joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b882a3e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x5b882a62
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x5b882aab
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
mov esi, ebx
neg esi
and esi, edi
lea ecx, [ebx - 1]
mov eax, ecx
and ecx, dword [ebp - 4]
and eax, edi
dec ecx
add eax, ebx
add eax, ecx
div ebx
xor edx, edx
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x5b882aa9
xor eax, eax
lock or dword [esi], eax
add esi, ebx
sub ecx, 1
jne 0x5b882a9d
pop esi
pop ebx
pop edi
leave
ret

Function at 0x5b884551
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x5b88458e
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x5b884587
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x5b884593
add edx, 0x28
cmp edx, esi
jne 0x5b884578
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x5b884590

Function at 0x5b8867cd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b80b400
push 0x5b80b3f8
push 0x5b80b400
push 0
call fcn.5b88674b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5b886802
push dword [ebp + 8]
mov ecx, esi
call dword [0x5b89d478]
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x5b886847
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b80b424
push 0x5b80b41c
push 0x5b80b424
push 2
call fcn.5b88674b
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x5b88687b
mov ecx, esi
call dword [0x5b89d478]
call esi
jmp 0x5b886881
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x5b886884
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b80b438
push 0x5b80b430
push 0x5b80b438
push 3
call fcn.5b88674b
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x5b8868bb
mov ecx, esi
call dword [0x5b89d478]
call esi
jmp 0x5b8868c1
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x5b8876f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x5b88772e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x5b887726
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x5b887730
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x5b887716
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5b887800
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x5b887831
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5b887831
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x5b887831
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4012a4
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push esi
push ebx
call fcn.0040a970
add esp, 0xfffffff8
push 0x402df0
add esp, 0xfffffff8
push 0x401230
push 0x412028
call fcn.0040298c
add esp, 0x10
mov eax, eax
push eax
call fcn.00410414
add esp, 0x10
add esp, 0xfffffff8
push 0x402df0
add esp, 0xfffffff8
push 0x401245
push 0x412028
call fcn.0040298c
add esp, 0x10
mov eax, eax
push eax
call fcn.00410414
add esp, 0x10
add esp, 0xfffffff8
push 0x402df0
add esp, 0xfffffff8
push 0x402df0
add esp, 0xfffffff8
push 0x401257
push 0x412028
call fcn.0040298c
add esp, 0x10
mov eax, eax
push eax
call fcn.00410414
add esp, 0x10
mov eax, eax
push eax
call fcn.00410414
add esp, 0x10
add esp, 0xfffffff8
push 0x401270
push 0x412028
call fcn.0040298c
add esp, 0x10
add esp, 0xfffffff8
lea eax, [ebp - 0xc]
push eax
add esp, 0xfffffff8
lea eax, [ebp - 8]
push eax
push 0x4120a8
call fcn.00402010
add esp, 0x10
mov eax, eax
push eax
call fcn.00402010
add esp, 0x10
add esp, 0xfffffff8
push 0x402df0
push 0x412028
call fcn.00410414
add esp, 0x10
add esp, 0xfffffff4
mov ebx, dword [ebp - 8]
lea eax, [ebx*4]
push eax
call fcn.0040b50c
add esp, 0x10
mov eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
nop
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jl 0x4013bc
jmp 0x4013f0
mov eax, dword [ebp - 0x10]
lea edi, [eax*4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add esp, 0xfffffff4
mov esi, dword [ebp - 0xc]
lea eax, [esi*4]
push eax
call fcn.0040b50c
add esp, 0x10
mov eax, eax
mov edx, dword [ebp - 0x14]
mov dword [edx + edi], eax
inc dword [ebp - 0x10]
jmp 0x4013b0
add esp, 0xfffffffc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040148c
add esp, 0x10
add esp, 0xfffffff8
push 0x402df0
add esp, 0xfffffff8
push 0x401297
push 0x412028
call fcn.0040298c
add esp, 0x10
mov eax, eax
push eax
call fcn.00410414
add esp, 0x10
add esp, 0xfffffffc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401594
add esp, 0x10
add esp, 0xfffffff4
push 0x40129e
call sub.msvcrt.dll_system
add esp, 0x10
xor eax, eax
jmp 0x40145e
lea esp, [ebp - 0x38]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x406184
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add esp, 0xfffffffc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x38]
call sub.msvcrt.dll__read
leave
ret

Function at 0x40aa60
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40aa88
mov dword [0x413164], eax
add esp, 0xfffffff8
push 0x40aa24
push eax
call fcn.0040ee88
jmp 0x40aa8d
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40aaa0
mov dword [0x41235c], 0x40ab80
jmp 0x40aaaa
mov dword [0x41235c], 0x40ab34
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x47b84d71
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..pdata_1
mov ebx, 0x42e3d0
nop
mov ecx, 0xba118d2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40e315
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0041a860
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40e530
push esi
call fcn.0041a523
pop ecx
cmp eax, 0x7f6
jae 0x40e530
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0041a590
movzx ecx, word [esi]
add esp, 0xc
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0x1c0
cmp cx, 0x22
jne 0x40e370
lea eax, [esi + 2]
mov dword [ebp - 0x38], eax
jmp 0x40e373
mov dword [ebp - 0x38], esi
xor eax, eax
cmp cx, bx
je 0x40e3c9
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40e39b
jmp 0x40e38b
cmp word [esi + eax*2], 0x22
je 0x40e394
inc eax
cmp word [esi + eax*2], bx
jne 0x40e384
jmp 0x40e39b
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x40e3b5
cmp word [esi + eax*2 + 2], 0x2f
je 0x40e3b5
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40e37c
jmp 0x40e3c9
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x40e3c3
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x40e3d5
cmp word [eax], bx
jne 0x40e3ea
cmp byte [ebp + 0xc], bl
jne 0x40e3ea
cmp word [0x44187a], bx
je 0x40e3ea
mov dword [ebp - 0x34], 0x44187a
push dword [ebp - 0x38]
mov dword [ebp - 0x2c], 1
call fcn.0040a42f
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40e416
push str..inf
push eax
call fcn.00411bd1
test eax, eax
jne 0x40e416
mov dword [ebp - 0x3c], str.Install
push dword [ebp - 0x38]
call fcn.004091c5
test al, al
je 0x40e43f
push 0x800
lea eax, [ebp - 0x1048]
push eax
push dword [ebp - 0x38]
call fcn.0040a928
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e52f
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
mov edi, 0x3e8
cmp byte [0x440870], bl
jne 0x40e474
cmp byte [ebp + 0xc], bl
jne 0x40e474
cmp byte [0x44085d], bl
je 0x40e4d1
cmp dword [ebp + 8], ebx
je 0x40e490
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e490
push ebx
push dword [ebp + 8]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
call fcn.0040d707
cmp byte [0x44085d], bl
je 0x40e4d1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40e4d1
mov eax, dword [ebp - 0xc]
add eax, edi
cmp eax, dword [0x440860]
jbe 0x40e4d1
mov dword [0x440860], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40e4f0
push 0x42a8ec
push dword [ebp - 8]
call fcn.00411bd1
test eax, eax
je 0x40e51e
cmp byte [0x440870], bl
je 0x40e509
cmp byte [ebp + 0xc], bl
jne 0x40e509
mov dword [0x440864], 0x1b58
jmp 0x40e51e
xor eax, eax
cmp byte [ebp + 0xc], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, edi
mov dword [0x440864], eax
cmp byte [ebp - 1], bl
je 0x40e52f
cmp byte [ebp + 0xc], bl
je 0x40e52f
push 1
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1051a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1051a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1051a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051a06a
add dl, dl
jne 0x1051a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051a0dc
xor eax, eax
add dl, dl
jne 0x1051a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051a17d
add dl, dl
jne 0x1051a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1051a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1051a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1051a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1051a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1051a075
mov eax, 1
add dl, dl
jne 0x1051a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1051a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1051a0e1
sub eax, ebx
mov ebx, 1
jne 0x1051a128
mov ecx, 1
add dl, dl
jne 0x1051a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1051a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1051a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1051a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1051a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1051a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1051a136
cmp eax, 0x7d00
jae 0x1051a16d
cmp eax, 0x500
jb 0x1051a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1051a075
cmp eax, 0x7f
ja 0x1051a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1051a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1051a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1051a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402e4b
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.004089d0
mov eax, dword [0x244ecec]
mov ecx, dword [0x244e778]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402f27
mov edi, ecx
mov ebx, eax
cmp dword [0x244ecec], 0x959
jne 0x402f17
push esi
lea eax, [esp + 0x414]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402a20
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x814]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call fcn.00402c17
add edi, 8
dec ebx
jne 0x402e7a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436590]
jne 0x406e8e
repz ret
jmp fcn.004089fb

Function at 0x40710b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x436590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405470
and dword [ebp - 0x14], 0
cmp dword [0x43c290], 0
mov dword [ebp - 0x18], eax
jne 0x4071be
push 0x401df8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407266
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401dec
push ebx
call edi
test eax, eax
je 0x407266
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x401ddc
push ebx
mov dword [0x43c290], eax
call edi
push eax
call esi
push 0x401dc8
push ebx
mov dword [0x43c294], eax
call edi
push eax
call esi
push 0x401dac
push ebx
mov dword [0x43c298], eax
call edi
push eax
call esi
mov dword [0x43c2a0], eax
test eax, eax
je 0x4071be
push 0x401d94
push ebx
call edi
push eax
call esi
mov dword [0x43c29c], eax
mov eax, dword [0x43c29c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407217
cmp dword [0x43c2a0], ecx
je 0x407217
push eax
call esi
push dword [0x43c2a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407217
test ebx, ebx
je 0x407217
call edi
test eax, eax
je 0x40720e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40720e
test byte [ebp - 8], 1
jne 0x407217
or dword [ebp + 0x10], 0x200000
jmp 0x40724a
mov eax, dword [0x43c294]
cmp eax, dword [ebp - 0x18]
je 0x40724a
push eax
call esi
test eax, eax
je 0x40724a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40724a
mov eax, dword [0x43c298]
cmp eax, dword [ebp - 0x18]
je 0x40724a
push eax
call esi
test eax, eax
je 0x40724a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43c290]
call esi
test eax, eax
je 0x407266
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407268
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e84
leave
ret
Function at 0x40a7f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
and byte [ebx + 0x57], dl
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.0040a3a0
mov eax, ebx
mov dword [esp + 0x34], edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a840
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.0040a8f0
push 0xffffffffffffffff
push edi
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], di
call fcn.0040a3a0
cmp dword [esp + 0x28], 8
jb 0x40a887
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0043670c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret

Function at 0x40aac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
Function at 0x40aad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, dword [esp + 0x30]
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov ebx, 0x10
cmp eax, ebx
push edi
mov byte [esp + 0x10], 0x37
mov byte [esp + 0x11], 0x58
mov byte [esp + 0x12], 0x81
mov byte [esp + 0x13], 0x77
mov byte [esp + 0x14], 0x5b
mov byte [esp + 0x15], 0xf8
mov byte [esp + 0x16], 0xa
mov byte [esp + 0x17], 0x70
mov byte [esp + 0x18], 0x66
mov byte [esp + 0x19], 0x46
inc esp
and al, 0x19
inc esi
mov byte [esp + 0x1a], 0x9c
mov byte [esp + 0x1b], 0xb4
mov byte [esp + 0x1c], 0xff
mov byte [esp + 0x1d], 0xa0
mov byte [esp + 0x1e], 0x9e
mov byte [esp + 0x1f], 0x97
mov byte [esp + 0x20], 3
mov byte [esp + 0x21], 0x30
mov byte [esp + 0x22], 0xb7
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x24], 0xa7
mov byte [esp + 0x25], 0x39
mov byte [esp + 0x26], 0x23
mov byte [esp + 0x27], 0x5a
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], 0x2b
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2b], 0x4f
mov byte [esp + 0x2c], 0x31
mov byte [esp + 0x2d], 0xce
mov byte [esp + 0x2e], 0x90
mov byte [esp + 0x2f], 0x9a
lea edi, [esi + 4]
jb 0x40ab8b
mov ecx, dword [edi]
jmp 0x40ab8d
mov ecx, edi
lea edx, [esp + 0x10]
cmp edx, ecx
jb 0x40abc4
cmp eax, ebx
jb 0x40ab9d
mov ecx, dword [edi]
jmp 0x40ab9f
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
lea ecx, [esp + 0x10]
cmp edx, ecx
jbe 0x40abc4
cmp eax, ebx
jb 0x40abb2
mov edi, dword [edi]
push ebx
lea edx, [esp + 0x14]
sub edx, edi
push edx
push esi
mov ecx, esi
call fcn.00401810
jmp 0x40abff
cmp eax, ebx
jae 0x40abd4
mov eax, dword [esi + 0x14]
push eax
push ebx
mov ecx, esi
call fcn.00402300
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x40abdf
mov eax, dword [edi]
jmp 0x40abe1
mov eax, edi
push ebx
lea edx, [esp + 0x14]
push edx
push ecx
push eax
call fcn.00436711
add esp, 0x10
cmp dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
jb 0x40abfb
mov edi, dword [edi]
mov byte [edi + 0x10], 0
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
lea esi, [ebp + 4]
jb 0x40ac0d
mov eax, dword [esi]
jmp 0x40ac0f
mov eax, esi
lea edx, [esp + 0x20]
cmp edx, eax
jb 0x40ac57
cmp ecx, ebx
jb 0x40ac1f
mov eax, dword [esi]
jmp 0x40ac21
mov eax, esi
mov edx, dword [ebp + 0x14]
add edx, eax
lea eax, [esp + 0x20]
cmp edx, eax
jbe 0x40ac57
cmp ecx, ebx
jb 0x40ac34
mov esi, dword [esi]
push ebx
lea ecx, [esp + 0x24]
sub ecx, esi
push ecx
push ebp
mov ecx, ebp
call fcn.00401810
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00436866
add esp, 0x24
ret
cmp ecx, ebx
jae 0x40ac67
mov edx, dword [ebp + 0x14]
push edx
push ebx
mov ecx, ebp
call fcn.00402300
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
jb 0x40ac72
mov eax, dword [esi]
jmp 0x40ac74
mov eax, esi
push ebx
lea edx, [esp + 0x24]
push edx
push ecx
push eax
invalid
nop
invalid
invalid
Function at 0x40acc0
Capabilities:
Access peb ldr_data

Disassembly:
pop esp
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x70], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 1
call fcn.0040aac0
mov ecx, dword [esp + 0x34]
mov ebp, 0x10
add esp, 4
cmp dword [esp + 0x44], ebp
mov dword [esp + 0xc], 1
jae 0x40ad34
lea ecx, [esp + 0x30]
cmp dword [esp + 0x60], ebp
mov eax, dword [esp + 0x4c]
jae 0x40ad42
lea eax, [esp + 0x4c]
push ebx
lea edx, [esp + 0x10]
push edx
push ecx
push eax
mov ecx, esi
lea edx, [esp + 0x20]
call fcn.0040e400
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x7c], 2
call fcn.00401810
cmp dword [esp + 0x28], ebp
jb 0x40ad7b
mov eax, dword [esp + 0x14]
push eax
call fcn.0043670c
add esp, 4
cmp dword [esp + 0x44], ebp
jb 0x40ad8e
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0043670c
add esp, 4
cmp dword [esp + 0x60], ebp
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x40adb1
mov edx, dword [esp + 0x4c]
push edx
call fcn.0043670c
add esp, 4
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00436866
add esp, 0x68
ret

Function at 0x40ade0
Capabilities:
Access peb ldr_data

Disassembly:
pop esp
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x70], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 1
call fcn.0040aac0
mov eax, dword [esp + 0x34]
mov ebp, 0x10
add esp, 4
cmp dword [esp + 0x44], ebp
mov dword [esp + 0xc], 1
jae 0x40ae54

Function at 0x410890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45a801
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x464df4
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push 1
push eax
push ecx
lea edi, [esp + 0x1c]
mov dword [esp + 0x30], 1
call fcn.00410b40
push eax
push esi
call fcn.0042fef0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0xc], 1
je 0x410913
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x46294c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
add byte [eax + 0x51], dl
push ebx
push esi
push edi
mov eax, dword [0x4352f4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]