joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb820
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5155b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x4cb8d0
mov eax, dword [0x6f4204]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0050561d
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0050566c
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.005055c9
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4cb8b7
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4cb8b7
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00505239
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ce9d0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x515a40
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4ceb77
mov ecx, dword [0x6f4204]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x4ceacc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004cd6f0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00505326
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00505239
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x6f2008
call fcn.005052a7
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.004cdab0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.00505326
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00505239
lea ecx, [esp + 0xc]
call fcn.00505701
mov ecx, dword [esp + 0xc]
push 0x6f2a44
push ecx
call fcn.004f3c24
add esp, 8
test eax, eax
je 0x4ceaf4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x4cea2d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00505239
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00505239
jmp 0x4ceb7b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.004ce770
test eax, eax
push 0
je 0x4ceb5f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.004cce10
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4ceb45
cmp eax, 0x64
jg 0x4ceb33
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4cead0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4cead0
cmp eax, 0x64
jge 0x4ceacc
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4cead0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.004cce10
mov esi, eax
jmp 0x4cead0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x4ceb85
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x4d6120
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4d6186
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4d6186
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4d6167
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4d6c60
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4d6ca9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4d7120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x515da0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004d6cd0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004d6d50
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004d6d50
lea ecx, [esi + 0xc]
call fcn.005051c4
lea ecx, [esi + 0x10]
call fcn.005051c4
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004d82e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004d82e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004d82e0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00505239
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00505239
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4d8c20
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x4d8c6c
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call edi
test eax, eax
jne 0x4d8c6c
pop edi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0x18], 2
jne 0x4d8c7f
cmp dword [esp + 0xc], 5
jb 0x4d8c7f
mov esi, 1
mov eax, esi
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x4db6d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e2b0
push 0x4f5a44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004f3bf0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db880
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x4db8c1
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x4db92e
cmp dword [esp + 0x1c], 2
jne 0x4db92e
cmp dword [esp + 0x10], 5
jne 0x4db92e
cmp dword [esp + 0x14], 1
jne 0x4db92e
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4db918
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4db909
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x4db911
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x4db92e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret
Function at 0x4dc4b0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.004f44d0
mov eax, dword [esp + 0x2824]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
call fcn.004f56b5
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4dc65d
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, [esp + 0x11c]
mov dword [esp + 0x14], eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x124]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x4dc65d
mov ecx, dword [esp + 0x283c]
mov edx, dword [esp + 0x128]
push ecx
push 0
lea eax, [esp + 0x124]
push edx
push eax
call fcn.004dc670
mov ecx, dword [esp + 0x2848]
mov edx, dword [esp + 0x13c]
push ecx
push 0
lea eax, [esp + 0x134]
push edx
push eax
call fcn.004dc670
mov ecx, dword [esp + 0x2860]
mov edx, dword [esp + 0x150]
push ecx
push 0
lea eax, [esp + 0x144]
push edx
push eax
call fcn.004dc670
mov ecx, dword [esp + 0x2864]
mov edx, dword [esp + 0x164]
push ecx
push 1
lea eax, [esp + 0x154]
push edx
push eax
call fcn.004dc670
mov ecx, dword [esp + 0x2884]
add esp, 0x40
xor eax, eax
lea edi, [esp + 0x11c]
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0x4dc65d
mov edi, dword [esp + 0x124]
mov edx, dword [esp + 0x2848]
mov eax, dword [esp + 0x284c]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret
Function at 0x4e4130
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5169a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0050b2f6
xor eax, eax
mov dword [esi + 0x10], 0x60e72c
mov dword [esp + 0x10], eax
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi], method.CDC.virtual_0
mov byte [esp + 0x10], cl
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ecx], eax
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], eax
push edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004e4230
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x4e41c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5169cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CDC.virtual_0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 1
push eax
call fcn.004e4e70
lea ecx, [esi + 0x10]
mov dword [esp + 8], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x14], 2
call fcn.0050bf44
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0050b42b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x507644
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x50767c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00505694
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0050566c
jmp 0x507688
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x508d39
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x508d7b
call fcn.0050ec9c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x508d7b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x508d72
xor eax, eax
jmp 0x508d83
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00508d89
pop edi
pop esi
pop ebx
ret 4
Function at 0x50f1cc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x50f1fa
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x50f218
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050f132
jmp 0x50f218
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50f218
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0050f132
test edi, edi
mov eax, edi
jne 0x50f202
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x469a16
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04542e4
jmp 0x469a20
pushfd
jmp 0x468e01
lea esp, [esp + 2]
push edi
jmp 0x4699e7
lea esp, [esp + 8]
mov word [esp], di
jmp 0x4699fd
ror ebp, cl
jmp 0x469ba2
lea ebp, [ebx*4]
lea ebp, [esi*4]
jmp 0x469ad0
inc bx
jno 0x469a7b
mov edx, dword [esp]
jmp 0x469a7e
sub esp, 0xc0
mov ebp, esp
cpuid
rdtsc
jmp 0x469a57
mov edx, dword [esp]
mov eax, esi
rcr bx, cl
jmp 0x469a9f
lea edi, [esp]
xchg bp, ax
bswap ebx
rdtsc
rdtsc
jmp 0x469a6d
jle 0x469ab5
mov dh, byte [esp]
mov edx, ecx
jmp 0x469b65
mov dh, byte [esp]
mov edx, ecx
btr cx, bx
mov edx, dword [esp]
lea ecx, [esp + eax]
not dx
jmp 0x469b09
mov esi, dword [esp + 0x2c]
xchg bp, cx
lea edi, [edx + edi]
mov ebp, esp
cpuid
jmp 0x469a92
mov ch, byte [esp]
not dh
mov edx, dword [esp]
bsr cx, ax
jmp 0x469b33
add esi, 0x4fb3d1e5
mov dx, word [esp]
mov bx, 0xaf13
lea ecx, [eax + edx]
jmp 0x469b19
mov ecx, 0x5d62cb95
bswap ebx
mov bx, word [esp]
mov dh, 0x4a
inc esi
jmp 0x469ae0
mov edx, 0xd51304a6
btc cx, di
jns 0x469b4d
mov bx, word [esp]
jmp 0x469b37
jbe 0x469af2
ja 0x469af2
push ebp
jmp 0x469b8a
mov bx, word [esp]
push ebp
jmp 0x469b8a
btr cx, bx
mov edx, dword [esp]
lea ecx, [esp + eax]
jmp 0x469ac4
sub esp, 0x1d
jb 0x469bd1
bsr ecx, esp
mov word [esp + 1], dx
jmp 0x469bf1
lea esp, [esp + 4]
add esi, 0x37549bda
mov dx, sp
mov bx, word [esp]
jmp 0x469b74
jo 0x469a28
lea ebp, [ebx*4]
lea ebp, [esi*4]
jmp 0x469ad0
lea esp, [esp + 1]
jmp 0x469bdb
bsr ecx, esp
mov word [esp + 1], dx
jmp 0x469bbb
lea esp, [esp + 0x1c]
inc esi
push ax
xchg word [esp], bx
call fcn.00469c86
pop ds
xchg cx, ax
adc byte [ebx + 0x24648d0a], dl
add ebx, ebp
in al, 0xb8
and eax, 0xeb2fdcb5
retf 0xc456
lea esp, [esp + 1]
jmp 0x469bdb

Function at 0x4710aa
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x457617
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x457631
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x457620
pop esi
jmp 0x45763c
ret 4
lea esp, [esp + 4]
jmp 0x45760a

Function at 0x471875
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
not cl
mov ecx, dword [esp + 2]
mov dword [esp + 2], esi
mov cx, ax
jmp 0x47184f

Function at 0x488b7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
push eax
sub esp, 0xb
jmp 0x488ba0
lea esp, [esp + 8]
push dword [ebp + 8]
push bp
lea esp, [esp + 2]
jmp 0x488d69
lea esp, [esp + 3]
jmp 0x488b88
call 0x470d0a
mov ax, 0xecce
add esp, 0x1c
call fcn.00488c00

Function at 0x50fa18
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], eax
mov ebp, 0x3ae7fbd9
add esp, 4
cld
jmp 0x50fa5a
xchg byte [esp + 1], ah
mov dh, byte [esp + 3]
setns bh
lea eax, [ebx + ebx]
bsr ebp, ebx
jmp 0x50fa44
Function at 0x50ff49
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x19
lea esp, [esp + 0x23]
not si
pop word [esp + 6]
jmp 0x50ffb7
pop word [esp + 1]
lea eax, [esi - 0xf4]
rdtsc
xchg dword [esp], edi
jmp 0x50ffe2
lea ebp, reloc.KERNEL32.dll_WriteProcessMemory
lea ebp, [ecx - 0x89]
mov bh, dh
pop dword [esp + 4]
push word [esp + 8]
bswap edx
jmp 0x50ff78
bsr ax, si
cld
rdtsc
pop ecx
mov bl, byte [esp + 8]
lea ebx, [ebx*4]
jmp 0x50ff8e
add esp, 5
mov bh, dh
add esp, 0
call fcn.0050ffcc
lea esp, [esp]
mov edx, 0x64e9ef38
lea esi, [eax + ebx]
xchg edi, edx
sub esp, 5
jmp 0x510050
mov ch, byte [esp]
lea ebp, reloc.KERNEL32.dll_WriteProcessMemory
lea esi, [ecx + edi]
cld
mov dh, byte [esp]
xchg byte [esp], dh
jmp 0x50ffef
xchg edi, edx
mov al, byte [esp]
setns al
lea esp, [esp]
neg si
mov dl, byte [esp]
jmp 0x510005
mov dl, 0x78
mov byte [esp + 9], dl
xchg ebp, eax
lea edx, [ebx + 0xb9]
inc dx
jmp 0x510065
sub esp, 0xd
xchg dword [esp], ecx
mov eax, edx
not bh
rol cx, 3
mov si, word [esp + 0x11]
jmp 0x51003a
mov word [esp + 0xb], sp
pop word [esp + 3]
mov cx, word [esp + 0xb]
call fcn.005100fe
fsubr qword [edi]
mov ebp, 0xcff67afb
neg edx
lea esp, [esp + 3]
neg bx
add esp, 0
add esp, 0
jmp 0x510027
Function at 0x5100fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt edi, ecx
lea eax, reloc.KERNEL32.dll_WriteProcessMemory
rdtsc
xchg dword [esp + 7], eax
shr bh, 6
not bh
jmp 0x5100df
lea ecx, [ebx + edi]
mov dh, byte [esp + 0xf]
add esp, 4
lea eax, [ecx + ecx]
mov byte [esp], al
mov word [esp + 0xd], si
jmp 0x510091
push word [esp + 4]
add esp, 0xb
bswap esi
mov edx, dword [esp + 7]
dec dh
jmp 0x51011e
add dl, cl
sub ah, dl
xchg byte [esp + 6], dl
cmc
mov ebp, 0x4c6f8aef
bsr edx, ecx
jmp 0x5100c9
rdtsc
mov bh, cl
adc ax, 0x3e88
jmp 0x5100b2
pop dx
mov edx, 0x4995f5bb
rdtsc
lea esp, [esp + 5]
call fcn.00510108
push esp
insb byte es:[edi], dx
jae 0x51017a
jb 0x51019b
add byte gs:[ebp + 0xad14], cl
add byte [eax], al
bsr ax, cx
btc bp, bp
mov cl, bl
lea edi, [edi + edi]
rdtsc
jmp 0x51007b
mov al, bh
lea eax, [ebp*4]
mov ecx, 0x7f59e425
pop dx
not esi
xchg dword [esp], ecx
call fcn.00510153
add esp, 6
lea ecx, [edx + edx]
std
pop word [esp]
lea ecx, [esi*4]
rdtsc
jmp 0x5101cc
mov esi, 0xb34b2889
jnp 0x51019f
mov bl, 0x7b
std
push dword [esp + 2]
cpuid
mov dword [esp], esp
mov bp, ax
jmp 0x51016a
pop si
mov edi, dword [esp + 8]
pushfd
lea eax, [edi*4]
jmp 0x5101dc
dec si
xchg bl, dl
sub esp, 0x1f
neg bx
pop ebx
call fcn.005101b0
mov dword [esp + 0x22], edx
not ah
call fcn.0051021d
push esp
insb byte es:[edi], dx
jae 0x51022c
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
cpuid
push word [esp + 0x16]
push dword [esp + 0x23]
sbb bl, 0x7d
lea ecx, [ecx + esi]
pop di
jmp 0x5101b6
mov ax, 0x735a
rdtsc
mov ebp, ebx
cpuid
bt ax, dx
rdtsc
jmp 0x51024e
dec esp
jmp 0x510207
lea ebx, [eax*4]
lea edi, [esi*4]
or dl, 0x5a
not edi
add esp, 1
rdtsc
jmp 0x510272
xchg bx, cx
rdtsc
xchg bp, ax
stc
cpuid
push edx
jmp 0x51022f
mov cx, ax
bswap eax
mov edi, 0xd35f590e
mov ah, byte [esp + 1]
dec edi
jmp 0x510282
xchg bp, ax
rdtsc
mov esi, ebx
mov bh, byte [esp]
xchg al, bl
mov edi, dword [esp]
jmp 0x51025c
mov si, word [esp]
mov dl, 7
mov byte [esp], dh
rcr cl, cl
lea ebp, reloc.KERNEL32.dll_WriteProcessMemory
mov edx, dword [esp]
jmp 0x5102c6
mov cl, 0x73
mov eax, dword [esp]
sub esp, 9
setle cl
mov di, 0x9a35
jmp 0x5102f2
mov ebp, 0xda396635
cpuid
lea esi, [edx*4]
stc
setb ch
inc dx
jmp 0x5102b0
not ebx
mov ah, 0x36
not ah
call 0x5102dc
stc
lea edi, [ebx + esi]
xchg dword [esp + 8], esi
setl bh
mov esi, ecx
mov cl, byte [esp + 0x10]
jmp 0x510a2d
bswap edx
mov cl, byte [esp + 0xc]
mov al, byte [esp]
neg edx
lea esp, [esp + 0x15]
std
lea edi, reloc.KERNEL32.dll_WriteProcessMemory
sub esp, 0x10
jmp 0x51036e
rdtsc
xchg dword [esp + 4], eax
xchg dword [esp + 2], edx
setle bl
lea esp, [esp + 0xe]
sub esp, 0xe
jmp 0x5103b5
pop cx
bsr di, sp
mov ecx, 0x5cea5d4e
bt di, di
lea ecx, [ecx + esi]
pop word [esp + 5]
jmp 0x5106bc

Function at 0x510108
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cl
adc edx, ebx
jmp 0x51019f

Function at 0x51021d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ebp*4]
mov ebx, dword [esp + 0x24]
pushal
lea esp, [esp + 0x4c]
Function at 0x51051d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], ah
bt dx, bp
lea ecx, [esi*4]
xchg ah, al
bswap esi
jmp 0x5104ff

Function at 0x5105f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
rdtsc
shl bx, 0xf
mov byte [esp + 1], dl
clc
mov eax, ecx
jmp 0x510615
bswap edx
cpuid
not dx
jmp 0x5105e0
bswap esi
pushfd
push dword [esp + 3]
not cl
call fcn.005105ff
pop dword [esp + 6]
push eax
mov ecx, 0x60fed43d
pop bx
mov di, si
cpuid
jmp 0x51066c
lea ebx, [edi*4]
cmc
or cl, dl
rdtsc
xchg cx, ax
rdtsc
jmp 0x510656

Function at 0x5129e5
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.005121e1
lea esp, [esp + 0xc]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x512a04
push eax
jmp 0x5121dc
mov dword [esp], eax
mov dword [esp + 0xc], edi
jmp 0x5129bc
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x5129cb