joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4485b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x4485e5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004039c8
jmp 0x4485ef
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.0040397c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4494c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4494fc
mov eax, esi
call fcn.00432a08
test al, al
je 0x4494fc
mov eax, dword [ebx + 0x6c]
call fcn.00432628
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4494fc
push 0
mov eax, dword [ebx + 0x6c]
call fcn.00432628
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4507c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403d24
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4507dd
test al, 0x10
jne 0x4507e1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x451aa8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x451b39
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00451714
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403d24
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x451b23
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x47a3f4]
call fcn.00404fac
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4515cc]
call fcn.0040a90c
call fcn.004033dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451b40
lea eax, [ebp - 0x10]
call fcn.004038e4
ret
Function at 0x451b4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x451be7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403d24
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x451bc1
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x47a608]
call fcn.00404fac
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4515cc]
call fcn.0040a90c
call fcn.004033dc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00451744
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451bee
lea eax, [ebp - 0x10]
call fcn.004038e4
ret
Function at 0x453e04
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x453e0d
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x453f87
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [edx + 0xa], 0
jbe 0x453e40
mov byte [ebx + 0xb4], 0
jmp 0x453e47
mov byte [ebx + 0xb4], 1
mov eax, dword [edx]
sub eax, 0x465
je 0x453e6a
dec eax
je 0x453f41
dec eax
je 0x453f6d
dec eax
je 0x453f76
jmp 0x453f7d
movzx eax, word [edx + 8]
cmp eax, 8
jg 0x453e8c
je 0x453f29
dec eax
je 0x453f17
dec eax
je 0x453f20
jmp 0x453f7d
sub eax, 0x10
je 0x453e9b
sub eax, 0x10
je 0x453ec7
jmp 0x453f7d
cmp byte [ebx + 0xb4], 0
je 0x453f7d
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x3a], 0
je 0x453f7d
mov edx, ebx
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
jmp 0x453f7d
push 0
push 0x3fff
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
jle 0x453efb
lea edx, [ebp - 0x4000]
mov eax, dword [ebx + 0x29c]
mov ecx, esi
call fcn.00411614
dec esi
jl 0x453f07
cmp byte [ebx + 0x84], 0
je 0x453ec7
mov byte [ebx + 0x2a0], 0
mov eax, ebx
call fcn.00454430
jmp 0x453f7d
mov eax, ebx
call fcn.00453f98
jmp 0x453f7d
mov eax, ebx
call fcn.004541cc
jmp 0x453f7d
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x32], 0
je 0x453f7d
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
jmp 0x453f7d
mov byte [ebx + 0xd4], 1
cmp word [edx + 8], 8
jne 0x453f7d
mov byte [ebx + 0x2a0], 1
test byte [ebx + 0x20], 8
jne 0x453f7d
cmp word [ebx + 0x42], 0
je 0x453f7d
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
jmp 0x453f7d
mov eax, ebx
call fcn.004541cc
jmp 0x453f7d
mov eax, ebx
call fcn.00453f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x453f91
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453f98
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x453fa1
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x4010], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4541be
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x84], 0
je 0x45401c
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, dword [ebp - 4]
cmp word [eax + 0x28e], 0
je 0x45401c
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x290]
call dword [ebx + 0x28c]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x79], 0
jne 0x45419d
xor eax, eax
push ebp
push 0x454196
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 1
lea edx, [ebp - 0x4010]
mov eax, dword [0x47a1f0]
call fcn.00404fac
mov ecx, dword [ebp - 0x4010]
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.004545e8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x29c]
mov eax, ebx
call fcn.00411560
mov edx, eax
mov eax, ebx
call fcn.00411554
push 0
push 0x3fff
lea eax, [ebp - 0x4009]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45410b
lea edx, [ebp - 0x4009]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov ecx, ebx
call fcn.00411614
mov eax, dword [ebp - 4]
cmp byte [eax + 0x78], 0
je 0x4540e3
mov eax, dword [ebp - 4]
add dword [eax + 0xc0], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0xc6], 0
je 0x4540e3
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc8]
call dword [esi + 0xc4]
mov byte [ebp - 9], 1
cmp ebx, 0x3fff
jne 0x454165
mov eax, dword [ebp - 4]
push eax
push 0
push 0x468
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.user32.dll_PostMessageA
jmp 0x454165
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x88], ebx
lea ecx, [ebp - 8]
mov edx, ebx
cmp edx, 0xffff
jbe 0x45412d
call fcn.00402c78
mov eax, dword [ebp - 4]
call fcn.0045389c
mov eax, dword [ebp - 4]
cmp word [eax + 0x4a], 0
je 0x454165
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
cmp ecx, 0xffff
jbe 0x454159
call fcn.00402c78
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x4c]
call dword [ebx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45419d
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 0
cmp byte [ebp - 9], 0
je 0x454195
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x454195
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4541c5
lea eax, [ebp - 0x4010]
call fcn.004038e4
lea eax, [ebp - 8]
call fcn.004038e4
ret
Function at 0x4541cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4541d5
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x4004], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x454421
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x79], 0
jne 0x454408
mov byte [ebx + 0x79], 1
lea edx, [ebp - 0x4004]
mov eax, dword [0x47a550]
call fcn.00404fac
mov ecx, dword [ebp - 0x4004]
mov dl, 8
mov eax, ebx
call fcn.004545e8
cmp byte [ebx + 0x288], 0
je 0x45424f
mov eax, dword [ebx + 0xa8]
call fcn.00411544
mov esi, eax
mov eax, dword [ebx + 0xa8]
call fcn.00411560
cmp esi, eax
jl 0x45426f
cmp byte [ebx + 0x288], 0
jne 0x454404
mov eax, dword [ebx + 0xa8]
call fcn.00411560
test eax, eax
je 0x454404
cmp byte [ebx + 0x84], 0
jne 0x454404
cmp byte [ebx + 0x288], 0
jne 0x454294
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00411554
jmp 0x4542a5
mov edx, dword [ebx + 0x80]
mov eax, dword [ebx + 0xa8]
call fcn.00411554
lea edx, [ebp - 0x4000]
mov ecx, 0x3fff
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax]
call dword [esi + 4]
mov edi, eax
push 0
push edi
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jle 0x4543e8
mov eax, dword [ebx + 0xa8]
call fcn.00411544
sub eax, edi
add eax, esi
push eax
mov eax, dword [ebx + 0xa8]
call fcn.00411560
pop edx
cmp edx, eax
jl 0x45431f
cmp byte [ebx + 0x288], 0
jne 0x454313
mov eax, dword [ebx + 0xa8]
call fcn.004119a4
mov byte [ebx + 0x286], 1
jmp 0x4543c2
cmp byte [ebx + 0x288], 0
jne 0x454392
mov eax, dword [ebx + 0xac]
call fcn.004119a4
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00411554
mov edi, dword [ebx + 0xa8]
mov eax, edi
call fcn.00411560
mov ecx, eax
sub ecx, esi
mov edx, edi
mov eax, dword [ebx + 0xac]
call fcn.00411690
mov eax, dword [ebx + 0xa8]
call fcn.004119a4
mov eax, dword [ebx + 0xac]
mov edx, dword [ebx + 0xa8]
mov dword [ebx + 0xac], edx
mov edx, eax
mov dword [ebx + 0xa8], edx
mov eax, edx
xor edx, edx
call fcn.00411554
mov byte [ebx + 0x79], 0
jmp 0x4543ae
mov eax, dword [ebx + 0xa8]
call fcn.00411544
mov edx, eax
sub edx, edi
add edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00411554
push ebx
push 0
push 0x467
mov eax, dword [ebx + 0x298]
push eax
call sub.user32.dll_PostMessageA
add dword [ebx + 0x80], esi
cmp byte [ebx + 0x78], 0
je 0x454404
cmp word [ebx + 0xce], 0
je 0x454404
mov edx, ebx
mov eax, dword [ebx + 0xd0]
call dword [ebx + 0xcc]
jmp 0x454404
call sub.wsock32.dll_WSAGetLastError
mov dword [ebx + 0x88], eax
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00411554
mov byte [ebx + 0x79], 0
mov byte [ebx + 0x79], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454428
lea eax, [ebp - 0x4004]
call fcn.004038e4
ret
Function at 0x454430
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4544fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x47a440]
call fcn.00404fac
mov ecx, dword [ebp - 4]
mov dl, 4
mov eax, ebx
call fcn.004545e8
mov byte [ebx + 0x2a0], 0
mov si, word [ebx + 0x294]
cmp si, 0xffff
je 0x4544e8
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x4544da
test byte [ebx + 0x20], 8
jne 0x454497
cmp word [ebx + 0x42], 0
je 0x454497
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
cmp byte [ebx + 0x85], 0
jne 0x4544e8
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x4544ba
call fcn.00402c78
mov word [ebx + 0x294], si
push 0x3f
push 0x465
mov eax, dword [ebx + 0x298]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4544e8
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0045450c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454505
lea eax, [ebp - 4]
call fcn.004038e4
ret

Function at 0x454870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov edi, edx
mov esi, esp
mov dword [esi], 0x10
push esi
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_getsockname
push dword [esp + 8]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
xor eax, eax
mov dword [esi], eax
jmp 0x4548b2
mov edx, dword [esi]
cmp al, 0x2e
jne 0x4548b0
mov eax, dword [esi]
mov byte [ebx + eax], 0x2c
inc dword [esi]
mov eax, dword [esi]
mov al, byte [ebx + eax]
test al, al
jne 0x4548a4
mov edx, edi
mov eax, ebx
call fcn.00408050
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4548cc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov esi, edx
mov dword [esp], 0x10
push esp
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_getsockname
push esi
mov bx, word [esp + 0xa]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
shr bx, 8
movzx eax, bx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
lea edx, [esp + 0x18]
mov ecx, 1
mov eax, 0x454938
call fcn.00408598
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x458fe8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x459016
mov eax, ebx
call fcn.00459a8c
cmp dword [ebx + 0x3c], 0
je 0x45900f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x459087
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x459079
cmp dword [ebx + 8], 0
je 0x459038
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x45904a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x459079
cmp dword [ebx + 8], 0
je 0x45902b
cmp eax, 3
je 0x45905d
dec eax
jne 0x45902b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45902b
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x45902b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4590a5
cmp dword [ebx + 0x10], 0xcc
je 0x4590a5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004590b0
pop ebx
ret
Function at 0x4a4aec
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4a4ab7
push dword [esp + 1]
js 0x4a4a58
mov word [esp + 1], bp
mov dword [esp + 4], ebp
jmp 0x4a4ac0
mov word [esp + 1], bp
mov dword [esp + 4], ebp
call fcn.004a4aa1
add ecx, 0x1821bbdd
jmp 0x4a643b
add ecx, 0xd6db2c0d
call fcn.004a6749
add ebp, ebx
jmp 0x4a4ad6
sub esp, 0x1b
jns 0x4a4b22
xchg ebp, edi
cpuid
pop dword [esp + 0xd]
lea esp, [esp + 3]
jmp 0x4a4b26
mov esi, dword [esp + 0x40]
mov al, 0x16
dec al
jmp 0x4a4b83
mov di, word [esp]
rdtsc
jmp 0x4a4b57
lea edi, [esp + 0x14]
lea ebx, [edi*4]
pushal
bsr ebp, ebp
jmp 0x4a4b8d
sub esp, 0x8c
jmp 0x4a4b91
jns 0x4a4b34
mov di, word [esp]
rdtsc
jmp 0x4a4b57
jb 0x4a4b6c
jae 0x4a4b6c
mov ebp, esp
mov ecx, 0x6c5bf55f
mov bx, bp
rdtsc
mov eax, esi
jmp 0x4a4bde
add esp, 1
clc
jmp 0x4a4bbc
lea esp, [esp + 2]
pushfd
xchg byte [esp + 2], dl
jmp 0x4a4c0d
lea esp, [esp + 0x14]
xor esi, 0x49eaa48c
jmp 0x4a4bf2
sub esp, 3
js 0x4a4bb2
add esp, 1
clc
lea esp, [esp + 2]
pushfd
xchg byte [esp + 2], dl
jmp 0x4a4c0d
dec ch
js 0x4a4c8d
bts dx, si
mov cx, word [esp]
mov ecx, esi
jmp 0x4a4c2c
sub esp, 0x10
rcl dh, cl
jg 0x4a4bc7
jle 0x4a4bc7
pop word [esp]
lea esp, [esp + 2]
jmp 0x4a4c68
mov dx, 0xd88f
mov cx, 0xedd8
jmp 0x4a4c4d
mov ecx, esi
mov dx, 0xd88f
mov cx, 0xedd8
call 0x4a4c16
xchg dl, ch
lea edx, reloc.MFC42.DLL_CWnd::OnCommand
rcl dl, 1
jmp 0x4a4c97
sub esi, 0x63290ae5
lea ebx, [eax*4]
dec bh
jae 0x4a4c52
jb 0x4a4cad
inc edi
invalid
dec eax
bts dx, si
mov cx, word [esp]
jmp 0x4a4c43
sub esi, 0x484464f9
mov edx, dword [esp]
neg bh
jmp 0x4a4cb9
xchg dl, ch
lea edx, reloc.MFC42.DLL_CWnd::OnCommand
rcl dl, 1
jmp 0x4a4c97
jb 0x4a4ccf
bsr bx, di
seto dl
jmp 0x4a4d51
nop
ret 0x8ae9
bsr bx, di
seto dl
jmp 0x4a4d51
cmp edx, 0xe06c5320
call fcn.004a4d21
in al, 0x6c
loop 0x4a4c8c
je 0x4a4cc0
stc
fdivr dword [ebx]
adc cl, byte [ebp - 0x8992909]
fidiv dword [esi - 0x1d]
not esi
neg dx
jbe 0x4a4cf8
cmp edx, 0xe06c5320
jmp 0x4a4d5f
not esi
mov cx, dx
not dh
lea ebx, [edx - 0x25]
mov dh, 0x2d
jmp 0x4a4d0e
mov dx, si
mov bx, word [esp]
jmp 0x4a4d87
add esi, dword [edi]
lea ebx, [eax*4]
dec ecx
jmp 0x4a4dde
xchg dh, cl
and ebx, edx
jmp fcn.004a4dc1
jno 0x4a4d97
xchg dh, cl
and ebx, edx
jmp fcn.004a4dc1
shl bx, 6
xor bl, 0x5b
xchg bh, bl
jmp 0x4a646d
clc
jmp 0x4a6462
xchg bh, bl
jmp 0x4a646d
jg 0x4a6425
shl bx, 6
xor bl, 0x5b
jmp 0x4a643e
mov ecx, dword [ecx - reloc.MFC42.DLL_CWnd::OnCommand]
lea ebx, [edi + ebp]
mov bx, word [esp]
mov bx, 0x6145
jmp 0x4a4ae0
Function at 0x4ab682
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
mov ah, byte [esp]
jmp 0x4ab7d6
mov dx, word [esp]
mov eax, dword [esp]
mov eax, 0xfa5e1c66
lea eax, [ebx*4]
mov bx, word [esp]
sub esp, 6
jmp 0x4ab704
mov ebx, 0x228f1c87
mov dl, 0x9f
rdtsc
mov ecx, edi
not ebx
or eax, esi
jmp 0x4ab6f9
js 0x4ab6c4
mov dx, word [esp]
mov eax, dword [esp]
jmp 0x4ab737
mov eax, edx
btc bx, dx
jle 0x4ab721
lea esp, [esp + 2]
jmp 0x4ab763
jno 0x4ab796
jo 0x4ab796
lea esp, [esp + 2]
jmp 0x4ab763
mov eax, 0xfa5e1c66
lea eax, [ebx*4]
mov bx, word [esp]
jmp 0x4ab6db
dec dx
jp 0x4ab77a
bsf bx, bp
lea ebx, [ebp + 0x67]
jmp 0x4ab7bb
lea esp, [esp + 4]
sub edi, 0x405f112d
rdtsc
lea ebx, [edx*4]
mov ah, al
jmp 0x4ab749
bsf bx, bp
lea ebx, [ebp + 0x67]
jmp 0x4ab7bb
sub esp, 0xbc
mov ebp, esp
mov ch, cl
jmp 0x4ab6e4
mov dl, byte [esp]
clc
jno 0x4ab80f
cmc
jmp 0x4ab7e8
inc edi
mov bx, 0x2dc3
lea eax, [esp + edx]
mov bl, 0xa2
mov dx, word [esp]
jmp 0x4ab7a5
lea esi, [esp + 4]
xchg edx, ebp
mov eax, edi
mov dx, 0x50d9
dec ebp
jmp 0x4ab71d
xchg dx, bx
jmp 0x4ab813
mov eax, edi
call fcn.004ab8ff
wait
mov eax, edi
jmp 0x4ab887
cmc
xchg dx, bx
neg edi
neg edx
jno 0x4ab7ed
jo 0x4ab7f5
lea edx, [ebp*4]
lea eax, [edi*4]
dec ax
or dx, bp
jmp 0x4ab859
xchg dword [esp + 8], ecx
mov bl, dh
bswap edx
cmp bl, dh
call fcn.004ab8a3
in eax, 0x78
out dx, al
mov dword [eax - 0x36], edi
aad 0x44
neg esi
sub dword [ebp + reloc.MFC42.DLL_CWnd::OnCommand], ecx
add byte [esi - 0x75], ah
adc al, 0x24
lea ecx, reloc.MFC42.DLL_CWnd::OnCommand
mov dx, word [esp]
mov edx, dword [esp]
mov ebx, esp
mov ax, sp
mov bx, 0xbb11
jmp 0x4ab83f
xchg al, bh
pushfd
not ebx
mov byte [esp], cl
sub esp, 0x1d
lea esp, [esp + 1]
call fcn.004ab8c9
dec eax
jmp 0x4ab8ee
inc bx
mov eax, 0xdb8aa75
jmp 0x4ab933
not ebx
mov byte [esp], cl
sub esp, 0x1d
jmp 0x4ab87c
jo 0x4ab871
xchg al, bh
pushfd
jmp 0x4ab8ac
mov dx, bx
mov dh, cl
jmp 0x4ab960
xor edi, 0x32bbfc9f
rcl bx, 0xc
jmp 0x4ab8c2
push esp
jmp 0x4ab946
mov dh, 0xc8
mov ebx, dword [esp + 2]
jmp 0x4ab989
add edi, dword [esi]
inc dx
jg 0x4ab93f
push esp
mov dh, 0xc8
mov ebx, dword [esp + 2]
jmp 0x4ab989
Function at 0x57e587
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec al
jmp 0x57e58f
mov bl, byte [esp + 4]
mov ah, byte [esp + 4]
mov dh, dl
sub esp, 3
xchg dword [esp], edi
pop di
jmp 0x57e600
mov esi, ebp
dec bh
mov di, 0xe08b
mov byte [esp + 0x11], dl
pop ebp
jmp 0x57e5e2
or ah, 0x86
cld
pop cx
rdtsc
pushal
mov ebx, eax
jmp 0x57e5bf
mov dl, byte [esp + 8]
pushfd
lea edi, [esi*4]
xchg word [esp + 0x15], si
lea ebx, [ebp - 0x56]
mov dh, byte [esp + 0x1a]
jmp 0x57e624
pop edx
rdtsc
inc ebp
add esp, 1
shr bp, cl
push si
jmp 0x57e5d5
cpuid
pop ebx
rdtsc
pop edi
dec esi
neg al
jmp 0x57e775
mov bl, byte [esp + 0x1a]
xchg ebx, eax
dec edx
push word [esp + 0x16]
xchg byte [esp], bh
push dword [esp + 0x18]
jmp 0x57e60e
mov ebp, dword [esp + 0xa]
mov eax, dword [esp + 6]
sub esp, 0x1f
bswap ebx
dec bx
jmp 0x57e73c
lea ebp, [eax*4]
xor bl, cl
setae cl
not dl
sub esp, 2
std
jmp 0x57e655
mov ah, 0x31
bt edx, esi
lea edx, [ecx + ebp]
bsr ebx, ecx
bswap edi
mov di, 0x58d6
call fcn.0057e6ff
cmp dl, byte [0x245c8966]
sub bh, ch
mov word [esp + 0x2a], bx
std
clc
push dword [esp + 0x38]
lea esp, [esp + 0x44]
cmc
jmp 0x57e67f
xchg ebx, edi
mov ecx, dword [esp + 0x33]
pop ecx
push dword [esp + 0x14]
cpuid
mov bh, 0x7c
jmp 0x57e697
xchg dword [esp + 0xd], ebp
xchg byte [esp + 0xe], al
not di
mov ebp, edx
mov edx, dword [esp + 1]
xchg bp, si
jmp 0x57e66b

Function at 0x57ef81
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
lea eax, [esi - 0xcb]
add esp, 3
mov ch, byte [esp + 3]
jmp 0x57efdb
rdtsc
not eax
mov esi, ebx
setb dh
mov dx, cx
stc
jmp 0x57f01c
pop word [esp]
bsf bp, cx
sub cl, 0xef
mov cx, bx
not bh
rdtsc
jmp 0x57efc5
btr ecx, esp

Function at 0x57ffce
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
neg dx
bsf eax, edx
mov ebx, dword [esp]
mov bx, 0x3e96
cld
pushal
mov eax, edi
mov bp, word [esp]
mov edi, dword [esp]
lea eax, [ebx + edi]
xchg ecx, ebx
jmp 0x57ff35
mov word [esp + 4], cx
pop word [esp + 1]
lea esp, [esp + 8]
jmp 0x57ff5f

Function at 0x580020
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bx
neg di
dec bl
rdtsc
shl ecx, 0x18
jmp 0x580064
mov eax, 0x9f7953e9
jmp 0x58000a
mov byte [esp + 7], dl
pop dword [esp + 9]
mov dx, 0x2597
mov edx, 0x4779a93f
rdtsc
push dword [esp + 0xa]
jmp 0x58004e
Function at 0x580236
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, byte [esp + 6]
pop dword [esp + 1]
jmp 0x580244
btc edi, eax
neg ebx
xchg ebx, ebp
setb ch
xchg ecx, ebp
rcr di, cl
jmp 0x580276
pop dword [esp]
cpuid
rdtsc
neg dh
pop ax
cmc
jmp 0x5802b4
xchg edi, esi
mov ah, 0x82
lea esp, [esp]
mov ah, 0x94
rdtsc
and edx, 0x4a55e6c3
jmp 0x58048b
setnp al
add esp, 0
sete cl
rdtsc
cmp esi, 0x793dc393
pop bx
jmp 0x580284
push dword [esp + 2]
pop ecx
mov dword [esp], ebx
xchg word [esp], bx
mov ch, bh
rdtsc
jmp 0x58033e
xchg byte [esp + 3], bl
mov dword [esp], eax
mov dh, dl
lea esp, [esp + 1]
push word [esp + 2]
xchg dl, bh
jmp 0x5802e8
push dword [esp + 1]
mov dx, word [esp + 7]
cld
push word [esp + 4]
xchg ecx, ebx
dec ecx
jmp 0x580356
bsr bp, di
mov dword [esp], edi
lea edx, [ebx*4]
jmp 0x58036b
lea edi, reloc.MFC42.DLL_CWnd::OnCommand
lea esp, [esp + 1]
xchg byte [esp + 1], dh
mov edi, dword [esp]
mov dh, 0xa8
bsr edi, eax
jmp 0x580314
pop edx
bt bx, dx
rdtsc
mov dx, 0xfb7
mov bl, byte [esp]
pop word [esp + 2]
jmp 0x580328
mov ah, 1
not edx
xchg ch, dh
sbb di, dx
add esp, 2
neg ch
jmp 0x5803a9
mov ch, 0x2c
rdtsc
xchg bx, ax
mov edi, dword [esp]
push ebx
dec cl
jmp 0x5802fe
bswap eax
bswap edi
bsf ecx, esi
mov edi, 0x50f114e8
btc edx, ebx
jmp 0x5803c4
rcl cl, 6
lea ebp, [esi*4]
mov esi, 0xb8f7e54f
xchg word [esp], di
mov word [esp], dx
pop bp
jmp 0x580393
xchg edx, eax
mov si, 0xd0f7
call fcn.0058045e
mov ecx, dword [edx]
cwde
dec dword [edx]
call 0x5a97b308
test eax, 0x56c0475e
xor eax, eax
and ch, bh
int3
lea esp, [esp]
setge bl
mov cx, sp
mov ax, word [esp]
mov al, byte [esp]
mov bx, word [esp]
jmp 0x580382
add esp, 0
bsr bx, dx
bsf ebx, edi
rdtsc
mov eax, dword [esp]
add esp, 0
jmp 0x5803e3