esp
call fcn.0071e66d
inc edi
je fcn.0071e5d4
jne 0x71e605
jb 0x71e5fa
outsb dx, byte [esi]
je 0x71e5e8
jb 0x71e609
arpl word [ebp + 0x73], sp
jae 0x71e59f
mov ch, byte [esp + 0x11]
push edx
lea ebp, [eax*4]
rdtsc
popal
rdtsc
jmp 0x71e568
invalid
jmp dword [esi - 0x75]
Function at 0x71e6fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cpuid
mov ah, byte [esp + 3]
rcl dx, cl
mov al, 0x76
xchg byte [esp + 2], bl
jmp 0x71e813
mov cl, ch
jmp 0x71e6dd
cpuid
mov dx, bx
mov ebx, eax
pop dword [esp]
mov cl, ch
xchg word [esp + 3], cx
jmp 0x71e7a8
inc bp
lea esi, [ecx*4]
pop bx
mov si, word [esp + 7]
jmp 0x71e702
xchg byte [esp + 4], al
mov byte [esp + 3], ch
sub esp, 2
btr edi, esp
neg dx
push dword [esp + 6]
jmp 0x71e724
pushal
mov dword [esp + 6], esi
add bx, 0xbebe
sub esp, 2
lea ecx, reloc.KERNEL32.dll_DuplicateHandle
pop word [esp + 0xe]
jmp 0x71e7e9
push edx
mov si, 0xcf95
push word [esp + 4]
neg eax
xchg ebp, ecx
mov ch, byte [esp + 4]
jmp 0x71e752
add esp, 0
xchg ebx, esi
lea esp, [esp]
btr edi, esp
add esp, 0
bsf cx, si
jmp 0x71e774
lea esp, [esp + 6]
lea edx, [edi*4]
bsr bx, bp
xchg byte [esp], bl
xchg byte [esp], cl
mov cx, word [esp]
jmp 0x71e78c
push word [esp + 0xe]
mov bh, byte [esp + 0x16]
btc edx, ebx
bsf bp, si
sub edi, eax
mov cx, sp
jmp 0x71e7f9
pop ecx
xchg bh, cl
cmc
lea ebp, reloc.KERNEL32.dll_DuplicateHandle
cmc
lea edi, [ebp + 0x1f]
jmp 0x71e7c3
mov edx, eax
rdtsc
btc esi, ebx
push word [esp + 1]
bsr di, bp
cpuid
jmp 0x71e8d2
bswap eax
xchg ah, bl
push dword [esp + 1]
shl dx, cl
pop ax
rcr ch, 5
jmp 0x71e73b
lea eax, [esi + 0xb5]
push word [esp + 0x1e]
xchg edi, eax
call fcn.0071e843
mov dword [esp + 0x1b], ecx
xchg dword [esp + 0xc], esi
xchg byte [esp + 0x22], dl
lea edi, reloc.KERNEL32.dll_DuplicateHandle
pop ecx
neg cx
jmp 0x71e85c

Function at 0x71ea7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x71eac9
mov bh, byte [esp + 2]
lea eax, [ecx - 0x1b]
lea esp, [esp + 5]
xor bp, 0x98c4
sub esp, 8
inc ecx
jmp 0x71eb1c
not bx
push dword [esp + 1]
lea edi, [ebp + 0xd7]
mov bl, bh
btr esi, esp
jmp 0x71eaaa
pop bp
pop word [esp + 3]
lea esi, [edx + ebx]
pop dword [esp]
push word [esp + 1]
pop edx
jmp 0x71eaf9

Function at 0x722085
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0xe229
push dword [esp + 2]
pop dword [esp + 4]
xchg word [esp + 3], di
bsf di, ax
jmp 0x722133
sub esp, 2
sub esp, 0x10
pop ecx
cpuid
lea esi, [ebp + 0xaf]
bsr bp, cx
jmp 0x722142
xchg ecx, ebp
rdtsc
mov bl, 0xc0
lea esp, [esp + 0x1c]
xchg byte [esp + 0xe], dl
pop bp
jmp 0x7220ec
neg ch
sub esp, 0
bswap edi
pushal
pop di
sub esp, 6
jmp 0x722113
mov dl, dh
lea edi, [ebp - 0xff]
rdtsc
pop esi
lea edi, [ebx*4]
mov ax, di
jmp 0x722270
xchg byte [esp + 8], dl
xchg dword [esp + 0xf], edx
lea esp, [esp + 4]
xchg dword [esp + 0xb], eax
setnp ah
cpuid
jmp 0x72216b
cpuid
inc di
neg eax
xchg ah, bl
mov edi, dword [esp + 0xd]
bsr ax, cx
jmp 0x722195
mov dl, dh
bsf cx, si
pop bx
mov ebx, 0x911e3ee6
lea edi, [esi*4]
xchg word [esp], ax
jmp 0x7221b2
Function at 0x72234f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 5]
mov byte [esp + 7], ch
jmp 0x7223c4
sub esp, 0x1e
rdtsc
pop word [esp + 0x19]
mov ecx, ebp
xchg byte [esp + 4], cl
btc eax, ebx
jmp 0x7223df
lea esp, [esp + 0x5e]
lea ecx, reloc.KERNEL32.dll_DuplicateHandle
mov ebp, dword [esp]
mov dl, byte [esp]
jmp 0x72243b
mov eax, dword [esp + 2]
lea ecx, [ecx - 0x13]
bsf bp, si
add esp, 7
mov word [esp], dx
lea edi, [eax*4]
jmp 0x722398
pop ecx
mov bl, bh
not di
pushal
push dword [esp + 0x2e]
pushal
jmp 0x7223ad
mov si, word [esp]
xor ebp, esi
add al, dh
inc edi
btc ecx, ebx
bsf si, si
jmp 0x722404
xchg bp, bx
cpuid
setae dh
xchg si, ax
clc
lea ecx, [edx + edi]
jmp 0x722423

Function at 0x722638
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr bx, bp
lea ebp, [eax - 0xc1]
not ebx
lea ebx, reloc.KERNEL32.dll_DuplicateHandle
mov ebx, dword [esp]
xchg si, bx
jmp 0x72249f
cld
bswap ebp
mov word [esp], bx
and dx, 0xae2
lea esi, [eax + ebx]
xchg ebx, ecx
jmp 0x72246b
mov ebx, 0x491556ee
mov esi, dword [esp]
rdtsc
lea edi, [esi*4]
lea eax, [edx*4]
jmp 0x722574
lea edi, reloc.KERNEL32.dll_DuplicateHandle
neg cx
xchg edx, ebp
mov word [esp], bx
neg ax
lea edx, [ebp + 7]
jmp 0x72248c
xchg bp, bx
xchg word [esp + 3], di
lea edx, [edx + edx]
mov dl, 0x74
push word [esp + 1]
add esp, 7
jmp 0x7224c0
cpuid
add esp, 0
neg ch
xchg dh, al
mov si, 0xd513
shr ecx, 7
jmp 0x722532
btr ebp, esp
xchg ebx, edi
btr edx, edx
mov dl, dh
xchg ah, bl
xchg byte [esp], cl
jmp 0x7224fd
mov edx, dword [esp]
push edx
mov si, di
pop word [esp]
inc ebx
inc cl
jmp 0x7225ab
popal
mov di, 0x8615
lea esi, [edx*4]
xchg dh, al
cld
sub esi, eax
jmp 0x722521
lea esp, [esp + 2]
xchg byte [esp], al
cpuid
pushal
inc di
rdtsc
jmp 0x722553
add esp, 0
lea edx, [ecx + edx]
lea esp, [esp]
shr eax, 0x17
and bp, 0xfbe2
rcr ecx, 0x11
jmp 0x7225f8
pop bx
mov ax, 0xd88f
mov byte [esp], ch
mov al, 0x9e
mov bp, 0x157d
mov eax, 0xc06d9326
jmp 0x722584
rdtsc
lea edi, [edx + ebp]
lea edx, [esi + edi]
call fcn.007225c1
loopne 0x72265f
jmp 0xc342a173
lea ecx, [ebp*4]
mov ch, byte [esp]
add esp, 0
mov edi, 0x286ea948
bsf ax, si
neg di
jmp 0x7225d7
mov si, di
btr edx, edx
jmp 0x7224e6
xchg edi, eax
dec cl
push 0x8e9b966
Function at 0x722989
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xb
jmp 0x722a0b
sub esp, 0xc
rdtsc
not bh
push esp
not edi
setbe bh
jmp 0x722a5a
rol di, cl
add esp, 1
sub esp, 0
lea ebp, [ecx + edi]
pushal
lea ebp, [edx + ebp]
jmp 0x7229ec
pushal
lea esp, [esp + 0x4b]
sub esp, 0x1e
lea eax, [edx + esi]
mov dword [esp + 5], esi
jmp 0x722ac9
pop word [esp + 0x21]
mov byte [esp + 0x2b], ch
neg bh
bswap ebp
pop dword [esp + 0x1a]
cmc
jmp 0x722a42
lea ecx, [ecx*4]
pop bp
xchg ch, dl
add esp, 0x1b
jmp 0x722d18
mov ebp, ecx
lea edx, [edi*4]
bswap ebx
rol ax, cl
rcr ecx, 0xf
jmp 0x722a99
push word [esp + 0x15]
bswap esi
mov esi, 0xa420e1c
xchg dword [esp + 4], eax
rdtsc
mov dword [esp + 9], ebp
jmp 0x722ab0
mov edx, esi
pop bx
call fcn.00722b9e
mov byte [esp + 0x11], bh
xchg si, dx
setle ah
lea esp, [esp + 0x19]
xchg dword [esp + 2], ebp
sub esp, 0
jmp 0x722ccd
lea esp, [esp]
mov ah, byte [esp]
call fcn.00722c8e
and al, 0xb4
sub cl, byte [ebp - 0x44]
sbb esp, dword [ecx]
pushal
mov dword [reloc.KERNEL32.dll_DuplicateHandle], eax
or eax, 0x8700c483
stc
ror edx, 0xd
add esp, 0
xchg ecx, edi
xor bp, 0x684c
mov bl, 0xd0
rdtsc
jmp 0x722c2f
rcr ch, 5
lea esi, [edi*4]
xchg ebx, esi
add esp, 9
mov al, ah
jmp 0x722c45
xchg bx, ax
cld
mov byte [esp + 2], ah
not dx
mov dword [esp], ebp
setle ah
jmp 0x722bdf
lea esp, [esp + 1]
mov word [esp], sp
mov di, word [esp]
mov byte [esp], dh
xchg byte [esp], bl
push word [esp + 1]
jmp 0x722ce5
Function at 0x723540
Capabilities:
Parse pe header

Disassembly:
call fcn.0072200f
call 0x72350c
push eax
jmp 0x72200a

Function at 0x72355b
Capabilities:
Parse pe header

Disassembly:
pushal
mov byte [esp + 0x20], ch
call fcn.007234e4