joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f01c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x455bb0]
cmp dword [eax + 0x30], 0
je 0x44f0c6
cmp dword [ebx + 0x94], 0
jne 0x44f0c0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44efac
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44f0c0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44f086
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44f0c0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413760
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44f095
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44fc28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44fc5d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f54
jmp 0x44fc6a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403eb8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450cbc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x450cfd
mov eax, esi
call fcn.00437484
test al, al
je 0x450cfd
mov eax, dword [ebx + 0x84]
call fcn.00437180
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450cfd
push 0
mov eax, dword [ebx + 0x84]
call fcn.00437180
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x451e28
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004066b0
ret

Function at 0x4524b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
xor edx, edx
push ebp
push 0x45253d
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
xor edx, edx
mov dword [ebp - 4], edx
mov byte [ebp - 7], al
mov byte [ebp - 6], 0x3a
mov byte [ebp - 5], 0x5c
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x114]
lea eax, [ebp - 7]
call fcn.004084f0
mov eax, dword [ebp - 0x114]
call fcn.00404324
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x452524
mov ebx, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452544
lea eax, [ebp - 0x114]
call fcn.00403e64
ret
Function at 0x50e053
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x18], edx
call fcn.0050db38
add cl, bl
mov edx, eax
not ax
jmp 0x50e0ea
shr al, 3
js 0x50e13c
jns 0x50e13c
mov edx, dword [esp]
rol al, 0
mov dx, word [esp]
rcl dx, 5
ja 0x50e126
sub esp, 0x16
add esp, 4
lea esp, [esp + 2]
jmp 0x50e2bd
jmp 0x50e30c
mov al, cl
mov edx, eax
mov dh, byte [esp]
jmp 0x50e0f1
mov dx, word [esp]
jmp 0x50e254
mov dx, word [esp]
call fcn.0050e185
lea esp, [esp + 0x14]
neg al
setle dh
mov dx, bp
jmp 0x50e28b
neg dh
jmp 0x50e29d
lea edx, reloc.kernel32.dll_DeleteCriticalSection
add bl, al
jb 0x50e275
neg dh
jmp 0x50e2e7
mov ah, bh
dec ebp
lea edx, [esi*4]
add dx, 0x2f00
jg 0x50e2d1
mov edx, dword [esp]
jmp 0x50e39d
lea esp, [esp + 0x10]
neg al
sbb edx, 0xc9401ee0
jp 0x50e250
jnp 0x50e19e
jmp 0x50e2eb
mov ah, bh
jmp 0x50e29f
mov edx, dword [esp]
lea eax, [edx*4]
seto dl
or ax, cx
mov edx, dword [esp]
mov al, 0x41
rdtsc
jmp 0x50e32e
sub esp, 0x16
add esp, 4
lea esp, [esp + 2]
jmp 0x50e2bd
neg dh
call fcn.0050e37f
jl 0x50e320
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
sbb al, 0x5a
rol byte [esi + 0x21], 1
rcr ah, 1
int 0x5c
scasd eax, dword es:[edi]
lea eax, [ebp*4]
neg cl
rcl al, 7
jno 0x50e318
jo 0x50e346
mov edi, 0x3ccdaa34
pop ebp
mov eax, dword [reloc.kernel32.dll_DeleteCriticalSection]
sal byte [esi + 0x7e4c0d0], 1
neg dh
jmp 0x50e31a
jp 0x50e369
mov dh, byte [esp]
jmp 0x50e3ac
mov edx, dword [esp]
jmp 0x50e2fe
mov dh, byte [esp]
mov ax, word [esp]
jmp 0x50ed11
lea eax, [edx*4]
seto dl
or ax, cx
jmp 0x50e364
mov ax, word [esp]
jmp 0x50ed11
not eax
jmp 0x50eb2d
not eax
neg dh
push dword [esp + 6]
rcr dx, 7
pop ax
jmp 0x50ead7
mov edx, ecx
not ah
sub esp, 0x1e
jno 0x50e81f
jo 0x50e809
dec edi
int3
xchg ah, al
bswap eax
lea edx, [eax*4]
xchg dx, ax
jmp 0x50e7d4
mov dh, ch
mov eax, ecx
jmp 0x50e854
lea esp, [esp + 2]
jmp 0x50e823
lea esp, [esp + 2]
mov eax, 0x2f3b0725
shl edx, 2
jmp 0x50e8bb
mov eax, ecx
mov ax, 0x12a9
not eax
mov eax, esi
setae al
jmp 0x50db3d
mov eax, dword [esp]
mov dh, ch
mov eax, ecx
lea esp, [esp + 0x1c]
inc cl
jmp 0x50e7ea
not eax
mov eax, esi
setae al
jmp 0x50db3d
jae 0x50e831
mov eax, ecx
mov ax, 0x12a9
jmp 0x50e874
mov edx, dword [esp]
rol dx, 3
jae 0x50e84d
mov eax, dword [esp]
jmp 0x50e803
pop ax
mov dh, 0xce
rdtsc
ror cl, 0
jmp 0x50e8f5
neg dh
push dword [esp + 6]
rcr dx, 7
jmp 0x50ead5
lea esp, [esp + 4]
xor cl, 0x2f
sub esp, 0x1a
jl 0x50e3b5
jge 0x50e3bd

Function at 0x50e185
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx*4]
inc dx
js 0x50e1dd
pushfd
call fcn.0050e1bd
adc cl, byte [ebp - 0x498990e4]
mov dh, 0x32
lea esp, [esp + 4]
dec al
mov dx, 0x3fe8
mov dh, 0x32
lea esp, [esp + 4]
dec al
mov dx, 0x3fe8
jmp 0x50e16f
pushfd
lea esp, [esp + 4]
add al, 0x26
sub esp, 0x12
jl 0x50e1ff
push dword [esp + 0xb]
jmp 0x50e201
jmp 0x50e233
bswap edx
mov edx, 0xc18b5674
mov dh, byte [esp + 8]
jmp 0x50e26f
push dword [esp + 0xb]
bswap edx
mov edx, 0xc18b5674
mov dh, byte [esp + 8]
lea esp, [esp + 2]
jmp 0x50e259
lea esp, [esp + 2]
jmp 0x50e259
Function at 0x50ef08
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xfbe82075
jmp 0x50f209
jmp 0x50ef45
not eax
add bl, dl
jb 0x50ef76
lea edx, [esi*4]
rol ax, cl
sub esp, 0x16
jmp 0x50f1c3
je 0x50ef0a
not eax
jmp 0x50ef0c
lea esp, [esp + 4]
neg dl
xchg al, ah
mov ax, word [esp]
neg ax
jmp 0x50ef2f
jmp 0x50ef8c
lea edx, [esi*4]
rol ax, cl
sub esp, 0x16
jmp 0x50f721
dec ebp
mov edx, dword [esp]
cmc
jae 0x50effb
not eax
btc eax, ebx
mov dx, word [esp]
jmp 0x50f015
btc eax, ebx
mov dx, word [esp]
push esp
mov byte [esp + 1], dh
jmp 0x50efff
not eax
jmp 0x50efe5
xchg word [esp + 1], ax
bswap edx
bts eax, ebp
jo 0x50f067
jno 0x50f067
mov ah, 0x31
mov eax, dword [reloc.kernel32.dll_DeleteCriticalSection]
mov bl, 0x54
push esp
mov byte [esp + 1], dh
jmp 0x50efff
neg cl
clc
jmp 0x50f108
mov edx, 0xdc91fa57
mov dx, 0xd3f8
mov eax, 0x9610b78d
jmp 0x50f083
lea esp, [esp + 4]
jmp 0x50f048
rol cl, 0
setbe ah
cmc
je 0x50f08d
mov ah, byte [esp]
rdtsc
jmp 0x50f0d6
setno dl
mov dh, ah
setge dh
jmp 0x50f06d
mov ah, byte [esp]
jmp 0x50f096
rdtsc
mov ax, word [esp]
mov al, byte [esp]
add eax, 0x3a250396
jmp 0x50f0c0
mov eax, 0x9610b78d
setno dl
mov dh, ah
jmp 0x50f088
xor cl, 0x2f
mov ax, 0x9bde
bts ax, sp
jmp 0x50f119
mov ax, word [esp]
mov al, byte [esp]
add eax, 0x3a250396
jmp 0x50f0c0
xchg dl, al
lea eax, [ebx*4]
xchg edx, eax
not dl
ror cl, 0
setnp al
jmp 0x50f12f
jg 0x50f051
mov edx, 0xdc91fa57
mov dx, 0xd3f8
jmp 0x50f0b4
jno 0x50f0e4
xchg dl, al
lea eax, [ebx*4]
jmp 0x50f12a
xchg edx, eax
not dl
jmp 0x50f0f0
rdtsc
xchg edx, eax
mov eax, edi
jmp 0x50f175
xchg dx, ax
call 0x50f17e
pushal
xchg dx, ax
sub ax, bp
jmp 0x50f1e3
inc cl
not dl
cmc
jbe 0x50f154
ja 0x50f15d
sub esp, 6
lea esp, [esp + 5]
lea esp, [esp]
mov edx, dword [esp]
add esp, 0
jmp 0x50f1aa
lea esp, [esp + 1]
xchg dword [esp], esi
xchg dl, ah
xchg dx, ax
lea esi, [esi + 0x38]
setb dh
jmp 0x50f657
push word [esp + 1]
call fcn.0050f145
mov edx, 0x35a310cf
dec dh
ja 0x50f23a
bsf edx, esi
jmp 0x50dbae
mov eax, ecx
mov dh, ah
shl eax, 2
mov dx, cx
jmp 0x50f1cd
lea edx, [ecx + ebx]
stc
lea edx, [edi*4]
jmp 0x50f269
clc
jmp 0x50f210
jns 0x50f1ef
lea edx, [ecx + ebx]
stc
jmp 0x50f21c
lea edx, [edi*4]
call fcn.0050f242
dec esp
invalid
bsf edx, esi
jmp 0x50dbae
mov eax, dword [eax + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x50f56a
lea edx, [eax*4]
lea edx, [edx*4]
mov edx, ebx
jmp 0x50dbdf
neg dx
push word [esp + 1]
jmp 0x50efa5

Function at 0x50f145
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
xchg dword [esp], ebx
add dx, bp
btr dx, ax
push eax
call fcn.0050efbb
xchg dword [esp], ebx
mov dh, byte [esp]
mov dx, bx
lea edx, [edx + 0x13]
lea eax, [esp - 0xbb]
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x50efd3
mov dx, 0xacb5
mov dh, 0xfa
mov eax, dword [esp]
xchg edx, eax
jmp 0x50f02d
Function at 0x50ff85
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esp + esi]
mov dh, 0x49
lea edx, reloc.kernel32.dll_DeleteCriticalSection
call fcn.0051002e
and al, 0x57
mov esi, 0x664b2889
mov edx, 0x648dfdcc
and al, 3
jmp 0x50ff64

Function at 0x51055d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0051056c
lea ecx, [edx + eax*4]
in eax, 0x14
jbe 0x510570
cdq
or dword [eax - 0x65], ebp
xchg esi, eax
js 0x5105b5
mov dl, 0xad
mov esp, 0x7af9f086
xchg al, dh
stc
jp 0x510547
mov edx, esp
mov bh, dh
xchg al, dh
stc
jp 0x510547
mov edx, esp
mov bh, dh
jmp 0x510586
lea eax, [edx*4]
lea edx, [edx + edx]
jmp 0x5105bc
rol ebp, 0
jmp 0x5105f9
loop 0x5105a2
sbb dword [esi], esp
push ecx
rcl byte [ebx - 0x79]
sub al, 0x24
xchg dword [esp], ebp
lea ebx, [ebx + esi]
ror ebx, cl
sub esp, 0x12
mov eax, dword [esp + 8]
xchg dword [esp + 3], edx
jmp 0x5105a6
mov edx, dword [esp]
mov edx, ecx
lea edx, reloc.kernel32.dll_DeleteCriticalSection
lea ebx, [ebx + edi]
jmp 0x510616
bsr ebx, esp
jb 0x51064a
mov dh, byte [esp]
sub esp, 8
jmp 0x510627
lea esp, [esp + 0xc]
add ebp, 0x359b8a0f
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x510a95
mov dh, byte [esp]
sub esp, 8
jmp 0x510627
shl bx, 9
jmp 0x510abe
mov ax, 0x177c
xchg edx, ebx
jmp 0x510a65
cmc
jle 0x510a7b
mov ax, 0x177c
xchg edx, ebx
shl bx, 9
jmp 0x510abe
jmp 0x510cbc
ror ebp, 0
mov dl, byte [esp]
rdtsc
rcr dh, cl
ja 0x510aa4
jbe 0x510cbc
jno 0x510ae6
xchg word [esp], dx
mov ebx, ebp
jmp 0x510b41
xchg word [esp], dx
mov ebx, ebp
mov eax, 0xce50d997
push word [esp + 1]
lea esp, [esp + 2]
ror ebp, 0
rdtsc
mov eax, dword [esp]
setns al
jmp 0x510b96
mov eax, 0xce50d997
push word [esp + 1]
lea esp, [esp + 2]
call fcn.00510b26
xchg ebx, eax
lea esp, [esp + 3]
push dword [esp + 8]
ret 0xc
not al
mov bl, byte [esp]
mov edx, esp
jmp 0x510ba1
bswap eax
add ebp, dword [esi]
shl dl, 7
jnp 0x510b80
jp 0x510bbf
not al
mov bl, byte [esp]
mov edx, esp
jmp 0x510ba1
neg ebp
push ebx
xchg byte [esp + 2], bh
mov bl, byte [esp + 3]
and bh, 0x2a
jmp 0x510ad0
Function at 0x510dac
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebx, 0xbaf4d96f
jmp 0x5110b9
add ebx, 0xc9c431c9
jmp 0x5111a4
neg dl
inc dh
jmp 0x50fde5
mov ah, ch
mov ax, word [esp]
mov eax, 0x8944c382
call int.00510e04
inc esi
jno 0x510e30
jae 0x510e2c
mov ah, bl
mov eax, 0x33b3a2bb
jmp 0x510e59
jnp 0x50ffc1
invalid
lea ebx, [ebx*4]
setp bh
mov ebx, dword [esp]
jmp 0x510e77
sub cl, bl
jbe 0x510e32
ja 0x510ec8
mov bh, dh
lea ebx, [edx + esi]
mov al, dh
mov eax, dword [esp]
neg bx
mov eax, dword [esp]
dec bx
jmp 0x510fa3
dec ebp
mov eax, 0xbc0f96d4
inc bx
jb 0x510e5f
jae 0x510ea1
mov eax, dword [esp]
neg bx
call fcn.00510eaa
mov eax, dword [eax]
xchg esi, eax
int1
add byte [ecx + 0x37], ah
mov ebp, 0xf7c7342d
pop es
mov ds, word [ebx + edi*2]
xchg esi, eax
cmpsb byte [esi], byte es:[edi]
lahf
mov bh, dh
lea ebx, [edx + esi]
mov al, dh
jmp 0x510e83
lea ebx, [ebx*4]
setp bh
mov ebx, dword [esp]
jmp 0x510e77
xor dl, 0x25
mov ebx, ebp
or al, cl
jnp 0x510f6b
jp 0x510f6b
or al, 0x8d
sbb eax, 0x9ca29764
out dx, eax
mul cl
and byte [esi - 0x48], ah
dec ecx
sal dword [ebx - reloc.kernel32.dll_DeleteCriticalSection], cl
xchg ebx, eax
push dword [esp + 4]
ret 8
call 0x510f52
mov eax, dword [esp]
mov ebx, ecx
lea ebx, [edx + edi]
jmp 0x510fbd
jo 0x510f2b
jno 0x510f2b
stc
lea eax, [ebx*4]
jmp 0x510fc5
stc
lea eax, [ebx*4]
lea esp, [esp + 4]
inc dl
jmp 0x511116
push esi
push word [esp]
pop ax
jmp 0x511056
neg dl
mov ax, 0x4c83
inc bx
jl 0x510fe5
jge 0x5110e8
lahf
adc eax, 0x2f1fec85
jbe 0xbedf832b
mov bh, 0x9e
jmp 0x510ffb
mov bx, si
cmc
mov bx, word [esp]
jmp 0x51103d
btc ax, si
mov bx, si
cmc
mov bx, word [esp]
jmp 0x511079
mov ah, byte [esp]
jmp 0x511061
ror dl, 0
jne 0x511031
btc ax, si
jmp 0x51101b
shl ebx, 2
bsf eax, ecx
jb 0x51109f
neg ah
neg eax
lea eax, [ecx + esi]
jmp 0x50fbcb
mov ebx, edx
mov ah, 0x5b
neg ax
jne 0x51103f
mov ah, byte [esp]
jmp 0x511061
neg eax
lea eax, [ecx + esi]
jmp 0x50fbcb
neg ah
jmp 0x511087
jmp 0x5110c7
dec al
jb 0x5110a3
jae 0x5110f4
xor dh, byte [ebp - 0x5940b3db]
and al, 0x57
mov eax, 0x389e51f8
neg ah
call 0x51114a
mov dh, 0x3c
sal byte [ebp + 0x9804844], cl
cdq
clc
or ebp, dword [eax + 0x22]
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
cwde
dec ebx
loop 0x511105
push esi
push word [esp]
pop ax
jmp 0x511056
mov eax, 0x389e51f8
neg ah
jmp 0x5110ce
neg eax
not eax
mov al, 0x72
call fcn.0051115b
out dx, al
add byte [eax], al
add byte [edi - 0x12], ah
jl 0x511127
test dh, 0x73
add edx, dword [ebx + reloc.kernel32.dll_DeleteCriticalSection]
int1
mov ax, 0x323a
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
setae bl
lea eax, [edx + edx]
dec bx
dec ebx
jae 0x511019
jb 0x510ffb
js 0x5110fd
neg eax
not eax
jmp 0x511154
mov al, 0x72
jmp 0x50fbfd
jmp 0x5111d0
mov ax, 0xd0cd
bt ax, cx
jmp 0x5111ff
mov eax, ebp
not ax
jmp 0x51120c
jge 0x5111de
mov eax, ebp
not ax
jmp 0x51120c
mov esp, edi
mov al, dh
mov al, byte [esp]
neg eax
jnp 0x51189d
neg eax
jmp 0x5112dc
neg eax
push ebx
ret
jmp 0x5112da
Function at 0x510e04
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp]
sub esp, 6
mov word [esp + 3], ax
lea esp, [esp + 2]
jmp 0x511223
xchg dword [esp + 4], esi
neg ax
jmp 0x510dee
add byte [ebx - 0x17d88973], dl
dec ebp
invalid
lea esi, [esi + 0x27]
call fcn.00511178
mov eax, 0x48b88a5a
sub esp, 9
xchg dword [esp + 3], eax
jmp 0x511266
mov eax, ebp
mov ah, ch
xchg bl, bh
jmp 0x5112f4
lea esp, [esp + 1]
neg bx
setne bh
inc ax
jmp 0x511278
jb 0x511243
mov eax, ebp
mov ah, ch
call 0x511284
jecxz 0x511221
mov ah, 0x11
ror al, cl
bt ax, sp
xchg dword [esp + 4], eax
jmp 0x5112ba
dec bl
mov bh, byte [esp]
sub esp, 7
mov dword [esp], ecx
call fcn.0051150e
ret 0xd949
jmp 0x51131f
btr bx, si
inc dl
bsf eax, ecx
jb 0x5112de
mov bh, dl
rol bx, 0xa
btc bx, ax
xchg ebx, eax
jmp 0x511331
mov bh, dl
rol bx, 0xa
btc bx, ax
jmp 0x51132f
xchg ebx, eax
inc dl
mov ah, 0xad
xchg bx, ax
jmp 0x511398
jge 0x51136e
rcl ax, 0
bsf eax, esi
jmp 0x51137d
rcl ax, 0
bsf eax, esi
neg ebx
jmp 0x5113a6
neg ebx
xchg al, bh
sub esp, 0x1f
jmp 0x5113ab
xchg al, bh
mov bl, dh
xchg ah, bl
xor dl, 0x13
sub esp, 0x1f
jmp 0x511358
xchg al, bh
sub esp, 0x1f
mov bl, ch
lea esp, [esp + 2]
jmp 0x5113e6
btr ebx, esp
lea eax, [ecx + ebx]
btc ebx, esp
pushal
jmp 0x51142d
lea esp, [esp + 0x3c]
neg dl
bt ax, ax
je 0x5113d0
jne 0x5113fc
and ah, byte [edi - 0x675eadc9]
pop edx
mov ch, 0xf
mov bl, 0xe3
btr ebx, esp
lea eax, [ecx + ebx]
btc ebx, esp
jmp 0x511445
lea esp, [esp + 0x20]
add dl, 0x15
sub esp, 8
jl 0x5114da
jge 0x51147a
or dword [eax - reloc.kernel32.dll_DeleteCriticalSection], ebp
pushal
jmp 0x51142d
pop bx
and ah, 0x7c
dec ebx
call fcn.00511448
dec esi
mov ebx, eax
xchg al, bh
xchg dword [esp], esi
bsf eax, ecx
mov bx, sp
mov eax, dword [esp]
jmp 0x5114c3
mov ax, word [esp]
mov ax, 0xa58d
push dword [esp]
ret 4
pop bx
and ah, 0x7c
dec ebx
lea esp, [esp + 2]
and edx, 0x3c
pushfd
call fcn.0051164f
jp 0x51147a
pop esp
and al, 2
sub esi, 4
xchg bx, ax
jmp 0x511535
mov ebx, dword [esp]
cmc
jno 0x5115b1
xchg bx, ax
jmp 0x5115b3
mov ebx, dword [edx + edi]
ror eax, 7
jmp 0x5115f6
bt ax, bp
rdtsc
neg ah
jmp 0x5115b5
xchg bx, ax
jmp 0x511589
mov eax, esi
mov dword [eax], ebx
xchg bx, dx
rcr eax, cl
jmp 0x511616
neg ah
jmp 0x5115b5
xchg edx, eax
add bx, 0x172e
jmp fcn.005115dc
jg 0x511595
bt ax, bp
rdtsc
jmp 0x5115cb
jg 0x5115cf
xchg edx, eax
add bx, 0x172e
jmp fcn.005115dc

Function at 0x51150e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
call 0x51134c
mov bh, 0x86
mov bx, word [esp]
mov bl, byte [esp]
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
xchg dword [esp + 0xc], eax
lea ebx, [eax + 0x5a]
jmp 0x5113c5
lea esp, [esp + 3]
lea eax, [eax - 0x34]
jmp 0x511414

Function at 0x51164f
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ax, di
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
lea ebx, [ecx*4]
setae al
lea edi, [edi + 1]
bsf ebx, edx
call fcn.00511533
xchg ebx, eax
mov ah, 0xcd
btc bx, bp
mov bx, word [esp]
xchg dword [esp], edi
jmp 0x51156a
Function at 0x5526aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
jmp fcn.005523cd
pushal
jmp 0x552735
mov eax, dword [esi + 0x20]
call fcn.0055268b
lea esp, [esp + 4]
jmp 0x5526b4
and dword [ebp - 4], 0
jmp 0x5526dd
add eax, ecx
push ebx
mov ebx, dword [esp]
bswap ebx
jmp 0x5526eb
neg bh
jmp 0x55270b
mov ebx, dword [esi + 0x18]
cmc
push edi
jmp 0x55275d
pop edx
mov dword [ebp - 0x10], eax
mov al, dh
mov eax, dword [esi + 0x1c]
jmp 0x552747
add edi, ecx
sub esp, 5
lea esp, [esp + 1]
jmp 0x552767
mov dword [ebp - 0x18], eax
lea esp, [esp + 0x24]
je 0x55241a
jmp 0x5526a2
clc
jmp 0x55271d
push edx
mov edx, esi
add edx, 0x24
mov edi, dword [edx]
jmp 0x552712
add eax, ecx
call 0x55276f
and eax, 0x8d243c88
and al, 8
dec ebx
call fcn.00552890
push edx
salc
inc esp
and ebx, esi
mov esi, 0xbedb4bc0
dec ebp
push eax
outsb dx, byte [esi]
jns 0x5527e3
mov ebx, 0xf3850f92
cli
jmp dword [esi + 0x55]
mov byte [esp], ah
lea esp, [esp + 8]
js 0x5523fe
jns 0x5524cc
pop esi
pop ss
jle 0x552830
dec ecx
call 0x89795475
jge 0x5527e6
mov dword [ebp - 0x14], eax
push edi
jmp 0x5527b7

Function at 0x552702
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x5526aa
lea esp, [esp + 0x20]
jne 0x5523e8
je 0x55241a
lea esp, [esp + 8]
test eax, eax
pushal
jmp 0x5526cd

Function at 0x55276f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
jmp fcn.005523cd
pushal
jmp 0x552735
mov eax, dword [esi + 0x20]
call fcn.0055268b
lea esp, [esp + 4]
jmp 0x5526b4
and dword [ebp - 4], 0
jmp 0x5526dd
add eax, ecx
push ebx
mov ebx, dword [esp]
bswap ebx
jmp 0x5526eb
neg bh
jmp 0x55270b
mov ebx, dword [esi + 0x18]
cmc
push edi
jmp 0x55275d
pop edx
mov dword [ebp - 0x10], eax
mov al, dh
mov eax, dword [esi + 0x1c]
jmp 0x552747
add edi, ecx
sub esp, 5
lea esp, [esp + 1]
jmp 0x552767
mov dword [ebp - 0x18], eax
lea esp, [esp + 0x24]
je 0x55241a
jmp 0x5526a2
clc
jmp 0x55271d
push edx
mov edx, esi
add edx, 0x24
mov edi, dword [edx]
jmp 0x552712
add eax, ecx
call 0x55276f
and eax, 0x8d243c88
and al, 8
dec ebx
call fcn.00552890
push edx
salc
inc esp
and ebx, esi
mov esi, 0xbedb4bc0
dec ebp
push eax
outsb dx, byte [esi]
jns 0x5527e3
mov ebx, 0xf3850f92
cli
jmp dword [esi + 0x55]
mov byte [esp], ah
lea esp, [esp + 8]
js 0x5523fe
jns 0x5524cc
pop esi
pop ss
jle 0x552830
dec ecx
call 0x89795475
jge 0x5527e6
mov dword [ebp - 0x14], eax
push edi
jmp 0x5527b7

Function at 0x552890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], ebp
mov dword [ebp - 8], edi
jmp 0x5527e8

Function at 0x552a8a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jle 0x5524cc
jmp 0x5524a0
mov word [esp], si
lea esp, [esp + 4]
jmp 0x552a6e

Function at 0x552b12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
cmp dword [ebp - 4], ebx
je 0x5524a0
push ax
lea esp, [esp + 2]
jmp 0x5529d7
push word [esp + 1]
mov word [esp + 3], ax
lea esp, [esp + 2]
jmp 0x5529ed
Function at 0x5f6390
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, 0xd871799c
mov word [esp], sp
mov bh, bl
rdtsc
bswap ebp
lea ebp, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x5f632b
mov dword [esp + 0x23], ecx
cld
setb cl
lea esp, [esp + 0x25]
mov bx, di
xchg byte [esp + 1], bh
jmp 0x5f62d3
pop dword [esp + 0x11]
mov byte [esp + 6], bl
lea esi, [ecx*4]
xchg bp, ax
stc
push dword [esp + 0xe]
jmp 0x5f6354
mov dh, 0x65
pop si
mov word [esp], di
pushal
pop dword [esp + 0x17]
pop dword [esp + 0xe]
jmp 0x5f6306
clc
bsf cx, si
lea eax, [eax*4]
neg ebp
push bp
jmp 0x5f636c
xchg cl, al
mov byte [esp + 4], dl
mov di, word [esp + 0x17]
mov cl, dh
mov ebp, dword [esp + 0xa]
pop word [esp + 0x17]
jmp 0x5f633e
cpuid
rcr ebp, 0x10
pop word [esp + 3]
mov word [esp + 0x16], ax
add esp, 8
cpuid
jmp 0x5f63ce
xchg ebx, edx
jmp 0x5f62f1
mov cl, 0xc3
lea esi, [edx*4]
add esp, 1
or al, cl
rdtsc
jmp 0x5f63e5
bsf ax, di
mov bx, word [esp + 1]
bsf bp, di
pop ecx
push word [esp]
not cx
jmp 0x5f6397
mov ecx, dword [esp + 0xa]
mov ecx, 0xccf40678
mov ah, byte [esp + 0x11]
not ebp
xchg dl, bh
lea esp, [esp + 0xc]
jmp 0x5f63ad
btc ax, si
shl ecx, 0x17
call fcn.005f6475
invalid

Function at 0x5f6875
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x15ce96e6
mov ax, bp
mov esi, dword [esp]
mov bx, 0x1d3
std
inc ecx
jmp 0x5f684d
mov dword [esp], ebp
lea esp, [esp + 3]
lea esi, [edx*4]
add esp, 1
cpuid
not bp
jmp 0x5f6804
lea esp, [esp + 0x19]
lea esi, [ebp - 0xb8]
mov bx, 0x44f3
jmp 0x5f689a
add bx, 0xf67c
add esp, 0
mov ch, byte [esp]
bt edi, ebp
cmp ax, dx
sub esp, 0x1c
jmp 0x5f6837
not ah
lea ecx, [eax*4]
pop word [esp]
jmp 0x5f681f
add esp, 1
mov al, ch
bsr bp, cx
pushal
lea esp, [esp + 0x10]
jmp 0x5f68dd
xchg byte [esp + 2], cl
mov byte [esp + 1], bl
mov bl, 0xf8
mov esi, dword [esp + 3]
pop word [esp]
mov ebp, dword [esp]
jmp 0x5f6884
mov ah, 0x9e
lea edi, [ecx + esi]
mov bh, 0x71
mov byte [esp + 3], al
mov edi, 0x662c31bc
push ecx
jmp 0x5f68c7

Function at 0x5f69bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 7]
mov byte [esp + 0xd], al
add esp, 0x12
jmp 0x5f6974

Function at 0x5f6bab
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xa]
rdtsc
add esp, 0
add esp, 4
rcr dl, 3
jmp 0x5f6bcb