joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55fb2e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
pushal
jmp 0x55fb36
mov dword [esp + 0x10], edi
popal
jmp 0x55fbc8
cmc
sub esp, 0x13
push ax
mov byte [esp + 0x13], bh
lea esp, [esp + 1]
jmp 0x55fb95
and edi, ecx
mov edi, dword [edi*4 + 0x536e98]
and ebx, ecx
jmp 0x55fb5c
lea esp, [esp + 2]
jmp 0x55fbab
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0x537698]
sub esp, 6
xchg dword [esp], ebx
rcl bx, cl
jmp 0x55fb7f
push eax
mov eax, esi
add eax, 0xa
jmp 0x55fc91
lea ebx, [ebx*4]
lea ebx, [ebx + 0x536a98]
mov edi, dword [ebx]
pop ebx
stc
jmp 0x55fb72
lea esi, [esi + 0x536a98]
mov edx, dword [esi]
pop esi
jmp 0x55fbfd
push esi
mov esi, edx
lea esi, [esi*4]
jmp 0x55fbdb
and edx, ecx
xor edi, dword [edx*4 + 0x537a98]
mov dx, bp
mov dh, ch
jmp 0x55fc40
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x537298]
movzx ebx, byte [esi + 0xd]
and edx, ecx
jmp 0x55fbf1
mov edx, dword [esi + 0xc]
call 0x55fc2a
fist dword [edi - 0x39]
mov byte [0xc8439a51], al
pop esi
cmp eax, ecx
jnp 0x55fc44
loop 0x55fc45
invalid
invalid
cmc
pushfd
outsd dx, dword [esi]
fst qword [ebx + ecx*4]
sbb al, 0x9d
cwde
push 0x53
add byte [esi + 0x57], ah
mov ebx, dword [ebx*4 + 0x536a98]
push di
lea esp, [esp + 2]
and ebx, ecx
jmp 0x55fc17
movzx ebx, byte [eax]
pop eax
push si
add esp, 1
lea esp, [esp + 1]
jmp 0x55fc5b

Function at 0x55fcb6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
jmp 0x55fcd9
shr edi, 0x18
push esi
mov edi, dword [edi*4 + 0x536a98]
jmp 0x55fca0
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + 0x537698]
jmp 0x55fce5
mov edi, dword [edi*4 + 0x536e98]
and ebx, ecx
pushal
jmp 0x55fcc3
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + 0x536a98]
clc
jmp 0x55fd1c
sub esp, 0x1c
pop edi
pop ecx
mov dword [esp + 0x14], edx
push bp
call fcn.0055fd22
jo 0x55fd8b
push 0xffffffffffffff85
xor al, 0x27
and edx, ecx
push edi
pushal
jmp 0x55fd06
dec esi
std
invalid

Function at 0x55fd22
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ecx
jmp 0x55fd67
mov edx, dword [edi]
pop edi
sub esp, 1
call 0x55fd4e
salc
lea esp, [esp + 1]
jmp 0x55fd95
lea esp, [esp + 2]
lea esp, [esp + 0x18]
popal
lea edi, [edi*4]
lea edi, [edi + 0x536a98]
jmp 0x55fd42
and edx, ecx
push ecx
mov dword [esp], ebx
jmp 0x55fdf5
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x537298]
jmp 0x55fd7f
mov dword [esi + 0xc], edi
jmp 0x55fe1c
pop word [esp]
mov byte [esp], dl
lea esp, [esp + 2]
jmp 0x55fdc4
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x537a98]
dec dword [ebp - 4]
pushfd
jmp 0x55fdda
jne 0x52bf40
Function at 0x55fd4e
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ecx
jmp 0x55fd67
mov edx, dword [edi]
pop edi
sub esp, 1
call 0x55fd4e
salc
lea esp, [esp + 1]
jmp 0x55fd95
lea esp, [esp + 2]
lea esp, [esp + 0x18]
popal
lea edi, [edi*4]
lea edi, [edi + 0x536a98]
jmp 0x55fd42
and edx, ecx
push ecx
mov dword [esp], ebx
jmp 0x55fdf5
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x537298]
jmp 0x55fd7f
mov dword [esi + 0xc], edi
jmp 0x55fe1c
pop word [esp]
mov byte [esp], dl
lea esp, [esp + 2]
jmp 0x55fdc4
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x537a98]
dec dword [ebp - 4]
pushfd
jmp 0x55fdda
jne 0x52bf40

Function at 0x56013b
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
mov byte [esp], dl
lea esp, [esp + 2]
jmp 0x560183
lea esp, [esp + 4]
push ebx
push ecx
jmp 0x560125
mov edi, eax
clc
jmp 0x5601c3
push edi
lea edi, [eax + ebp]
mov edi, 0x5944392b
bswap edi
jmp 0x56016d
mov al, byte [ecx]
cmp al, 0x41
call 0x5601a6
cmp al, 0x7a
pushal
push dword [esp + 0x1e]
jmp 0x56021b

Function at 0x560472
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x560679
lea esp, [esp + 8]
jbe 0x52c139
ja 0x52c165
Function at 0x5604d3
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.00560205
sbb dword [eax + 0x5b], edi
mov dl, 0x51
cmc
jae 0x52c034
mov cl, 0x8e
aas
pop ebp
fbld tbyte [esi]
push ecx
sar byte [eax + 0x403], 1
push edx
push word [esp]
jmp 0x560396
mov dl, byte [ecx + 2]
call 0x5603ff
xchg ebp, eax
add al, 0x8b
cmpsb byte [esi], byte es:[edi]
pop ebx
pop edi
call 0x3df750bf
xor byte [edx + 0x74], cl
cmp bl, 0x2b
jmp 0x5603da
call 0x56046c
lcall 0xe156, 0x948bb759
push ebp
ret
cmp dl, 0x30
jmp 0x56059f
cmp dl, 0x2b
jmp 0x5604e9
dec dword [edi]
xchg dword [esi], ebx
mov edi, 0x7ae8fffc
invalid
jp 0x560208
invalid
call 0x560284
jne 0x5601fe
add byte [ebp - 0xe], dh
pushal
pop es
inc esp
jne 0x560209
add dh, cl
dec edi
push 0xffffffffffffff85
xor al, 0x27
dec esi
lea esp, [esp + 0x24]
jbe 0x52c0c9
ja 0x52c087
ficomp word [ecx - 0x37]
test al, 0x5b
wait
xor byte [edx + 0x7fba4f28], bh
sbb esi, dword [edx + 0x6d]
jl 0x56028b
salc
call fcn.00560a84
dec eax
rcl dword [ecx + 0x30], 0xc3
jb 0x560212
inc edi
xlatb
mov dl, 0x41
invalid
frstor dword [esi - 1]
xor al, 0x24
lea esp, [esp + 2]
and al, 2
jmp 0x5602c8
lea esp, [esp + 4]
cmp al, 0x2b
call fcn.005602b2
in al, 0x75
in eax, 0x8c
jg 0x560291
mul byte [esi - 0xc]
xchg ebx, eax
outsb dx, byte [esi]
fst qword [edi]
jle 0x56032b
call 0x483f85f2
sub ecx, 0x47
jmp fcn.00560713
cmp bl, 0x61
call fcn.0056036b
movsb byte es:[edi], byte [esi]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0x8d31
lea esp, [esp + 2]
lea esp, [esp + 4]
mov bl, byte [ecx + 1]
call fcn.00560310
lea esp, [esp + 4]
cmp bl, 0x7a
call fcn.00560373
cmp bl, 0x30
pushal
mov byte [esp + 3], ah
lea esp, [esp + 2]
mov word [esp + 0xe], dx
jmp 0x560434
je 0x52c0f5
jne 0x560415
sbb eax, 0x81721787
cmp esp, dword [ebp + 0x38c9ae38]
invalid
cmp bl, 0x39
jbe 0x52c0f5
ja 0x52c10b
jmp 0x56045b
cmp bl, 0x2f
jne 0x52c09d
je 0x52c0f5
rol byte [eax - 0x2a], 0xb1
inc eax
cmc
jle 0x560429
insd dword es:[edi], dx
hlt
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
jb 0x52c10b
stc
jmp 0x5603f0
lea esp, [esp + 2]
jmp 0x56048b
lea esp, [esp + 4]
cmp dl, 0x41
jb 0x52c14f
push si
jmp 0x560445
cmp dl, 0x5a
jbe 0x52c139
ja 0x52c14f
cmp dl, 0x61
jb 0x52c165
cmp dl, 0x7a
pushfd
call fcn.00560472
sub byte [ecx + 0x12a35031], ah
push 0xffffffffffffffe2
jo 0x5604cd
loop 0x56050a
mov dword [0x572435da], eax
cmp cl, 0x5a
pushal
mov dword [esp + 2], ebp
jmp 0x560b1c
mov ch, 0x44
or byte [ecx + 0x5beb4b28], 0xee
pushal
not byte [ecx - 0x62ef2fa0]
or eax, 0x6264a754
out dx, al
jl 0x560500
test byte [ebp + 0x7f], 0x46
je 0x52c139
cmp dl, 0x2f
je 0x52c139
call 0x5604d3
invalid
xor byte [ebx - 0x40], 0xf0
ljmp 0x39fa
cmp dl, 0x39
jbe 0x52c139
cli
cmp dword [edi], ecx
xchg byte [edi], ah
mov esp, 0x870ffffc
lahf
mov esp, 0x648dfffc
lea esp, [esp + 4]
ja 0x52c1b7
jb 0x52c1b7
sub esp, 0x1b
add esp, 0xe
lea esp, [esp + 1]
lea esp, [esp + 0xc]
jmp 0x560509
sub ecx, 0x41
jmp fcn.00560713
lea esp, [esp + 0x20]
movzx ecx, cl
ja 0x5602e4
jmp 0x560a66
Function at 0x560518
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.00560205
sbb dword [eax + 0x5b], edi
mov dl, 0x51
cmc
jae 0x52c034
mov cl, 0x8e
aas
pop ebp
fbld tbyte [esi]
push ecx
sar byte [eax + 0x403], 1
push edx
push word [esp]
jmp 0x560396
mov dl, byte [ecx + 2]
call 0x5603ff
xchg ebp, eax
add al, 0x8b
cmpsb byte [esi], byte es:[edi]
pop ebx
pop edi
call 0x3df750bf
xor byte [edx + 0x74], cl
cmp bl, 0x2b
jmp 0x5603da
call 0x56046c
lcall 0xe156, 0x948bb759
push ebp
ret
cmp dl, 0x30
jmp 0x56059f
cmp dl, 0x2b
jmp 0x5604e9
dec dword [edi]
xchg dword [esi], ebx
mov edi, 0x7ae8fffc
invalid
jp 0x560208
invalid
call 0x560284
jne 0x5601fe
add byte [ebp - 0xe], dh
pushal
pop es
inc esp
jne 0x560209
add dh, cl
dec edi
push 0xffffffffffffff85
xor al, 0x27
dec esi
lea esp, [esp + 0x24]
jbe 0x52c0c9
ja 0x52c087
ficomp word [ecx - 0x37]
test al, 0x5b
wait
xor byte [edx + 0x7fba4f28], bh
sbb esi, dword [edx + 0x6d]
jl 0x56028b
salc
call fcn.00560a84
dec eax
rcl dword [ecx + 0x30], 0xc3
jb 0x560212
inc edi
xlatb
mov dl, 0x41
invalid
frstor dword [esi - 1]
xor al, 0x24
lea esp, [esp + 2]
and al, 2
jmp 0x5602c8
lea esp, [esp + 4]
cmp al, 0x2b
call fcn.005602b2
in al, 0x75
in eax, 0x8c
jg 0x560291
mul byte [esi - 0xc]
xchg ebx, eax
outsb dx, byte [esi]
fst qword [edi]
jle 0x56032b
call 0x483f85f2
sub ecx, 0x47
jmp fcn.00560713
cmp bl, 0x61
call fcn.0056036b
movsb byte es:[edi], byte [esi]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0x8d31
lea esp, [esp + 2]
lea esp, [esp + 4]
mov bl, byte [ecx + 1]
call fcn.00560310
lea esp, [esp + 4]
cmp bl, 0x7a
call fcn.00560373
cmp bl, 0x30
pushal
mov byte [esp + 3], ah
lea esp, [esp + 2]
mov word [esp + 0xe], dx
jmp 0x560434
je 0x52c0f5
jne 0x560415
sbb eax, 0x81721787
cmp esp, dword [ebp + 0x38c9ae38]
invalid
cmp bl, 0x39
jbe 0x52c0f5
ja 0x52c10b
jmp 0x56045b
cmp bl, 0x2f
jne 0x52c09d
je 0x52c0f5
rol byte [eax - 0x2a], 0xb1
inc eax
cmc
jle 0x560429
insd dword es:[edi], dx
hlt
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
jb 0x52c10b
stc
jmp 0x5603f0
lea esp, [esp + 2]
jmp 0x56048b
lea esp, [esp + 4]
cmp dl, 0x41
jb 0x52c14f
push si
jmp 0x560445
cmp dl, 0x5a
jbe 0x52c139
ja 0x52c14f
cmp dl, 0x61
jb 0x52c165
cmp dl, 0x7a
pushfd
call fcn.00560472
sub byte [ecx + 0x12a35031], ah
push 0xffffffffffffffe2
jo 0x5604cd
loop 0x56050a
mov dword [0x572435da], eax
cmp cl, 0x5a
pushal
mov dword [esp + 2], ebp
jmp 0x560b1c
mov ch, 0x44
or byte [ecx + 0x5beb4b28], 0xee
pushal
not byte [ecx - 0x62ef2fa0]
or eax, 0x6264a754
out dx, al
jl 0x560500
test byte [ebp + 0x7f], 0x46
je 0x52c139
cmp dl, 0x2f
je 0x52c139
call 0x5604d3
invalid
xor byte [ebx - 0x40], 0xf0
ljmp 0x39fa
cmp dl, 0x39
jbe 0x52c139
cli
cmp dword [edi], ecx
xchg byte [edi], ah
mov esp, 0x870ffffc
lahf
mov esp, 0x648dfffc
lea esp, [esp + 4]
ja 0x52c1b7
jb 0x52c1b7
sub esp, 0x1b
add esp, 0xe
lea esp, [esp + 1]
lea esp, [esp + 0xc]
jmp 0x560509
sub ecx, 0x41
jmp fcn.00560713
lea esp, [esp + 0x20]
movzx ecx, cl
ja 0x5602e4
jmp 0x560a66

Function at 0x560540
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
mov cl, byte [ecx + 3]
cmp cl, 0x41
jmp 0x560583
jb 0x52c1a1
cmp cl, 0x5a
jmp 0x56056d
Function at 0x560661
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
je 0x52c1fb
stc
jmp 0x56064b

Function at 0x560764
Capabilities:
Encrypt data using aes

Disassembly:
cmp al, 0x2f
jne 0x55fe84
call 0x560766
sub al, 0xae
cmp al, 0x5b
mov dh, 1
ret
pop eax
jmp 0x5600bd
lea esp, [esp + 8]
jne 0x55fe5c
je 0x56077c
in eax, dx
cmc
pushfd
outsd dx, dword [esi]
test al, 0x14
xchg dword [esi], ebp
cmp ebx, ebp
jmp 0x56074e
jmp 0x560783
adc dword [edx + 0x299a6f08], ebx
jno 0x56076f
outsd dx, dword [esi]
or bh, cl
mov bh, 0x59
rol byte [esi + 0x21], 1
rcl byte [esi]
int 0x5c
jmp 0x56074e
push 0x3e
jmp 0x55fe9a

Function at 0x560830
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
mov bl, byte [ebp - 1]
jmp 0x55fe40
inc ebx
mov dword [edi], ebx
push esi
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x560729
lea esp, [esp + 8]
jmp 0x56073f

Function at 0x61afc3
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl bl, 2
push dx
pop word [esp]
mov ax, 0xe213
jmp 0x61afdc
lea esp, [esp + 0xa]
bswap ebp
mov ecx, dword [esp + 2]
add esp, 2
mov bl, dh
mov cl, byte [esp + 1]
jmp 0x61af84
cmc
jmp 0x61af9a
mov byte [esp + 1], dh
stc
xchg esi, ecx
mov bp, 0xa57d
rdtsc
mov dl, byte [esp]
jmp 0x61bcd4
mov esi, 0xc77b0c01
lea edi, [ebp + 0xc3de]
lea ecx, [edx + ebx]
cld
inc edi
rol ebp, cl
jmp 0x61afc6
cpuid
mov byte [esp + 3], ch
std
push dword [esp + 0xd]
push dword [esp + 1]
jmp 0x61b013
push dx
push esi
inc di
bswap eax
mov bl, 0x6e
mov bl, dl
jmp 0x61aff0
lea edx, [esi + 0x86]
clc
pop ecx
cld
bsf esi, eax
rdtsc
jmp 0x61b0d6
rdtsc
sub esp, 7
xchg byte [esp + 1], bl
mov cl, byte [esp + 0xc]
clc
cld
jmp 0x61b006
lea esi, [esp + 0x5694]
mov ebx, 0x6a874e03
call fcn.0061b0a1
pushfd
mov bp, 0xb279
sub esp, 0x10
xchg dx, cx
bt bx, cx
lea ecx, [ecx + 0x7c131562]
jmp 0x61b02d
mov ecx, 0xcfe6d9da
push word [esp + 4]
lea ecx, [esp - 0x7f1cdcda]
and bh, bl
lea edi, [esi*4]
xchg byte [esp + 4], dh
jmp 0x61b15d
xchg ch, al
push word [esp]
xchg dword [esp], ebx
mov bl, bh
mov dx, 0xa54e
xchg dword [esp], ecx
jmp 0x61b406

Function at 0x61b20a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
push edx
rdtsc
mov bx, 0xbf8c
mov ebx, ebp
sub esp, 7
jmp 0x61b215
xchg di, cx
rdtsc
add esp, 1
not dh
bswap ebp
mov ch, bl
jmp 0x61b1d0
xchg word [esp + 3], bx
mov dword [esp + 3], ecx
jmp 0x61b1e6
mov bl, 0xfd
push word [esp + 0x1a]
pop word [esp + 0x10]
pop word [esp + 0x14]
stc
mov si, cx
jmp 0x61b27b
mov di, 0x7b03
mov al, 0x8e
push dword [esp + 3]
xchg dx, ax
add esp, 0xa
cpuid
jmp 0x61b245
mov bx, word [esp + 0x11]
add esp, 0xa
pop dword [esp + 6]
cld
xchg dword [esp + 1], edi
pop eax
jmp 0x61b25b

Function at 0x61b810
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0x70a1
mov dh, 0x8c
setae bh
std
push word [esp + 2]
jmp 0x61b82d
Function at 0x61b945
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esp - 0x2033]
lea eax, [esi*4]
lea edx, [eax - 0x512c]
add esp, 3
lea eax, [edi + ebp]
jmp 0x61b966
pop edx
pop dword [esp]
cld
mov ax, 0x36f5
jmp 0x61b925
bswap esi
inc al
rdtsc
rdtsc
mov cl, ah
jmp 0x61b979
std
or ax, 0xb2cc
lea esp, [esp + 1]
adc ah, 0xe0
bswap esi
mov bl, byte [esp]
jmp 0x61b950
lea ecx, [ebx*4]
cpuid
setp bl
not bp
mov al, 0x6d
cpuid
jmp 0x61b9e4
push bp
setbe dh
stc
lea esp, [esp]
mov al, dh
xchg ah, cl
jmp 0x61ba0b
bswap edi
add esp, 0
mov ebp, dword [esp]
dec ah
xchg bx, si
mov bx, word [esp]
jmp 0x61b9b7
std
mov al, ah
mov dx, 0x81bb
std
lea esp, [esp]
bts dx, ax
jmp 0x61b9cd
mov di, ax
bsf eax, edx
cpuid
add esp, 0
seto ah
xchg cl, ch
jmp 0x61ba33
bsr edx, esi
pop cx
lea esp, [esp]
neg ax
neg ch
add esp, 0
jmp 0x61b9f5
add esp, 0
cpuid
mov esi, dword [esp]
mov eax, dword [esp]
sub esp, 2
cpuid
jmp 0x61ba89
lea esp, [esp]
std
mov cl, ch
xchg byte [esp], ch
lea ebp, [edi - 0x11cf]
bt ebp, ecx
jmp 0x61ba1d
add esp, 2
mov ebp, 0x80672cc
add esp, 0
call fcn.0061bab3
scasb al, byte es:[edi]
cmp byte [esi - 0x7f72c737], ch
adc eax, 0xb41fec85
adc al, byte [esi + 0x3a8e7314]
mov bh, 0x9e
jmp 0xff4b45f3
mov bp, cx
inc dh
bsr eax, edi
rdtsc
rdtsc
lea edi, [edi - 0x2cb3]
jmp 0x61ba64

Function at 0x61c909
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
pop ax
xchg edx, eax
neg dh
bswap eax
lea esi, [eax + edi]
jmp 0x61c80f
pop si
not si
neg dx
mov dl, bh
mov ax, word [esp + 2]
mov dx, word [esp]
jmp 0x61c7e4
setp ah
rcr ax, 0xa
sub esp, 4
pop edx
xchg si, ax
lea eax, [ecx + edx]
jmp 0x61c853
mov esi, dword [esp]
bts eax, edx
add esp, 1
lea esp, [esp]
pushal
add esp, 0x1c
jmp 0x61c7fa
mov dh, 0xcc
xchg byte [esp], ah
rdtsc
inc ax
sbb si, 0xb8ef
cmc
jmp 0x61c8cd
rdtsc
not ah
xchg al, dl
btr edx, eax
mov byte [esp], dl
mov dl, byte [esp]
jmp 0x61c83d
lea esp, [esp + 9]
xchg word [esp], ax
lea eax, [ebx*4]
add esp, 2
xchg esi, eax
lea eax, [edx*4]
jmp 0x61c82b
bswap eax
rdtsc
xchg byte [esp], dl
pop si
mov ax, dx
bsf edx, eax
jmp 0x61c8a9
xchg edx, eax
xchg ah, dl
push esp
clc
pop si
mov ah, dh
jmp 0x61c888
mov eax, dword [esp]
dec ah
xchg al, ah
btr ax, cx
xchg esi, eax
mov si, word [esp]
jmp 0x61c8e0
lea eax, [ebp + 0x54]
mov si, dx
add esp, 0
mov dh, 0x8c
not ax
xchg si, dx
jmp 0x61c89e
bsf ax, cx
dec dl
stc
mov eax, dword [esp]
lea esp, [esp]
mov ah, byte [esp]
jmp 0x61c933
push esp
stc
rcr esi, 0
mov edx, dword [esp + 1]
lea eax, [edi + edi]
inc dl
jmp 0x61c91d
xchg dx, si
mov dh, bh
setae dl
mov dl, byte [esp + 0xb]
mov si, ax
jmp 0x61c86b
lea esi, [esp - 0x1cd2]
rcl dl, 1
clc
call fcn.0061c960
fistp word [ebx - 0x35]
scasb al, byte es:[edi]
pop ebp
mov ecx, 0x9ebe663e
pop edi
mov si, 0x5f9e
setle al
lea esp, [esp]
add esp, 0
rdtsc
mov ah, cl
jmp 0x61c8f2
Function at 0x61c99f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
pop word [esp]
not ah
add esp, 0
inc ax
mov dl, bl
jmp 0x61c9b7
add esp, 3
bswap eax
lea eax, [ecx + ecx]
rdtsc
mov si, word [esp]
mov edx, 0xf90dc19d
jmp 0x61c96a
jmp 0x61c980
stc
mov si, word [esp]
pop ax
dec al
lea esi, [ebx*4]
jmp 0x61c9f6
mov ah, byte [esp + 3]
lea esp, [esp + 2]
xchg al, ah
mov si, 0xbbd2
lea eax, [ebp*4]
bt dx, bp
jmp 0x61c9a1
Function at 0x61cccc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xchg dword [esp + 8], edx
pop ax
mov dx, 0x4d8f
setb dl
jmp 0x61cd00
mov esi, dword [esp + 3]
rdtsc
cld
jmp 0x61ccb6
lea edx, [esi + 0xa166]
rdtsc
pop si
lea esp, [esp + 0x1c]
cld
setbe dl
jmp 0x61cd2d
rdtsc
push word [esp + 1]
add esp, 6
rdtsc
bswap eax
sub esp, 6
jmp 0x61cd17
xchg word [esp + 0xd], dx
cmp ax, 0x65d7
rdtsc
lea edx, [ecx - 0x4b]
push dword [esp]
xchg dword [esp + 0x11], esi
jmp 0x61ccd5
mov word [esp + 2], bx
mov word [esp + 3], bx
mov byte [esp + 4], bl
jmp 0x61cd88
mov dh, al
mov al, byte [esp]
sub esp, 5
lea esi, [esi - 0xbb]
mov dx, bp
lea esp, [esp + 3]
jmp 0x61cce9
bsr si, cx
bt si, bp
rol dx, cl
setle al
jmp 0x61cf04
mov dx, 0x4a10
mov word [esp], bx
mov ax, 0x571e
xchg word [esp], dx
mov al, byte [esp + 2]
mov esi, dword [esp]
jmp 0x61cd50
mov dh, 0x32
mov dword [esp], esp
mov dh, 0xd9
clc
mov esi, dword [esp + 2]
pop edx
jmp 0x61cd66
lea edx, [esp - 0x73]
lea edx, [edx + ebx]
pop dword [esp]
mov byte [esp + 4], ch
push word [esp]
neg dl
jmp 0x61cded
lea eax, [ecx*4]
pop dword [esp + 0x15]
lea esp, [esp + 7]
mov dx, 0x11de
lea esp, [esp + 0xc]
cld
jmp 0x61cd97
btr esi, eax
mov dl, 0xbc
lea edx, [edx + ebp]
sub esp, 6
mov byte [esp + 5], bl
pop esi
jmp 0x61ceca
bswap esi
bswap esi
mov dl, 0xff
rcl dx, cl
lea esi, [edx + esi]
add esp, 7
jmp 0x61cdd7
lea esi, [ebx - 0x4d98]
mov word [esp], ax
dec al
stc
sub esp, 0x1e
cld
jmp 0x61cdbd
lea esp, [esp + 2]
xchg byte [esp], dh
lea esi, [ecx + edi]
cld
neg dx
cld
call fcn.0061ce19
bts edx, edx
mov edx, 0x282f9d62
xchg word [esp], dx
bts edx, edx
jmp 0x61ce63
pop word [esp]
xchg esi, edx
inc ax
adc al, al
mov word [esp], bx
lea esi, [ebp + 0xaf0e]
jmp 0x61cea6
pop dx
xchg word [esp + 0xa], si
pop si
dec dh
mov eax, ecx
neg eax
jmp 0x61cee2
xchg word [esp], si
stc
xchg byte [esp + 1], dh
sub esp, 0x16
bsf si, si
mov eax, 0x1d275db9
jmp 0x61ce90
mov edx, ecx
cmp eax, 0xd47f8552
xchg ah, al
xchg dx, ax
mov byte [esp + 1], al
lea eax, [eax - 0x5c]
jmp 0x61ce2f
pop edx
rdtsc
not si
mov byte [esp], bl
bsr edx, eax
mov esi, 0xd5da15ac
jmp 0x61cf93
add esp, 0
lea eax, [edx*4]
xchg byte [esp], dl
rdtsc
mov word [esp], dx
lea eax, [esi + 0x2c67e0f]
jmp 0x61ce06
mov word [esp + 7], ax
push word [esp + 0x12]
neg si
jmp 0x61cf63
push dword [esp + 0x14]
inc esi
lea esi, [ecx + esi]
and esi, esi
xchg dh, al
shr dl, cl
jmp 0x61cf22
mov edx, 0x489b88cb
bsf esi, ecx
xchg ah, dl
mov byte [esp + 0xc], bl
std
neg dl
call fcn.0061cf7a
add bh, byte [ebp + 0x66661f8c]
mov eax, dword [esp + 0xd]
mov ax, word [esp + 0xd]
push dword [esp + 1]
push word [esp + 0x10]
mov dh, al
neg ax
xchg dl, ah
jmp 0x61cf48
xchg dword [esp + 0xa], esi
xchg byte [esp + 4], dh
std
lea edx, [esi*4]
push si
push cx
jmp 0x61cf38
Function at 0x61d0a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edi*4]
lea eax, [ebx + 0x86]
mov byte [esp + 2], dl
jmp 0x61d08a
pushfd
not eax
neg dh
neg dh
inc dh
rdtsc
jmp 0x61d04e
mov al, byte [esp + 0x13]
bswap eax
xchg si, ax
sub esp, 0x11
push dword [esp + 0x11]
jmp 0x61d0b9
lea eax, [esp + edi]
mov byte [esp + 0x16], dl
push dword [esp + 0x17]
cmp edx, ebp
mov ah, 0xd5
jmp 0x61d074
jmp 0x61d067
inc eax
lea esi, [ebx + edi]
stc
lea edx, [esp + ecx]
bsr edx, ebp
lea esp, [esp + 5]
jmp 0x61d0d1
rdtsc
xchg word [esp + 0x17], si
mov eax, 0xe7a6e867
mov esi, 0xb1f77c3
add esp, 0xc
xchg dl, ah
jmp 0x61d0a3
stc
pop si
pop ax
pop eax
mov ah, byte [esp + 3]
xchg ah, dl
jmp 0x61d1f7
add esp, 0xf
call 0x61d1ca
rcl eax, cl
rdtsc
mov al, 0x5e
bsf eax, ebx
mov esi, edx
xchg ah, dh
jmp 0x61d212
sete al
mov ax, si
neg si
xchg dx, si
mov eax, 0xb8c7f093
jmp 0x61d402
xchg si, dx
xor esi, 0x7f3d2b43
cld
rdtsc
mov si, word [esp + 2]
not ah
call fcn.0061d2a4
sub eax, 0xb8492eb8
adc dword [0x9f6c0595], ecx
sub dword [edi + esi - 0x504b96e2], eax
mov ah, 0xaf
bswap edx
lea edx, [esp + 0x93]
sub esp, 0x16
sub esi, ebx
lea esi, [ebp - 0x9c0f]
jmp 0x61d23e
mov ax, word [esp]
lea edx, [eax + ecx]
setl dh
rdtsc
xchg si, ax
xchg si, ax
jmp 0x61d266

Function at 0x61d2a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, bx
add esp, 0x15
pop word [esp]
lea eax, [esi + ebp]
xchg byte [esp], al
push word [esp]
jmp 0x61d2d4
jmp 0x61d27e
mov si, sp
push word [esp + 2]
rdtsc
cmc
push eax
call fcn.0061d2bc
xchg edx, eax
pop ax
sub esp, 0x17
stc
pop dx
btc dx, ax
jmp 0x61d2f8
mov byte [esp + 0x1f], ah
call fcn.0061d324
loopne 0x61d365
invalid
sahf
sbb eax, 0xc727d48d
call 0x76fdcfde
lahf
cli
adc dword [ebx], 0x76
test dword [ebx - 0x3a], esp

Function at 0x61d2bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
std
lea esp, [esp]
bswap edx
setne al
clc
jmp 0x61d33f
xchg byte [esp + 5], dl
jmp 0x61d2a6
xchg edx, eax
shr ax, cl
push dword [esp + 4]
setg dl
mov ax, bp
rdtsc
jmp 0x61d2e5
mov si, word [esp]
setne dl
bswap edx
mov eax, 0xa59ae44d
mov dword [esp], esp
setle ah
jmp 0x61d311
Function at 0x61d42e
Capabilities:
Execute anti-debugging instructions

Disassembly:
setle dh
lea esp, [esp + 1]
mov dx, word [esp]
mov al, 0xe5
mov dh, dl
jmp 0x61d46c
lea esp, [esp + 4]
not al
setp ah
xchg byte [esp], dh
jmp 0x61d418
mov edx, ebp
mov dx, di
xchg dx, ax
add esp, 0
std
rdtsc
jmp 0x61d456

Function at 0x61d686
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call 0x61d144
jmp 0x61d6e5
lea esp, [esp + 0x38]
jmp 0x61d6b2
push word [esp + 1]
push dword [esp + 5]
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x38], edi
jmp 0x61d670
mov eax, dword [eax]
jmp 0x61d6c0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x61d69c
mov eax, dword [eax + 8]
push eax
jmp 0x61d13f

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx