joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470745
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47085d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47085d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004b1b7f
mov esi, eax
test esi, esi
je 0x47085d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x47085d
mov ecx, esi
call fcn.004706b0
cmp edi, eax
jge 0x47085d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4707e3
mov dword [esp + 0x34], 1
jmp 0x47083e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x47085d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046fca0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4750e7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c25a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x14]
call fcn.004aed17
mov eax, dword [0x9ae2b0]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x48], eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp ebx, edi
mov byte [esp + 0x18], 1
mov dword [esi], 0x987a74
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
je 0x475144
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.004afe35
add esp, 4
mov dword [esi + 4], eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4803d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x48058d
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x480506
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x480506
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x4804ed
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x4804ed
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.00481640
mov ebp, eax
test ebp, ebp
je 0x4804e5
push ebp
mov ecx, esi
call fcn.00482a60
test eax, eax
je 0x4804e5
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x4804e5
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4804a6
xor eax, eax
jmp 0x4804ae
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.00483400
inc ebx
xor ebp, ebp
jmp 0x480437
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x480410
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.00481950
test eax, eax
pop ebx
je 0x48058d
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.00481640
mov edi, eax
cmp edi, ebp
je 0x48058d
push edi
mov ecx, esi
call fcn.00482a60
test eax, eax
je 0x48058d
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.00481b90
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.00481c00
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.00483400
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x488f00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c3681
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x488f3d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004b8037
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.004b737f
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.00481ec0
lea ecx, [esp + 8]
call fcn.004b82e2
lea ecx, [esp + 0x30]
call fcn.004b74e3
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.004b737f
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.00482360
lea ecx, [esp + 0x74]
call fcn.004b74e3
lea ecx, [esp + 8]
call fcn.004b82e3
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.0047fb60
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.00481e60
mov ecx, esi
call fcn.004829a0
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.00481e60
mov ecx, esi
call fcn.004829a0
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.00481e60
mov ecx, esi
call fcn.004829a0
mov ecx, dword [edi + 0x5c]
call fcn.0047f330
push eax
mov ecx, esi
call fcn.0047f340
mov ecx, dword [edi + 0x5c]
call fcn.0047f900
push eax
mov ecx, esi
call fcn.0047f8a0
mov ecx, dword [edi + 0x5c]
call fcn.0047fa20
push eax
mov ecx, esi
call fcn.0047f9d0
mov ecx, dword [edi + 0x5c]
push 0
call fcn.0047ec10
push eax
mov ecx, esi
call fcn.0047ec20
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.004b745b
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.004b745b
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.004b80fc
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x48a7a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c38a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004ae06f
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004ae06f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.0048b2c0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x48b310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c3980
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004baa36
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x48b343
xor al, al
jmp 0x48b46f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x48b365
xor al, al
jmp 0x48b46f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x48b378
xor al, al
jmp 0x48b46f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x48b38c
xor al, al
jmp 0x48b46f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004ae11f
test eax, eax
jne 0x48b3c0
xor al, al
jmp 0x48b46f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x988ab4
mov dword [esp + 0x20], ebp
call fcn.004baa36
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004b7034
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004b708b
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x48b454
mov ax, word [ebx]
test ax, ax
je 0x48b446
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.0048b490
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x48b42a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004b708b
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x48b9f0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004b8720
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x48ba36
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.0049f1c4
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x9a88f4
push ecx
call fcn.004a0861
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x48d16d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c3b08
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x40]
test edx, edx
setne bl
inc ebx
test eax, eax
je 0x48d183
or bh, 0x80
lea ecx, [esp + 0xc]
call fcn.004930b0
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x28], 0
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00493370
lea eax, [esp + 0xc]
push ebx
push eax
mov ecx, esi
call fcn.0048d1f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x988ec0
call fcn.004932b0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x492060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4920ac
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4920ac
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x492096
push eax
call ebp
test ax, ax
jl 0x4920a4
inc esi
add edi, 4
cmp esi, 6
jb 0x492088
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00491d60
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x494a10
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x494a70
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x494a70
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x494a70
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x494a70
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x494a80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4b2523
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b255b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b059b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b0573
jmp 0x4b2567
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b3d1a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b3d5c
call fcn.004baa36
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b3d5c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b3d53
xor eax, eax
jmp 0x4b3d64
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b3d6a
pop edi
pop esi
pop ebx
ret 4

Function at 0x4baf66
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4baf94
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bafb2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004baecc
jmp 0x4bafb2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bafb2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004baecc
test edi, edi
mov eax, edi
jne 0x4baf9c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x483b05
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esi, [esi + 0x9d]
rdtsc
add bp, 0xff4e
jmp 0x483adf
mov al, ah
jmp 0x483ae9
mov word [esp], dx
mov byte [esp], ch
mov word [esp], dx
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x483aa0
jno 0x483ab4
mov al, ah
jmp 0x483ae9
mov ebp, dword [esp + 0x28]
mov al, 0xf6
neg di
je 0x483b5c
jne 0x483b39
mov dword [esp], eax
mov word [esp], sp
jmp 0x483aca
xchg dh, al
xchg ch, dl
jmp 0x483b60
rdtsc
xchg dh, al
shr edi, 0xd
sub esp, 0xc0
jmp 0x483f91
xchg dh, al
xchg ch, dl
lea esi, [esp]
bsf di, ax
jmp 0x4848e9
mov edx, dword [esp]
jmp 0x4837c6
mov cx, dx
lea ecx, [eax - 0xf9]
add al, dh
ja 0x483b94
mov edx, dword [esp]
jmp 0x4837c6
not ax
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x483c7a
not ax
sub esp, 0x1a
lea esp, [esp + 2]
mov ebx, ebp
jmp 0x483bc0
mov edi, esp
mov ecx, dword [esp]
stc
jl 0x483c70
jge 0x483bda
mov dh, ch
rdtsc
lea edx, [ebp - 0xf7]
mov word [esp], dx
push dword [esp]
jmp 0x483fd9
setle dh
mov al, ah
lea esp, [esp + 8]
not cl
call fcn.00483fbc
and eax, 0xc7342dbd
jno 0x484005
mov ds, word [ebx + edi*2]
xchg esi, eax
and al, 0x9f
out 0x86, al
invalid
invalid
shr edi, 0xd
jmp 0x483b46
jbe 0x483b3f
rdtsc
xchg dh, al
jmp 0x484109

Function at 0x483d73
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x483e15
mov ax, 0x5a2b
jmp 0x483dfd
mov eax, dword [esp]
jmp 0x483de1
neg dl
push edx
xchg dword [esp], eax
rcl eax, 0x19
jp 0x483eb1
mov al, 0x28
clc
jmp 0x483e70
bsf ax, si
mov eax, 0xbe2f78e8
jmp 0x483db0
bsf ax, si
mov eax, 0xbe2f78e8
jmp 0x483db0
inc dl
xchg al, ah
bsr ax, cx
jno 0x483d7e
mov eax, dword [esp]
jmp 0x483dc9
pop eax
bt eax, edx
je 0x483d78
mov ax, 0x5a2b
jmp 0x483d7c
lea eax, [ecx*4]
jmp 0x483e98
lea eax, [ecx*4]
mov al, ah
not al
dec eax
jmp 0x483ecc
mov eax, 0xb996d6fe
mov ax, word [esp]
mov eax, dword [esp]
adc eax, ecx
jl 0x483e28
jge 0x483e35
lodsd eax, dword [esi]
and al, 0xba
invalid
xchg dword [esp], eax
add al, ah
jmp 0x483e90
mov al, 0x28
clc
xchg dword [esp], eax
add al, ah
lea esp, [esp + 4]
neg dl
jmp 0x483e51
mov al, ah
not al
dec eax
jmp 0x483ecc
jmp 0x483e88
pop dword [esp + 8]
lea eax, [esi + 0x65]
mov eax, dword [esp + 9]
pop word [esp + 0xb]
bswap eax
jmp 0x483f36
xor dl, 0x51
lea eax, [ebx + esi]
sub esp, 0x1a
jne 0x483eb3
je 0x483ee1
invalid
pop dword [esp + 8]
lea eax, [esi + 0x65]
mov eax, dword [esp + 9]
jmp 0x483ef2
pop word [esp + 0xb]
bswap eax
jmp 0x483f36
mov al, ah
lea eax, [eax*4]
sub esp, 0x16
jb 0x483f16
mov al, ah
push dword [esp + 0x26]
xchg byte [esp + 0x14], al
sets al
lea esp, [esp + 2]
jmp 0x483f7a

Function at 0x483fbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
jmp 0x48401e
jb 0x484003
jae 0x484003
pop dx

Function at 0x483fc1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
mov ax, word [esp + 1]
lea eax, [ecx - 0xd3]
sub edx, ebp
jmp 0x484051
jns 0x484022
pop dx
mov edx, dword [esp]
jmp 0x484093
lea esp, [esp + 1]
Function at 0x484eff
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dx
sub esp, 0
mov ax, word [esp]
jmp 0x484f0e
lea edx, [ebx*4]
not dh
xchg dword [esp], edx
mov eax, 0x2926fcd8
clc
jmp 0x484f29
rol al, 3
pushal
lea eax, [ebp - 0xf]
lea edx, [edx - 0x84]
bt eax, ebx
xchg al, ah
jmp 0x484f61
not ax
btr eax, ebx
bsr ax, bp
xchg dword [esp + 0x20], edx
jmp 0x485078
setge ah
sub esp, 0xe
call 0x484f99

Function at 0x4850c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
neg cl
js 0x4850e9
jns 0x4850e9
sub dword [edx + reloc.USER32.dll_MessageBoxA], edi
or dword [edi + reloc.USER32.dll_MessageBoxA], ebx
jb 0x485143
jl 0x485127
salc
inc ecx
jmp 0x485240
cmp dword [esp + 4], 0
jne 0x485110
je 0x4852d8
mov edi, 0x2bd8b929
call 0xc0209c39
dec edx
invalid
pushal
jmp 0x483880

Function at 0x4a3a5b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x4a3a85
mov dword [esp + 1], ebp
pop word [esp + 5]
jmp 0x4a3a44
lea esi, reloc.USER32.dll_MessageBoxA
mov ebx, dword [esi]
pop esi
sub esp, 8
call fcn.004a3a5b
and ebx, ecx
sub esp, 6
lea esp, [esp + 2]
jmp 0x4a3acd
add byte [eax], al
jmp 0x4a3a74
movzx ebx, byte [esi + 0xd]
push edx
call fcn.004a3afa
ficom word [edi - 0x39]
mov byte [0xc844eb51], al
pop esi
cmp eax, ecx
jle 0x4a3ab0
adc al, 0x87
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
clc
bsf bx, si
jmp 0x4a3ab4

Function at 0x4a3b01
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
call 0x4a3b01
int 0x21
retf 0x4eb

Function at 0x4a3c4f
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
movzx ebx, byte [esi + 0xe]
sub esp, 0x1c
push esp
jmp 0x4a3bd3
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
and ebx, ecx
lea esp, [esp + 0x4c]
jmp 0x4a3b9e
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x4a3c01
pushal
pop word [esp + 0x1b]
mov byte [esp + 0x1c], bh
lea esp, [esp + 2]
and edi, ecx
jmp 0x4a3bc4
and edx, ecx
sub esp, 4
mov edx, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
call fcn.004a3c4f
lea esp, [esp + 1]
cmc
lea esp, [esp + 3]
jmp 0x4a3c39
lea esp, [esp + 2]
shr edi, 0x18
cmc
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x4a3bef
and ebx, ecx
cmc
pushal
push esp
jmp 0x4a3ca5
mov word [esp], sp
jmp 0x4a3c12
mov edi, edx
sub esp, 4
pop word [esp]
mov byte [esp], ah
mov byte [esp], bh
jmp 0x4a3c28
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x4a3cb5
push edx
mov dword [esp], eax
cmc
jmp 0x4a3c77
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
stc
and edx, ecx
jmp 0x4a3c8d
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
call 0x4a3cc1
and byte [ebp - 0x16fbdb9c], cl
mov dword [eax], eax
add byte [eax], al
pushal
out 0x77, eax
adc ah, cl
push ecx
sahf
sbb byte [esi - 0xa24e717], cl
in al, 0x17
jle 0x4a3c66
adc al, 0x95
call 0x214a84eb
retf 0x648d