joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ddfe
Capabilities:
Execute anti-debugging instructions
Print debug messages

Disassembly:
jmp 0x42388b
xchg edx, eax
mov byte [esp], 0x5f
pushfd
lea esp, [esp + 0x30]
call fcn.004087e0
cwde
mov al, 0x90
lea edx, [ebx*4 - 0x445ac83a]
rdtsc
lea eax, [ebp - 0x36]
not dx
bswap dx
lea edx, [ecx + 0x18c653b5]
js 0x4223fc
mov edx, dword [ebp - 4]
call fcn.0041f8b3

Function at 0x41dfa8
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x28]
jl 0x4230ec
cmc
cmp esi, 0xe
pushal
pushal
jmp 0x41db92

Function at 0x41e0dd
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x44]
call sub.ntdll.dll_DbgPrint
test sp, 0x78c
test eax, 0xfbd7baf9
add esp, 8
pushfd
pushal
stc
clc
test byte [ebp - 1], 0x80
jmp 0x41f2d3
lea esp, [esp + 0x24]
jne 0x41f372
push ebp
test byte [ebp - 1], 0x40
pushal
pushal
lea esp, [esp + 0x44]
je 0x41f372
btr ax, 0xf
mov eax, dword [0x4123dc]
bt bp, 4
jmp 0x422f4f
test dl, dl
test al, 2
cmp dword [eax], 1
pushal
pushfd
push esp
call fcn.00424cb5

Function at 0x41e1a8
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 4]
jns 0x41ffe3
pushal
pushal
lea esp, [esp + 0x40]
call sub.ntdll.dll_wcscat
cmp si, 0xb171
cmc
test bx, 0x9a17
add esp, 8
jmp 0x420549
pushfd
jmp 0x4264f1
call fcn.004080b8
pushfd
mov byte [esp], 6
mov dword [esp], eax
jmp 0x423068
push ebx
pushal
lea esp, [esp + 0x20]
call sub.ntdll.dll_wcscat
pushal
add esp, 0x28
pushfd
pushfd
lea esp, [esp + 8]
jmp fcn.004206e4
lea esp, [esp + 4]
call sub.ntdll.dll_wcscat
push 0xc86adcce
test cl, 0x65
pushal
mov word [esp], 0xd2c6
add esp, 0x2c
jmp 0x426257

Function at 0x41e2c9
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x10]
jno 0x42011d
call fcn.0040c228
stc
mov byte [ebp - 0xd], al
push edi
cmp byte [ebp - 0xd], 0
push 0x68dc82aa
mov byte [esp], 0xc2
push ecx
lea esp, [esp + 0xc]
jne 0x421f39
stc
jmp 0x423d8c

Function at 0x41e355
Capabilities:
Print debug messages

Disassembly:
and dword [ebp - 4], 0xffff7fff
cmp bl, 0x20
stc
or dword [ebp - 4], 0x10000
mov byte [esp + 4], al
mov byte [esp + 4], dh
push 0x1dfce39e
lea esp, [esp + 0xc]
call fcn.00408040
movsx dx, cl
push 0x93b9c7ce
lea ecx, [edi + 0x1693b703]
bswap cx
mov edx, 0x411570
push dword [esp]
mov cl, 0x90
movsx ecx, bl
mov ecx, dword [ebp - 4]
push 0x4b0f8a40
xchg edx, eax
lea esp, [esp + 0xc]
je 0x423284
pushal
call fcn.00422048
mov dword [esp + 0x24], 0x4116c8
jmp 0x42504e
push dword [esp]
jmp 0x41d7c9
lea eax, [ebp - 0x36]
not dh
lea edx, [esp - 0x24904f95]
movsx dx, al
pushal
mov edx, dword [ebp - 4]
pushal
lea esp, [esp + 0x40]
call fcn.0040c228
bt esp, esp
pushfd
cmc
mov byte [ebp - 0xd], al
clc
cmc
push ebp
clc
cmp byte [ebp - 0xd], 0
push 0x62be7c23
pushfd
pushfd
mov dword [esp], ebp
lea esp, [esp + 0x14]
je 0x42353b
pushfd
pushal
push dword [esp]
jmp 0x41d959
push esp
lea esp, [esp + 4]
call fcn.004087e0
bswap eax
jmp 0x41ee09

Function at 0x41e671
Capabilities:
Print debug messages

Disassembly:
cmp cl, ah
cmp byte [ebp - 0xe], 0
push dword [esp + 4]
push 0xdd9e465b
pushal
lea esp, [esp + 0x30]
je 0x42221f
jmp 0x42269c
Function at 0x41e6bc
Capabilities:
Print debug messages

Disassembly:
jmp 0x42569a
lea esp, [esp + 0xc]
call fcn.00408b30
movsx ax, cl
lea eax, [ecx - 0x630dd50f]
pushal
mov eax, dword [esp + 0x2c]
push edi
pushfd
mov byte [esp], al
call fcn.0041ab54

Function at 0x41e712
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0xc]
call fcn.00408348
sete ah
mov eax, ebx
push 0xb52b3c6f
lea esp, [esp + 4]
jmp fcn.00423c42

Function at 0x41ec72
Capabilities:
Print debug messages

Disassembly:
jmp 0x421f2e
bt bx, ax
mov byte [ebp - 0xd], al
lea esp, [esp + 4]

Function at 0x41ee55
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x28]
je 0x421f39
call fcn.0041a07d

Function at 0x41ef12
Capabilities:
Print debug messages

Disassembly:
push dword [esp + 4]
mov dword [esp + 8], 0x411684
pushfd
jmp loc.0041a713

Function at 0x41efe5
Capabilities:
Check http status code
Execute anti-debugging instructions
Print debug messages

Disassembly:
mov dword [esp], 0x40d02c
jmp 0x424302
call fcn.00426cae
call fcn.0042194f
pushfd
xchg dword [esp], eax
bswap ax
push esp
lea eax, [ebx + 0x14]
lea esp, [esp + 4]
jge 0x422720
pushal
mov byte [esp], ch
mov byte [esp + 4], 0xe8
mov dword [esp + 0x1c], eax
jmp loc.0041a87a

Function at 0x41f0cd
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 8]
jno 0x421ba0
bswap si
mov esi, eax
jmp 0x4277e3
push 0x411293a
push 0xcee13554
mov esi, eax
pushal
call fcn.00421eac
lea esp, [esp + 8]
call fcn.0040ff34
push edi
call fcn.0040d410
pushfd
push edx
jmp 0x427484

Function at 0x41f208
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 0x20], 0x411714
pushal
mov dword [esp + 4], 0xee668215
lea esp, [esp + 0x40]
call sub.ntdll.dll_DbgPrint
stc
pushfd
pushfd
clc
add esp, 0x10
push 0x9ec136ce
call fcn.0041a00b

Function at 0x41f4ee
Capabilities:
Print debug messages

Disassembly:
mov byte [ebp - 0x14], 0
cmp ecx, 0x34b38270
pushfd
push dword [esp + 4]
cmp byte [ebp - 0x13], 0
pushfd
pushfd
lea esp, [esp + 0x14]
je fcn.004114e6
shl al, 1
mov al, byte [ebp - 0xd]
stc
clc
test dl, dh
and al, byte [ebp - 0xf]
pushfd
pushal
mov word [esp], 0xc93c
call fcn.00421e8a
Function at 0x41f677
Capabilities:
Print debug messages

Disassembly:
pushal
push dword [esp]
mov dword [esp + 0x20], 0x41178c
push edx
pushal
mov dword [esp + 0x40], ebx
mov word [esp], bp
mov word [esp + 0x18], dx
lea esp, [esp + 0x40]
call sub.ntdll.dll_swprintf
or al, 0x47
cmc
aam 0xd3
rcr al, 1
add esp, 0xc
push 0xc6c95b22
movsx ax, dl
mov byte [ebp - 0xe], 1
pop eax
movsx ax, dl
pushfd
mov eax, dword [ebp - 0xc]
jmp 0x421180
mov dword [esp + 0x3c], 0x43
lea esp, [esp + 0x3c]
ja 0x41d27f
push 0xac5d9835
push esi
push dword [esp + 4]
mov dword [esp + 8], 0x41178c
lea esp, [esp + 8]
jbe 0x42621f
push ebx
pushfd
pushal
lea esp, [esp + 0x24]
call sub.ntdll.dll_swprintf
sar ah, 3
test cl, dl
sbb ah, 0x36
add esp, 0xc
movsx eax, cl
cwde
jmp 0x42195c
pushfd
lea esp, [esp + 0xc]
call fcn.004081ec
pushfd
push 0xbe1f384e
mov dword [esp + 4], 0x40
mov byte [esp], bh
mov dword [esp], ebx
push ecx
mov byte [esp], 0x16
lea esp, [esp + 4]
call sub.ntdll.dll_RtlZeroMemory
pushal
mov word [esp], sp
pushal
jmp 0x41e75d
pushal
jmp 0x41ae7e

Function at 0x41f6ae
Capabilities:
Print debug messages

Disassembly:
pushfd
mov dword [esp + 8], eax
pushfd
push dword [esp + 8]
pushfd
mov dword [esp + 0x10], ebx
pushal
mov dword [esp + 0x2c], 0x4117a0
jmp 0x4272a4
mov byte [esp], al
lea esp, [esp + 0x2c]
call sub.ntdll.dll_DbgPrint
aam 0xb6
add esp, 0xc
bswap cx
mov dword [ebp - 8], 1
bswap cx
lahf
pushal
cwde
lea ecx, [ebp - 8]
call fcn.0041e979

Function at 0x41fa6a
Capabilities:
Print debug messages

Disassembly:
sub ebp, dword [esp + 0x18]
push dword [esp + 4]
mov byte [esp + 8], dl
stc
test ebp, ebp
mov word [esp], di
mov byte [esp + 8], dl
lea esp, [esp + 0xc]
je 0x4276c8
aad 0x43
rcl dh, cl
xadd ax, dx
mov eax, dword [esp + 0x10]
sbb dl, 0x35
add dword [ebx + 0xc], eax
lahf
pushfd
mov edx, edi
not al
jmp 0x426d40
Function at 0x41fd70
Capabilities:
Print debug messages

Disassembly:
jmp 0x425ea3
jmp 0x421866
pop edx
cdq
lea eax, [ebp - 0x36]
sets dl
pushal
mov edx, dword [ebp - 4]
push dword [esp + 8]
lea esp, [esp + 0x44]
call fcn.0040bf9c
jmp 0x424a53
push 0x977920fe
lea esp, [esp + 8]
call sub.ntdll.dll_DbgPrint
sete al
xchg edx, eax
not ax
pushal
mov ecx, dword [esp + 0x20]
jmp 0x41e556
not ch
setbe ch
pushfd
movzx ecx, cl
mov ecx, dword [esp + 4]
pushfd
mov byte [esp + 8], 0xb0
lea esp, [esp + 0xc]
jmp fcn.004114e6
pushal
mov dword [esp + 0x1c], 0x4118e0
pushal
lea esp, [esp + 0x3c]
jg 0x4255fd
push 0xe1ee5421
lea esp, [esp + 4]
call sub.ntdll.dll_DbgPrint
jl 0x4209ee
pushal
lea ecx, [esi - 0xdcaceb9]
mov ecx, dword [esp + 0x20]
push dword [esp]
pushfd
pushfd
push 0x2cb2b1af
lea esp, [esp + 0x34]
jmp fcn.004114e6
lea esp, [esp + 0x48]
call fcn.0040bf9c
bt si, 0xf
cmp bl, dl
cmp cx, bp
mov byte [ebp - 0x14], 0
cmp cl, 0xcc
cmp byte [ebp - 0xf], 0
jmp 0x4263f5
mov dword [esp], 0x411890
call fcn.00421d5e
mov al, bl
lea ecx, [ebp - 8]
push edi
bswap ax
call fcn.00420394
jmp 0x421ad0
lea esp, [esp + 0x40]
call sub.ntdll.dll_DbgPrint
not cx
xchg dh, al
pop ecx
movsx dx, dl
lea ecx, [ebx + 0x7f1fc266]
not cx
mov byte [ebp - 0x13], 0
jmp 0x4250e0
cmp dx, bp
cmp esp, 0x8be42a4a
pushal
mov byte [ebp - 0x14], 0
sub esp, 0xffffffe0
bt sp, ax
test al, 0x7b
cmp byte [ebp - 0xf], 0
push 0x27c0ba16
lea esp, [esp + 4]
jne 0x421d87
push 0xb25b0155
jmp 0x421b7d
mov ch, bh
lea ecx, [ebp - 8]
cwde
not ah
setns dh
pushfd
mov edx, 0x4118bc
pop eax
mov eax, 0x411570
push 0x656a09a7
mov byte [esp], bl
push dword [esp]
lea esp, [esp + 8]
call fcn.004088ac
pushal
cmp dword [ebp - 8], 1
pushfd
push eax
lea esp, [esp + 0x28]
jne 0x42624b
jmp 0x41e4cd
mov dword [esp + 0x1c], 0x411890
push 0xb96625d
pushal
jmp 0x42454b
pushfd
lea esp, [esp + 4]
jne 0x421d87
pushal
jmp 0x41da4c

Function at 0x41fda5
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x24]
jne 0x4227e1
setle al
push ebx
mov dword [esp], 0
setl ah
not eax
lea eax, [ecx*4 + 0x3799ff61]
push 0
seta ah
push ebx
lahf
mov eax, dword [esp + 0x24]
mov byte [esp], ah
pushfd
mov word [esp], 0xfb79
pushfd
mov dword [esp + 8], eax
call fcn.00423217

Function at 0x41fde5
Capabilities:
Check http status code

Disassembly:
mov byte [esp], 0xd4
lea esp, [esp + 0x48]
je 0x41014e
pushal
push dword [esp]
cmp esi, 0xb
jmp 0x41ed6a

Function at 0x42000d
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 8]
je 0x42353b
pushal
pushfd
push 0x60d017db
mov dword [esp + 0x24], 0x4116e4
push ebp
push dword [esp + 0xc]
push dword [esp]
pushfd
lea esp, [esp + 0x34]
call sub.ntdll.dll_DbgPrint
pushal
pushfd
push 0x63a3af50
mov ecx, dword [esp + 0x28]
pushfd
call fcn.0041e7b0
Function at 0x420836
Capabilities:
Print debug messages

Disassembly:
cmc
test byte [ebp - 2], 2
setns ah
cwde
push 0xafde90a5
seta ah
setne byte [ebp - 0xf]
lea eax, [ebp*4 - 0xcfdbed5]
pushal
mov eax, 0x40
mov byte [esp], ch
pushfd
call fcn.00423b37
mov byte [esp + 4], al
lea esp, [esp + 0x50]
call fcn.004088ac
bt edx, 0xe
cmp dword [ebp - 8], 1
push 0xf60046bd
pushal
lea esp, [esp + 0x24]
je 0x41aeb9
jnp 0x4242cf
pushfd
mov dword [esp], 0x411650
push ecx
jmp 0x420eae
push edi
lea esp, [esp + 8]
call sub.ntdll.dll_DbgPrint
movsx ecx, cl
movzx ecx, dl
jmp 0x4273d5
push 0xce4ba408
mov dword [esp], 0x411650
call fcn.0040c98c
pop ecx
push 0x9d9507d
lea esp, [esp + 4]
jmp fcn.004114e6

Function at 0x420bcc
Capabilities:
Print debug messages

Disassembly:
test byte [ebp - 3], 0x10
mov byte [esp + 4], 2
jmp 0x424ac1
pushal
lea esp, [esp + 0x28]
je 0x42353b
pushfd
push 0x585eaf41
push 0x169428e4
push dword [esp]
mov dword [esp + 0xc], 0x4116e4
pushfd
pushal
push esp
push 0x61bf959d
lea esp, [esp + 0x38]
call sub.ntdll.dll_DbgPrint
pushal
pushfd
lea esp, [esp + 0x24]
jmp fcn.0041ea1b

Function at 0x420d7a
Capabilities:
Print debug messages

Disassembly:
movzx ax, dl
jmp 0x420930

Function at 0x420f44
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp byte [ebp - 0x12], 0
jmp 0x420fb7
push 0x61d1be88
lea esp, [esp + 0x2c]
je 0x42353b
lahf
cwde
movzx cx, dl
xchg al, dl
push 0
rdtsc
rdtsc
xchg ch, ah
lea ecx, [ebp - 0x11]
movzx ax, al
mov edx, 0x411620
bswap ax
mov ax, dx
movsx ax, cl
pushfd
mov eax, 0x411570
call fcn.0042277d

Function at 0x420f78
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jb fcn.0041a55f
push ebp
pushal
not ax
mov dword [ebp - 0xc], 0x20000
movzx ax, al
movzx ax, bl
mov word [esp + 4], 0x2618
pushal
mov eax, ebx
push dword [esp]
pushfd
mov byte [esp], ch
lea esp, [esp + 0x4c]
call fcn.00408348
mov al, dh
call fcn.00420d7a

Function at 0x42106b
Capabilities:
Print debug messages

Disassembly:
push 0x40d02c
jae 0x41a72b
push esi
mov byte [esp], ch
pushfd
mov dword [esp + 4], 0x40d030
pushfd
mov byte [esp + 4], 0x67
pushfd
lea esp, [esp + 0xc]
call sub.ntdll.dll_DbgPrint
sar ax, cl
add esp, 8
push edi
mov eax, esi
mov dword [esp], ebx
pushal
pushal
push eax
lea esp, [esp + 0x48]
call fcn.00408b30
setae al
push edx
mov eax, dword [esp + 0x10]
call fcn.00421014
movzx ax, al
mov edx, edi
movzx ax, al
not eax
pushfd
mov eax, esi
pushal
lea esp, [esp + 0x28]
call fcn.0040cb10
push 0x8aea6929
test eax, eax
push dword [esp]
lea esp, [esp + 8]
je 0x421a59
jmp 0x41d4b2

Function at 0x421172
Capabilities:
Print debug messages

Disassembly:
lea edx, [esi - 0x59521358]
lahf
mov edx, edi
call fcn.0042334c
mov byte [esp], 7
mov dword [esp], eax
push 0x5dc640b2
mov word [esp], 0xcf7
pushal
mov dword [esp + 0x20], ebx
mov byte [esp], 0xb
mov dword [esp + 0x1c], 0x4117a0
pushfd
pushfd
mov byte [esp], 0xa1
lea esp, [esp + 0x24]
call sub.ntdll.dll_DbgPrint
rol dx, 0xa
adc ch, dl
aam 0xc1
add esp, 0xc
cwde
movzx cx, al
mov dword [ebp - 8], 1
push 0xbb35c32f
setne cl
lea ecx, [ebp - 8]
cwde
mov edx, 0x4117c4
pushfd
bswap ax
pop eax
pushfd
mov eax, 0x411570
call fcn.0041dd46
Function at 0x421221
Capabilities:
Print debug messages

Disassembly:
pushal
pushal
lea esp, [esp + 0x40]
call fcn.0040d45c
call fcn.00426267
mov dword [esp + 4], 0x41166c
mov dword [esp], ecx
pushal
push edx
lea esp, [esp + 0x28]
call sub.ntdll.dll_DbgPrint
pushfd
add esp, 0xc
bt edi, esp
pushfd
test byte [ebp - 1], 0x80
pushal
call fcn.0041d835
jmp 0x425a69
mov dword [esp + 0x44], eax
bswap eax
cwde
mov dword [esp + 0x40], 0xac
seto ah
pop eax
lea eax, [esp + 0x7c]
pushfd
mov dword [esp + 0x3c], eax
lea eax, [ebx*2 + 0x6f0e0755]
push esp
lea eax, [esp + 0x58]
call fcn.0041d6dc
jmp 0x421211
mov dword [esp + 0x20], 0
lahf
push 0x44a1744d
lea eax, [esp + 0x38]
pushal
pushfd
jmp 0x421e06
pushal
mov byte [esp], bl
pushfd
mov dword [esp + 0x5c], eax
movsx ax, al
cwde
cwde
mov dword [esp + 0x34], 0
lea eax, [edi + 0x25340325]
setns al
mov dword [esp + 0x38], 0
jmp 0x4252be

Function at 0x421639
Capabilities:
Read file on windows

Disassembly:
mov dword [esp + 0x38], eax
push 0x6a6a89ce
lea esp, [esp + 0x3c]
call sub.ntdll.dll_NtReadFile
stc
cmp bp, 0xe1fe
pushal
cmp ah, 0x11
cmp eax, 0x103
call fcn.0041fda5

Function at 0x42178b
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 0x38], 0x41ffe9
movzx ax, al
push ecx
not ax
lea eax, [ecx*4 + 0x6947a12]
mov eax, dword [ebp - 4]
jmp loc.0041ac45

Function at 0x4217af
Capabilities:
Print debug messages

Disassembly:
bt dx, dx
and dword [ebp - 4], 0xffff7fff
pushfd
or dword [ebp - 4], 0x10000
mov word [esp], bx
push dword [esp]
lea esp, [esp + 0xc]
call fcn.00408040
xchg dx, cx
pushfd
mov edx, 0x411570
not cl
pushfd
mov ecx, dword [ebp - 4]
call fcn.004208a8
pushfd
push 0xecb10afa
jmp 0x426eee

Function at 0x42183e
Capabilities:
Print debug messages

Disassembly:
pushfd
jmp 0x41fca1
call fcn.00421209
mov byte [esp + 4], 0x74
mov dword [esp + 4], 0x40
pushfd
call fcn.004223f2
call fcn.00420c30
mov dword [esp], ebx
push edx
mov dword [esp], 0x411714
jmp 0x42519d
pushal
pushal
lea esp, [esp + 0x40]
call sub.ntdll.dll_DbgPrint
jmp 0x41f5f9

Function at 0x421993
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [ebp - 8]
jmp 0x424546
call fcn.004249f6

Function at 0x421a8e
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x28]
call fcn.00408a10
call fcn.0041d69f

Function at 0x421a9c
Capabilities:
Print debug messages

Disassembly:
bt sp, 2
push ebp
mov byte [esp], 0xac
and al, byte [ebp - 0xf]
push 0xdd076c84
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x424a64
pushal
pushal
jmp 0x42771c
push dword [esp]
pushal
lea esp, [esp + 0x2c]
je fcn.004114e6
neg al
jae 0x423dad
mov al, byte [ebp - 0xd]
jmp 0x41e437
push 0xdef4367
mov al, byte [ebp - 0xd]
clc
cmp bl, al
bt bx, di
stc
and al, byte [ebp - 0xf]
push dword [esp]
pushfd
pushal
pushfd
lea esp, [esp + 0x30]
je 0x424a64
pushal
mov dword [esp + 0x1c], 0x41186c
jmp 0x41f749

Function at 0x421b12
Capabilities:
Print debug messages

Disassembly:
not ah
setbe al
mov edx, 0x4118bc
push dword [esp + 4]
jmp 0x4215b9

Function at 0x421b52
Capabilities:
Write file on windows

Disassembly:
lea esp, [esp + 0x28]
jnp 0x4247d5
pushfd
mov dword [esp + 0x14], eax
jmp 0x4238f4
Function at 0x421bb2
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 4], 0x4116e4
mov word [esp], 0x360e
pushal
lea esp, [esp + 0x24]
call sub.ntdll.dll_DbgPrint
bswap cx
pop ecx
pushfd
push esi
pushfd
lea esp, [esp + 0xc]
jmp fcn.0041ea1f

Function at 0x421c02
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 4], 0x40d050
push ebp
lea esp, [esp + 8]
call sub.ntdll.dll_DbgPrint
bswap ax
add esp, 8
not ax
bswap ax
mov eax, esi
pushfd
lea esp, [esp + 4]
call fcn.00408b30
not al
mov eax, dword [esp + 0xc]
ja 0x422eba
push ebp
push 0x2a50745
mov dword [esp + 4], eax
call fcn.00421fc6
push 0x44a6229f
push dword [esp]
mov word [esp + 4], 0x4882
pushfd
mov dword [esp + 8], eax
pushal
jmp 0x4278bc
call fcn.0041139c
lea esp, [esp + 0x28]
call sub.ntdll.dll_NtClose
jmp 0x4278b7

Function at 0x42212a
Capabilities:
Print debug messages

Disassembly:
jmp 0x426bfc
mov byte [esp], 0x73
lea esp, [esp + 8]
jle 0x42053f
je 0x41ec26
pushal
bt cx, cx
sub eax, eax
call fcn.0041e690
jmp 0x421856

Function at 0x42218d
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x28]
call sub.ntdll.dll_DbgPrint
bswap cx
pop ecx
call fcn.004236a5
push 0x75a7e39a
push esp
lea esp, [esp + 0x10]
je 0x42353b
pushfd
push dword [esp]
pushal
pushfd
mov dword [esp + 0x28], 0x4116e4
jmp 0x41f70b

Function at 0x4221b0
Capabilities:
Print debug messages

Disassembly:
mov dword [esp], 0xa5098e08
lea esp, [esp + 0xc]
jne 0x422c2b
jmp 0x4257a6

Function at 0x422398
Capabilities:
Print debug messages

Disassembly:
push 0x4118e0
pushfd
push dword [esp]
lea esp, [esp + 8]
call sub.ntdll.dll_DbgPrint
not ch
pop ecx
push edi
push dword [esp]
pushfd
lea esp, [esp + 0xc]
jmp fcn.004114e6
jmp 0x41fcf5
lea esp, [esp + 0x24]
jne 0x42624b
ja 0x420b62
push 0x4118e0
jmp loc.0041a5b6

Function at 0x4223db
Capabilities:
Print debug messages

Disassembly:
movsx ax, cl
lahf
mov eax, dword [ebp - 8]
mov word [esp], 0x3667
pushfd
push dword [esp]
call fcn.0041d588

Function at 0x4223f2
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 8], ebx
pushfd
call fcn.004271c0
pushfd
not edx
push 0xaf26d24
mov edx, dword [ebp - 4]
pushfd
pushfd
pushal
call fcn.00423b83

Function at 0x42240f
Capabilities:
Print debug messages

Disassembly:
lahf
mov byte [ebp - 0x14], 0
sets ah
mov byte [esp], bh
bswap edx
mov byte [ebp - 0x13], 0
bswap eax
seto al
pushfd
mov byte [ebp - 0x12], 0
push 0xd69c1ac7
mov byte [ebp - 0x15], 0
jmp 0x425479
pop ecx
pushal
mov eax, 0x411570
bswap cx
mov ecx, ebx
pushfd
call fcn.0040ca7b
movsx dx, dl
lea edx, [esi*2 + 0xc72c2ed]
pushfd
pushfd
mov dword [ebp - 0x21], 0
push dword [esp + 4]
mov dword [ebp - 0x1d], 0xffffffff
cwde
pushfd
movzx ax, bl
push eax
mov dword [ebp - 0x19], 0xffffffff
jmp 0x4217ff
mov byte [esp + 0xc], dh
pushfd
pushfd
lea esp, [esp + 0x3c]
call fcn.0040c228
clc
cmp cl, 0xaf
pushal
mov byte [ebp - 0xd], al
stc
cmp byte [ebp - 0xd], 0
push ebx
jmp 0x41dc91
mov dh, byte [esp + 8]
pushal
cdq
mov byte [ebp - 0x11], 0
rdtsc
movsx dx, dl
not ax
not dh
mov byte [ebp - 0x10], 0
movsx ax, al
bswap dx
lea edx, [ecx + 0x7938c300]
lea eax, [ebp - 0x36]
pop edx
bswap dx
setp dh
pop edx
mov edx, dword [ebp - 4]
jmp 0x424210
Function at 0x422569
Capabilities:
Print debug messages

Disassembly:
pushfd
lea esp, [esp + 0x28]
je 0x421f39
pushfd
pushfd
pushal
mov dword [esp + 0x24], 0x411684
pushfd
mov byte [esp], 0xa1
lea esp, [esp + 0x28]
call sub.ntdll.dll_DbgPrint
push esp
mov ecx, dword [esp + 4]
push 0xe08e995a
pushfd
pushfd
push esi
lea esp, [esp + 0x18]
jmp 0x424b7e
jmp 0x42751b
lea esp, [esp + 8]
jne 0x421f39
stc
cmc
pushfd
bt edx, 0x1b
test byte [ebp - 3], 0x80
pushal
jmp 0x41e605

Function at 0x422981
Capabilities:
Print debug messages

Disassembly:
mov dword [esp], eax
pushfd
mov byte [esp], 0xf
jmp 0x427334
push dword [esp]
mov dword [esp + 4], ebx
pushfd
mov byte [esp + 4], 0x79
mov byte [esp + 4], cl
mov dword [esp + 4], 0x4117a0
pushfd
pushal
lea esp, [esp + 0x28]
call sub.ntdll.dll_DbgPrint
clc
add esp, 0xc
mov ch, bh
pushal
call fcn.0041e377

Function at 0x422a58
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 4], 0x40d030
mov word [esp], dx
mov dword [esp], 0xc359220
jmp loc.0041af5b

Function at 0x422d29
Capabilities:
Print debug messages

Disassembly:
pushal
lea esp, [esp + 0x28]
je 0x42353b
push esp
jmp loc.0040cdcc

Function at 0x422da3
Capabilities:
Print debug messages

Disassembly:
push 0xe1d283e3
call fcn.00421684
xor edx, ecx
int3
pushfd
mov word [esp + 0xc], bp
lea esp, [esp + 0x10]
je 0x42221f
jg 0x40cfb7
push 0x4117e0
pushal
call fcn.0040c8ba
pushal
lea esp, [esp + 0x20]
call sub.ntdll.dll_DbgPrint
cmp bl, bh
add esp, 8
call fcn.00422fe7

Function at 0x422dec
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x20]
call sub.ntdll.dll_DbgPrint
call fcn.0041dfbd

Function at 0x422f9b
Capabilities:
Print debug messages

Disassembly:
mov word [esp + 4], 0xdc34
pushal
mov dword [edx], eax
movsx ax, dl
not eax
mov eax, dword [ebp - 4]
pushfd
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x28], 0x41166c
mov byte [esp], dh
lea esp, [esp + 0x28]
call sub.ntdll.dll_DbgPrint
test si, 0x4510
cmc
cmc
add esp, 8
cmp bl, ch
pushfd
pushal
test byte [ebp - 1], 0x80
pushfd
mov byte [esp], ch
mov byte [esp + 8], ch
call fcn.00424edf

Function at 0x423116
Capabilities:
Print debug messages

Disassembly:
clc
cmp dword [esp + 0x1c], 0
call fcn.0042212a

Function at 0x4232ec
Capabilities:
Write file on windows

Disassembly:
lea esp, [esp + 0x28]
call sub.ntdll.dll_NtWriteFile
rol bx, 8
sub bh, ch
mov ebx, eax
pushfd
bt dx, bp
mov byte [esp], bh
cmp ebx, 0x103
mov byte [esp], dh
lea esp, [esp + 4]
jne 0x4234d9
pushfd
push ebp
pushal
mov dword [esp + 0x24], 0
mov byte [esp + 8], cl
pushal
pushfd
mov dword [esp + 0x44], 0
push ecx
pushfd
jmp 0x426b6c
call fcn.00424ff7
mov dword [esp + 0x48], esi
mov dword [esp + 4], 0x4d4e6397
pushfd
push esp
call fcn.0042348c
pushal
pushfd
lea edx, [edx + 0x1ef491ec]
call fcn.004218dc

Function at 0x42334c
Capabilities:
Print debug messages

Disassembly:
not ah
mov eax, esi
mov word [esp], ax
pushfd
push 0x4409e57b
mov byte [esp + 4], 0x73
lea esp, [esp + 0x10]
call fcn.0040cb10
cmc
test ch, 0xd
test eax, eax
call fcn.0040cc47