joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447ae0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x447b13
push esi
call fcn.0044abf0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x447b0c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x447b99
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x447b82
mov eax, dword [esi + 8]
test eax, eax
je 0x447b37
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x447b7e
cmp eax, 2
je 0x447b82
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x447b2a
cmp eax, 3
je 0x447b5d
cmp eax, 1
jne 0x447b2a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x447b2a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x447b2a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00447bc0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x447ba8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00447bc0
add esp, 4
pop esi
ret

Function at 0x4544c0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x454563
test eax, eax
jbe 0x454563
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x454563
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45450e
xor esi, esi
jmp 0x454514
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45453f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004564d0
add esi, eax
push esi
mov ebx, esi
call fcn.004564d0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x454520
pop ebp
test edi, edi
pop edi
jne 0x454563
test ebx, ebx
je 0x454563
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00462300
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4546a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4547bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4547bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004732c1
mov esi, eax
test esi, esi
je 0x4547bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4547bd
mov ecx, esi
call fcn.00454610
cmp edi, eax
jge 0x4547bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x454743
mov dword [esp + 0x34], 1
jmp 0x45479e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4547bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00453c10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x473c65
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x473c9d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00471d1c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00471cf4
jmp 0x473ca9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x475357
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x475399
call fcn.0047b07f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x475399
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x475390
xor eax, eax
jmp 0x4753a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004753a7
pop edi
pop esi
pop ebx
ret 4
Function at 0x47b5af
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47b5dd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47b5fb
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047b515
jmp 0x47b5fb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47b5fb
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047b515
test edi, edi
mov eax, edi
jne 0x47b5e5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x1133210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01133360
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1133236
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1133222
add dl, dl
jne 0x1133241
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1133294
xor eax, eax
add dl, dl
jne 0x113324e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1133335
add dl, dl
jne 0x113325d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1133268
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1133273
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113327e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x113328a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x113322d
mov eax, 1
add dl, dl
jne 0x11332a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11332ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1133299
sub eax, ebx
mov ebx, 1
jne 0x11332e0
mov ecx, 1
add dl, dl
jne 0x11332c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11332d1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11332bd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113322d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11332f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1133302
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11332ee
cmp eax, 0x7d00
jae 0x1133325
cmp eax, 0x500
jb 0x1133320
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113322d
cmp eax, 0x7f
ja 0x1133328
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113322d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1133356
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x113322d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4c4ea2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04b5230
jmp 0x4c4f0b
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
jmp 0x4c4ebf
pushfd
jmp 0x4c4164

Function at 0x4c76ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04b5230
jmp 0x4c7724
lea esp, [esp]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], edi
jmp 0x4c773a
pushal
push word [esp + 8]
jae 0x4c787f
lea esp, [esp + 2]
jmp 0x4c77af
lea esp, [esp + 0x34]
pushfd
jmp 0x4c6110
mov edi, dword [esp + 0x4c]
lea esi, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
mov dh, 0x6d
setl bl
mov dh, al
jmp 0x4c7826
stc
jae 0x4c7806
rcl eax, cl
mov ax, word [esp]
sub esp, 6
rdtsc
bswap eax
jmp 0x4c780e
sub esp, 0xa0
mov esi, esp
rdtsc
lea ebx, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
mov ebx, edi
jmp 0x4c77dc
rcl eax, cl
mov ax, word [esp]
jmp 0x4c7849
lea edx, [ecx + esi]
mov ch, cl
lea esp, [esp + 2]
jmp 0x4c7833
lea ebp, [esp + 0x20]
xchg si, cx
cpuid
bswap ecx
jmp 0x4c77f2
lea esp, [esp + 4]
not edi
ror edx, cl
jno 0x4c7868
jo 0x4c7852
xchg ecx, eax
adc al, 0x8a
in eax, dx
sbb al, 0xe9
add eax, eax
cmp dword [edx], reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
in al, dx
push es
sub esp, 6
rdtsc
bswap eax
jmp 0x4c780e
bsr ax, ax
mov ax, word [esp]
bswap eax
jmp 0x4c789a
bsr ax, ax
mov ax, word [esp]
bswap eax
sub esp, 9
shr dx, 0xb
jmp 0x4c7884
call fcn.004c7744
rcr edx, 5
setne al
lea esp, [esp + 1]
jmp 0x4c78a3
sub esp, 9
shr dx, 0xb
jmp 0x4c7884
lea esp, [esp + 8]
sub edi, 0x13d0fc1a
dec cx
js 0x4c79bd
jns 0x4c7939
rcl byte [edi - 0x39], cl
mov byte [0xc848b951], al
pop esi
cmp eax, ecx
cmp esp, ebp
adc al, 0x40
mov ecx, ebp
lea ecx, [ecx + edx]
xor cl, al
jno 0x4c7917
inc dh
lea ecx, [esi - 0x54]
jmp 0x4c791b
xchg edx, eax
lea eax, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
jmp 0x4c79ca
lea ecx, [esi - 0x54]
jmp 0x4c791b
inc dh
jmp 0x4c7901
dec edi
push ebx
xor eax, 0x1f1cf2bf
jg 0x4c7957
jle 0x4c7941
out 0x62, eax
invalid
rdtsc
xchg al, cl
bswap edx
jmp 0x4c78f5
push dword [esp + 3]
neg ah
btc eax, eax
jmp 0x4c7980
push dword [esp + 3]
neg ah
btc eax, eax
mov eax, dword [esp + 4]
lea esp, [esp + 8]
inc edi
xchg cx, dx
not ax
jmp 0x4c799c
mov eax, dword [esp + 4]
jmp 0x4c7964
add edi, dword [ebp]
mov ch, byte [esp]
push ebp
jmp 0x4c79a3
bts eax, esp
je 0x4c7986
jne 0x4c7986
pop ax
mov word [esp], di
lea esp, [esp + 2]
call fcn.004c84e9
inc edi
insb byte es:[edi], dx
call 0xb349337
test dword [edi], esi
dec esi
rdtsc
xchg al, cl
bswap edx
xchg edx, eax
lea eax, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
dec edi
mov dh, byte [esp]
jmp 0x4c78d7
Function at 0x4c7744
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr edi, edi
seto dl
rdtsc
bts si, di
sub esp, 0xd
jmp 0x4c77c8
xchg dword [esp + 0x10], edi
bts di, dx
bt edi, edx
rdtsc
jmp 0x4c77a8
lea edi, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
sub esp, 4
rcl ecx, 0
mov dl, 0x53
cpuid
lea ecx, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
jmp 0x4c777a
push dword [esp + 0x10]
ret 0x14
lea esp, [esp + 1]
xchg dword [esp + 0xc], edi
xchg edx, ebx
xchg dh, bh
mov cx, word [esp]
neg esi
jmp 0x4c7790

Function at 0x4c968e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx + 0x47]
jmp 0x4c96c6
xchg bx, ax
bswap edx
mov bh, byte [esp]
rdtsc
lea ebp, [ebp + 0x1a]
jmp 0x4c970e
lea ebx, [esp + 0xe1]
sete al
not bh
shl bh, 1
xchg dword [esp], ebp
lea ebx, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
jmp 0x4c96b0
cmp dh, ah
rdtsc
pushal
push dword [esp + 0x20]
ret 0x24
mov ax, word [esp]
bsf ebx, esi
mov ah, bh
cmp ax, 0x9572
xchg dword [esp], ebp
not edx
jmp 0x4c96f5

Function at 0x4c973d
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edi
lea eax, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
mov bl, byte [esp]
mov eax, edi
mov ebx, ebp
mov edx, edi
jmp 0x4c9747
mov ebx, dword [esp + 2]
lea esp, [esp + 4]
jmp 0x4c9722
dec edi
push ax
setne dh
mov bx, 0xc3fe
xchg ebx, edx
jmp 0x4c97e3
mov dh, byte [esp]
mov eax, edx
stc
jmp 0x4c97c4
rdtsc
mov ebx, 0x9b1135ee
jmp 0x4c9817
not edi
setp dh
mov dx, sp
stc
jle 0x4c9789
jg 0x4c97bc
xchg edi, eax
pop ss
xchg edx, esp
adc esp, ebp
or ah, byte [ebp - 0x74dbcb76]
ret 0xebf9
mov dh, byte [esp]
mov eax, edx
stc
jmp 0x4c978f
ror edi, 0
jp 0x4c9791
rdtsc
mov ebx, 0x9b1135ee
mov al, byte [esp]
mov dx, 0xb5c0
jmp 0x4c981e
lea esp, [esp]
mov word [esp], bp
lea esp, [esp]
lea edx, [esi + ebp]
lea esp, [esp + 2]
jmp 0x4c97a7
mov al, 0xa0
mov dl, cl
mov dx, di
jmp fcn.004c9838
mov al, byte [esp]
mov dx, 0xb5c0
add edi, dword [esi]
jmp 0x4c97f6
Function at 0x506344
Capabilities:
Encrypt data using aes

Disassembly:
bswap ebp
pushal
mov dword [ecx + 4], edx
jmp 0x50639b
lea ebx, [ebx + 9]
movzx esi, byte [ebx]
pop ebx
shl edx, 8
jmp 0x506379
xor edx, esi
jmp 0x506384
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
jmp 0x506358
movzx esi, byte [eax + 0xb]
jmp 0x5063a4
movzx edx, byte [eax + 8]
push ebx
mov ebx, eax
jmp 0x50634c
shl edx, 8
xor edx, esi
mov dword [ecx + 8], edx
jmp 0x5063b2
movzx edx, byte [eax + 0xc]
jmp 0x5063fc
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
jmp 0x5063e4
xor edx, esi
shl edx, 8
jmp 0x506437
movzx esi, byte [eax + 0xd]
shl edx, 8
xor edx, esi
jmp 0x5063d3
and eax, esi
jmp 0x506440
shr eax, 0x10
mov esi, 0xff
jmp 0x506407
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
jmp 0x50641d
push edi
mov edi, eax
lea edi, [edi*4]
jmp 0x506450
lea edi, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
mov eax, dword [edi]
pop edi
jmp 0x50650a
shr edi, 8
jmp 0x5064db
xchg edi, ebx
mov edi, edx
mov ebx, ebp
mov ebx, dword [esp]
jmp 0x50647b
pushfd
jmp 0x5064c2
and edi, 0xff0000
mov ebx, dword [esp]
mov bl, 0x6f
mov ebx, dword [ecx + 4]
jmp 0x50649c
lea esp, [esp + 4]
and eax, 0xff000000
jmp 0x5064ef
and edi, esi
xchg bl, bh
mov edi, dword [edi*4 + reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z]
lea ebx, [ebx*4]
jmp 0x5064b2
xor eax, edi
mov ebp, 0xc4821b21
neg di
jmp 0x50656f
lea esp, [esp + 0x44]
xor eax, 0x1000000
bswap ebp
cmc
lea ebp, [edx + edi]
jmp 0x506491
mov edi, edx
lea ebp, [eax + edi]
mov ebp, 0x6f043d90
jmp 0x506543
lea ebp, [edi + edi]
movzx edi, byte [edi*4 + 0x4bfe60]
xor eax, edi
jmp 0x50651e
lea ebp, [edi*4]
and edi, esi
mov bp, word [esp]
bsf bp, sp
jmp 0x506594
clc
call fcn.0050657e
inc ecx
invalid
mov edi, edx
shr edi, 0x18
mov ebp, esi
lea ebp, [eax - 0xe9]
jmp 0x506534
mov edi, dword [edi*4 + reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z]
stc
mov ebp, 0x4ef160c6
add ebp, 0xb10f9e3a
jmp 0x506556
Function at 0x50687d
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x506674
mov eax, edi
push ebx
jmp 0x50669c
xchg dx, ax
mov cl, 0xcb
bt cx, bx
bswap eax
jmp 0x5061c3
mov ebx, eax
jmp 0x5066d7
neg edi
jmp 0x506703
add ebx, 0xc
mov edx, dword [ebx]
pop ebx
dec cx
mov di, word [esp]
jmp 0x5066c1
mov di, 0xcaae
mov di, word [esp]
mov edi, esi
jmp 0x506713
pushal
lea eax, [eax*4]
mov dword [esp + 0x18], edx
stc
popal
jmp 0x5066e5
shr ecx, 8
lea edi, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
neg edi
pushal
jmp 0x50675b
lea esp, [esp + 2]
lea esp, [esp + 0xc]
popal
call fcn.00506773
imul ebp, ecx, 0x79
sbb bl, ch
sbb cl, byte [eax - 0x2b287ed5]
or edi, dword [ebx + eax + 0x66]
mov edi, 0xf7664a76
rol dword [eax + reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z], cl
and al, 0x83
in al, dx
push cs
adc edi, 0x37c0bd4
mov di, 0x4a76
not bx
sbb ah, 0xd6
mov dword [esp], edx
sub esp, 0xe
jmp 0x506745
jmp 0x506893
shr edi, 0x18
pushal
push word [esp + 0x1e]
pop dword [esp + 7]
jmp 0x50690a
mov edx, 0xb757ad4f
dec edi
lea edi, [eax + ebx]
jmp 0x5068ee
and edx, ebp
xor ecx, edx
lea esp, [esp + 0x44]
xor ecx, dword [ebx]
jmp 0x5068b6
xor ecx, dword [eax]
pushfd
jmp 0x506930
lea edi, [eax + 0x10]
mov dx, si
lea edx, [ecx + ebp]
jmp 0x5068d8
lea esp, [esp + 2]
movzx edi, byte [edi*4 + 0x4bfe60]
xor ecx, edi
jmp 0x5068cc
mov dword [edi], ecx
mov dh, bh
not dx
setp dh
jmp 0x50693c
lea esp, [esp + 4]
add ebx, 4
pushfd
xchg dl, dh
jmp 0x50691a
mov edx, dword [eax + 4]
call 0x506945
nop
sub esp, 0x15
sub esp, 0x18
lea esp, [esp + 1]
jmp 0x506982
mov ecx, dword [eax + 8]
pushal
jmp 0x5069ba
xor edx, ecx
mov dword [eax + 0x14], edx
mov cx, 0x6215
jmp 0x50696c
mov edi, eax
jmp 0x5069c2
xor ecx, edx
mov dword [eax + 0x18], ecx
push edi
jmp 0x5069a4
lea edi, [edi + 0xc]
mov edx, dword [edi]
pop edi
xor edx, ecx
jmp 0x506a15
push 0xa
xchg ah, bl
mov bp, word [esp]
jmp 0x506a3a
jne 0x5061be
bswap eax
mov eax, dword [esp]
setb bh
mov al, ch
jmp 0x5069e4
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x54]
cmp ebx, 0x4c1688
jmp 0x5069fa
mov bh, cl
lea esi, [edx*4]
jmp 0x506a5a
pop eax
not bl
mov si, 0x6885
pop edi
jmp 0x506a24
lea esp, [esp + 8]
pop ebp
mov bh, byte [esp]
push ebx
call fcn.00506a7a
mov ecx, 0x38c9ae38
ficom dword [ebp + 0x24348b04]
mov esi, dword [esp]
not ebx
pushfd
mov bh, 1
jmp 0x506a44
Function at 0x607b52
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ebx
mov dword [esp], edx
lea esp, [esp]
mov ax, word [esp + 3]
lea edx, [ecx + 0x74]
bswap edi
jmp 0x607b71
pop word [esp + 4]
bswap ebp
jmp 0x607b2c
neg bl
pop ecx
add esp, 0
mov esi, 0x47ed7212
bt ecx, esi
jmp 0x607b84
sbb di, bp
bswap ebx
dec cx
mov byte [esp + 2], cl
xchg byte [esp + 4], bh
not edi
jmp 0x607b5b
xchg di, bp
xchg word [esp], ax
setg ch
sub esp, 0xc
mov dword [esp + 7], edx
cld
jmp 0x607beb
mov ah, 0x40
xchg bp, dx
xchg bp, di
mov ah, byte [esp + 4]
lea ecx, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
not ecx
jmp 0x607bb0
push word [esp + 0xc]
push dword [esp + 2]
bsr ax, si
rdtsc
mov edx, 0x3ef2d3c6
mov word [esp + 0xb], bx
jmp 0x607bc6

Function at 0x607f2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc ax, sp
mov esi, 0xc690c4e4
jmp 0x607f3c
mov ebx, 0x1c1f57bb
mov ch, bh
mov si, 0x5a8d
mov dx, 0x18b1
mov bp, word [esp + 8]
jmp 0x607f6a

Function at 0x6082a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [ebx*4]
xchg byte [esp + 2], bh
setae dh
inc cx
jmp 0x6082ca
lea ebx, [edi + edi]
mov dword [esp], ebp
rdtsc
cld
jmp 0x608292
inc cl
dec ax
lea esp, [esp + 4]
bsf ecx, ecx
lea ebp, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
jmp 0x6082df
xchg word [esp], ax
mov dword [esp], eax
bswap esi
mov ebx, 0xf56ff829
neg al
lea edx, [esi + esi]
jmp 0x6082b3
lea esp, [esp]
mov eax, 0x8fcf597f
mov ch, byte [esp]
cmp bp, 0xdc8a
dec bh
lea esi, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
jmp 0x608393
cpuid
lea esp, [esp + 2]
mov esi, dword [esp]
xchg ah, cl
btc edi, ebx
mov cx, di
lea edx, reloc.mrtcomm.dll__HexTextToBin_CLitCall__SAXV__CStringT__WV__StrTraitMFC_DLL__WV__ChTraitsCRT__W_ATL_____ATL__PAE_Z
sbb al, 0xa2
jmp 0x608338
neg ch
not ch
lea eax, [eax + 0x7c]
rcr eax, cl
mov ecx, 0x8b3a158d
pushfd
jmp 0x608367

Function at 0x608559
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl edi, 0x12
rdtsc
pop dword [esp + 0xc]
mov ebx, dword [esp + 0x16]
jmp 0x608574
bts esi, esp
jmp 0x608543
mov dword [esp + 5], edx
btc ebx, esi
lea ebx, [edi + edi]
jmp 0x6085f5
mov cx, word [esp + 2]
xchg bh, dl
xchg dword [esp + 0x16], edi
mov edx, 0xcb9bbbc0
mov word [esp + 0xd], si
mov ecx, dword [esp + 6]
jmp 0x60855e
pop ecx
lea esp, [esp + 2]
lea esi, [eax + ecx]
bsr cx, cx
not ebx
mov di, bp
jmp 0x6085b0
lea ebp, [eax*4]
std
not bl
inc cl
add esp, 0x14
lea eax, [esp + eax]
jmp 0x6085c6
Function at 0x608823
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, di
xchg si, di
shl ebx, 9
pop ax
mov word [esp], bx
cmc
jmp 0x6087f2
mov al, 0xee
mov ah, 0xa3
not ebp
inc ebx
mov dh, byte [esp]
mov dx, word [esp]
jmp 0x6087a1
mov cl, ch
mov cx, dx
bswap esi
bts esi, esp
sub esp, 8
add esp, 0xc
jmp 0x608805
cmc
rdtsc
xchg byte [esp], ch
mov si, word [esp]
xchg esi, ebp
mov dl, 0x25
jmp 0x6089c6
rdtsc
mov ebp, ebx
not esi
push word [esp + 2]
bswap edi
mov bp, word [esp]
jmp 0x6087c7
mov ebp, dword [esp]
mov eax, 0x37bd752c
lea esp, [esp]
pushfd
pop esi
xchg cl, bh
jmp 0x6087d9
neg cl
lea esi, [ebx + edi]
mov byte [esp + 2], bh
jmp 0x6087b7
sub ebp, 0x8c17e780
xchg di, ax
bswap eax
sub esp, 0x1d
bswap esi
call fcn.0060882e
mov dx, word [esp]
bswap esi
inc ch
xchg bp, ax
bswap ecx
mov edx, dword [esp]
jmp 0x608844

Function at 0x60882e
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr dh, cl
jmp 0x6088c8
ror esi, 2
lea edi, [esi + 0x9c]
mov ax, bx
xchg byte [esp + 4], al
jmp 0x60889d
pop word [esp + 0xf]
xchg word [esp + 3], di
std
mov ebp, dword [esp + 0x13]
mov eax, dword [esp + 0xf]
or dx, bp
jmp 0x608859
mov esi, ebp
std
lea esi, [ebx + edi]
lea eax, [ebx + esi]
neg ah
cld
jmp 0x6088b1
push word [esp + 2]
add esp, 0x15
bswap ebp
xchg dword [esp + 1], ebp
sub edi, ebp
rcl edx, cl
jmp 0x608887
not cx
mov dx, bx
sub esp, 0xf
xchg ebx, ecx
push ax
mov cl, dl
jmp 0x608951
mov word [esp + 3], ax
mov byte [esp + 0x15], al
inc ecx
mov bp, word [esp + 0x16]
bt ebp, esi
mov byte [esp + 0xe], ah
jmp 0x60886f
mov si, word [esp + 5]
xchg word [esp + 5], dx
xchg edi, ebx
mov bl, dh
jmp 0x608922
lea esp, [esp + 0x11]
mov cl, 0x6c
lea edi, [esi - 0xc1]
mov dl, cl
xchg esi, ebp
mov dh, byte [esp + 4]
jmp 0x6088e0
stc
inc ah
cpuid
mov esi, 0x56e916d2
pop dword [esp]
lea esp, [esp]
jmp 0x608938
mov ax, bx
mov dh, byte [esp]
bsr si, di
setb dl
neg esi
mov dx, word [esp + 6]
jmp 0x60890c
pop ax
neg al
cpuid
mov bh, 0xb6
rdtsc
mov di, 0xcc1e
jmp 0x60897e
pop esi
push word [esp + 2]
xchg word [esp + 0xf], bx
rdtsc
setg ch
dec ebx
jmp 0x6088f6
bsf edx, ecx
pushal
xchg edx, edi
bt bx, bx
pop dx
mov di, word [esp + 0x19]
jmp 0x6089a6
mov dword [esp], esi
mov al, 0x30
mov dword [esp], eax
lea esp, [esp + 2]
cld
xchg dx, ax
jmp 0x608964
mov word [esp + 0xd], sp
mov si, word [esp + 8]
pushfd
lea esp, [esp + 0x18]
popal
call fcn.00608b02
push esi
pushal
lea esp, [esp + 0x41]
sub esp, 0x10
push word [esp + 1]
push word [esp + 8]
xchg word [esp + 0xb], di
jmp 0x608990