joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a450
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46c068
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00464bc0
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00439df0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00464aee
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004613a9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004613a9
push 1
push 0
push 0
mov ecx, esi
call fcn.00461351
push 1
push 0
push 1
mov ecx, esi
call fcn.00461351
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00464c32
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x43a5d0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46c088
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00464bc0
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00439df0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00464aee
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x43a694
cmp dword [esp + 0x40], 1
jne 0x43a692
cmp ecx, eax
jge 0x43a694
mov eax, ecx
cmp eax, 0xc8
jge 0x43a6a0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0043a450
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00464c32
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x43ae10
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46c0f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045f7ca
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00464e68
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00466384
test eax, eax
je 0x43af2c
mov ecx, dword [esp + 0x3c]
call fcn.00464e95
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43aef0
push edi
mov ecx, esi
call fcn.004624f0
mov ecx, esi
call fcn.0043b090
cmp dword [esp + 0x38], 1
jne 0x43af25
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046262b
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x449f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00449af0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00449b70
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00449b70
lea ecx, [esi + 0xc]
call fcn.0045e1a6
lea ecx, [esi + 0x10]
call fcn.0045e1a6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044c3a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044c3a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044c3a0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0045e21b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045e21b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44abe8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46c848
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x44abf8
call fcn.0044b110
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x44acdb
cmp byte [edi], 0
je 0x44acdb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x44ac1d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00449910
test eax, eax
jne 0x44ac3d
push 0x4d9458
lea ecx, [esi + 0x38]
call fcn.0045e358
jmp 0x44acdb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00449960
test eax, eax
jne 0x44ac6c
mov ecx, esi
call fcn.00449a60
push edi
add esi, 0x38
push 0x4d9434
push esi
call fcn.0045c1b7
add esp, 0xc
jmp 0x44acdb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0044b990
test eax, eax
je 0x44acd4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044adb0
test eax, eax
jne 0x44acf0
push edi
lea eax, [esi + 0x38]
push 0x4d9410
push eax
call fcn.0045c1b7
add esp, 0xc
mov ecx, esi
call fcn.0044b110
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x44ad98
mov ecx, dword [0x4d96c8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0045c1b7
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00449a10
test eax, eax
jne 0x44ad5a
push 0x4d93f4
lea ecx, [esi + 0x38]
call fcn.0045e358
jmp 0x44ad6a
push 0xfa
mov ecx, esi
call fcn.0044b990
test eax, eax
jne 0x44ad87
mov ecx, esi
call fcn.0044b110
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045e21b
jmp 0x44acdb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045e21b
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x818146
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 2]
test eax, eax
push esp
lea esp, [esp + 3]
mov byte [esp], ah
jmp 0x8180f4
pop word [esp]
clc
jmp 0x81810f

Function at 0x81b20c
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
jmp 0x81b242
lea esp, [esp + 4]
jle 0x7ede76
lea edx, [esp + esi]
jmp 0x81b46c
mov ecx, 0xff
jmp 0x7edddb
lea ecx, [eax - 1]
mov edi, 0xda3f6b86
xchg ebx, edx
mov dword [ebp - 4], ecx
jmp 0x81b343

Function at 0x81b4dc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push dword [esp + 2]
jmp 0x81b408
and ebx, ecx
call fcn.0081b3f1
sub esp, 6
and edx, ecx
push esp
pushal
jmp 0x81b6cd
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x81b4ae
lea esp, [esp + 2]
shr edi, 0x18
stc
sub esp, 0xe
mov byte [esp + 5], dh
jmp 0x81b47e
and edi, ecx
stc
call 0x81b4dc
push es
popfd
or eax, 0x7011a754
out dx, al
jl 0x81b4db
test byte [ebp + 0x62], 3
xchg ebx, eax
test byte [0x52f146bc], 0xbf
push eax
test byte [edx + 0x56], bl
push edx
mov edi, 0x565a8450
mov di, word [esp + 2]
mov edi, edx
sub esp, 0x1a
jmp 0x81b49d
rol dword [ebx + reloc.kernel32.dll_DeleteCriticalSection], 0x24
add ch, cl
hlt
neg di
lea edi, [edx + edi]
stc
inc di
mov ebx, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x81b4ca
mov edx, dword [esi + 4]
sub esp, 8
mov byte [esp + 3], dh
mov byte [esp + 2], bh
mov dword [esi], edi
jmp 0x81b4f6
lea esp, [esp + 0x54]
xor edi, dword [edx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov dh, 0x38
btc edx, esp
lea edx, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x81b519

Function at 0x81b712
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x81b79f
add esp, 3
add esp, 0
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x81b77f

Function at 0x81b81b
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x81b865
push eax
mov eax, esi
lea eax, [eax + 0xc]
mov edx, dword [eax]
jmp 0x81b84a
pop eax
stc
cmc
clc
mov dword [esi + 8], edi
jmp 0x81b8ae
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov dh, byte [esp]
inc dh
jmp 0x81b83c
lea esi, reloc.kernel32.dll_DeleteCriticalSection
mov ebx, dword [esi]
pop esi
jmp 0x81b99e
push esi
mov esi, ebx
lea esi, [esi*4]
jmp 0x81b877
neg di
bsr di, cx
mov edi, 0x2ddd8a1e
jmp 0x81b894
mov edi, edx
call fcn.0081b8ef
Function at 0x81ba31
Capabilities:
Encrypt data using aes

Disassembly:
btc edx, edi
adc edx, esi
jmp 0x81b320
call 0x81baa8
imul eax, eax, 0x1e
jmp 0x84783b
mov edi, edx
call fcn.0081b2fd
push edi
sti
imul ecx, dword [esi], reloc.kernel32.dll_DeleteCriticalSection
jl 0x81b2e4
fdiv qword [edx + 0x15]
in al, 0x27
test eax, 0x3d826bc8
or al, 0xf6
fdivrp st(6)
fimul word [ebx - 0x137cdbc4]
or al, 0x8b
push ss
neg dh
neg dh
mov edi, dword [esp]
sub esp, 0xc
mov edx, dword [esi]
jmp 0x81b278
mov ebx, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
sub esp, 8
lea esp, [esp + 8]
add esi, 0x10
jmp 0x81b291
out dx, eax
sbb al, ch
fcos
invalid
movzx ebx, byte [esi + 0x11]
add di, 0x306e
xchg edx, edi
rol di, cl
mov dh, ch
jmp 0x81b2b1
jmp 0x81ba93
push edx
mov word [esp], di
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x81ba67
dec dword [ebp - 4]
push edx
mov byte [esp + 1], ch
mov dword [esi + 0xc], edi
jmp 0x81ba78
lea esp, [esp + 4]
jne 0x7edddb
je 0x7ede76
dec ecx
into
pop esp
cmp edx, esi
pushal
fbld tbyte [esi]
push ecx
rcl byte [ebx - 8]
clc
sub esp, 0x18
push dword [esp + 6]
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x81ba33
push 0xc8f5d264
call fcn.007fb3d4
sahf
or byte [esi + 0x30be08f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x426caf5c
salc
inc esp
and ebx, esi
push 0xffffffffffffffc7
outsb dx, byte [esi]
jns 0x8478c3
xchg edx, eax
sal ch, cl
enter 0x70e8, 0x3b
sti
jmp [eax + 0x1c]
cmc
enter 0xae8, 0x3b
sti
jmp [eax + 0x17]
Function at 0x81bd51
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 0xd]
cmc
call fcn.0081bb1b
mov dl, 0x34
stosb byte es:[edi], al
int 0x3c
and byte [ecx - 0x4aa5dc20], 0xa4
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
seto bl
inc ebx
jmp 0x81b7de
and ebx, ecx
push edx
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x81b7f4
push esp
mov byte [esp], dh
jmp 0x81ca1a
call 0x81cc0b
push 0xe21770e2
push edx
stosb byte es:[edi], al
daa
mov bh, 0xd2
and edx, ebp
fidiv dword [reloc.kernel32.dll_DeleteCriticalSection]
push edx
mov dword [esp], eax
pop word [esp]
jmp 0x81c9d6
call fcn.0081cad1
test al, 0x2e
mov esp, 0xba8836db
inc ebx
sal dword [esi + reloc.kernel32.dll_DeleteCriticalSection], cl
xor byte [ebx], dh
sub ch, al
inc ebp
call 0x81cbf0
sldt word [eax]
jb 0x81bca8
imul ecx, dword [esi], reloc.kernel32.dll_DeleteCriticalSection
dec ebp
pop eax
fdiv qword [edx + 0x15]
in al, 0x53
test eax, 0x3d826bc8
inc ebx
lds edx, [ebp + 0x3c]
iretd
xor ch, al
stosd dword es:[edi], eax
push cs
add byte [eax], al
call 0x81cb7e
aad 0x5a
enter 0x5aaf, 0xffffffffffffffed
xor eax, 0xb94a2fbf
add al, 0x12
lea ebx, [edi + ebp*2]
jbe 0x81bccd
call 0x81cbcb
loop 0x81bcf5
add byte [eax], al
test dword [ebx], ecx
wait
dec byte [0x22ac2dcd]
inc ebp
mov ah, 3
cmp dword [eax], ebx
jnp 0x81bd4b
int 0x2d
cmp bl, 0x5a
push edx
jmp 0x81cb80
clc
pushal
clc
add esp, 7
lea esp, [esp + 1]
jmp 0x81b80b
add byte [edx - 0x3ffec27e], bl
mov ebx, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x81bd14
lea esp, [esp + 2]
cmp al, 0x5a
pushal
mov byte [esp + 2], dh
mov dword [esp + 1], ecx
jmp 0x81ca51
lea esp, [esp + 4]
sub eax, 0x47
jmp 0x81bc90
sub eax, 0x41
jmp 0x81bc90
lea esp, [esp + 0x20]
movzx eax, al
ja 0x81bc45
jmp 0x81ca37
push word [esp + 7]
lea esp, [esp + 2]
jmp 0x81cafd
lea esp, [esp + 0xc]
cmp bl, 0x2f
push edx
jmp 0x81d649
lea esp, [esp + 4]
ja 0x81bce4
call fcn.0081cbc0
outsb dx, byte [esi]
cld
xchg edx, eax
cmc
add al, 0xc5
dec ecx
call 0x2d5f6da6
lea esp, [esp + 4]
add esi, 4
jmp 0x81bca6
lea esp, [esp + 0x24]
push 0x3f
jmp 0x81bc5b
lea esp, [esp + 4]
jne 0x81bcce
pushal
push dword [esp + 8]
jmp 0x81d202
Function at 0x8c4b90
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 1]
mov bh, byte [esp + 3]
jmp 0x8c4c0c
neg si
stc
lea esp, [esp + 0x23]
xchg bp, dx
shl bx, cl
xchg ecx, edx
jmp 0x8c4ce4
not ax
push word [esp + 0x11]
sub esp, 0x14
xchg dh, al
xchg byte [esp + 0x10], bl
rdtsc
jmp 0x8c4bd6
rdtsc
inc cl
mov word [esp], sp
sub esp, 0
sub esp, 0x1a
mov si, word [esp + 0xe]
jmp 0x8c4bed
mov di, word [esp + 0xc]
add al, dh
mov bp, word [esp + 1]
jmp 0x8c4c86
mov dl, dh
lea ebp, [eax*4]
mov dword [esp + 0xd], ecx
mov dh, byte [esp + 0xa]
xchg ah, bl
neg ch
jmp 0x8c4c3a
xchg byte [esp + 0x10], al
mov al, ah
xchg byte [esp], al
lea eax, [esi + edi]
inc al
xchg ebp, ebx
jmp 0x8c4c51
lea edi, [eax*4]
push dword [esp + 0xf]
call fcn.008c4cc0
jle 0x8c4c88
test dword [eax], eax
add byte [eax], al
add bh, bh
je 0x8c4cb4
psubsb mm5, qword [edx]
add byte [eax], al
add byte [esi - 0x10], bh
add ax, si
push ds
pushal
in eax, dx
jge 0x8c4ca4
not dword [edi]
jl 0x8c4cf3
salc
inc ecx
ret
sub ax, 0xef0
setae bh
mov word [esp + 0xd], dx
mov byte [esp + 7], ch
insb byte es:[edi], dx
and al, 7
mov eax, dword [esp + 4]
rcr ch, 5
jmp 0x8c4c74
bsr bp, cx
push word [esp + 0xb]
xor eax, esi
bswap eax
sub esp, 2
mov dl, 0x6c
jmp 0x8c4ca7
add dh, byte [edx + 0x32afeb6c]
aad 0x88
insb byte es:[edi], dx
and al, 0xf
mov bx, sp
popal
pop dword [esp]
mov dword [esp + 8], ecx
jmp 0x8c4d65
lea esp, [esp + 0xc]
xchg byte [esp], cl
lea esp, [esp]
inc ebx
mov bx, word [esp]
pushal
jmp 0x8c4daa
bsf di, ax
xchg byte [esp], al
mov byte [esp], dh
btc eax, edi
not ebp
sub esp, 2
jmp 0x8c4d94
xchg word [esp], cx
rcl bp, cl
xchg ebx, eax
mov ecx, ebp
rdtsc
lea esp, [esp + 1]
jmp 0x8c4e09
lea edx, [esp + ebx]
xchg si, bx
bsr cx, bp
popal
shr ch, 5
jmp 0x8c4d77
bsr dx, bp
bswap eax
mov edx, dword [esp]
call fcn.008c4de5
xchg word [esp], bp
btr ebx, esp
mov dh, byte [esp + 1]
setg ah
jmp 0x8c4e56
bsf bx, si
inc bp
mov eax, ebp
rdtsc
bsr bx, cx
cld
call fcn.008c4e3e
cmp ebp, dword [esi + reloc.kernel32.dll_DeleteCriticalSection]
daa
ret

Function at 0x8c4cc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0xa], bl
mov edx, dword [esp + 1]
rdtsc
cpuid
jmp 0x8c4d3c
bswap ecx
push word [esp + 1]
xchg dx, di
pushal
setg ah
pop ebx
jmp 0x8c4d1f
xor dl, ch
mov byte [esp + 0xf], ch
mov ebp, dword [esp + 3]
pop word [esp + 5]
add esp, 8
not bp
cmc
mov si, dx
jmp 0x8c4cf8
mov bl, 0x38
ror bh, 3
mov word [esp + 9], di
xchg word [esp + 4], dx
lea edx, [esi + 0x25]
mov ebp, eax
jmp 0x8c4cce

Function at 0x8c5be2
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x10
mov al, ah
rdtsc
not ebx
shl bp, cl
ror bh, 3
jmp 0x8c5c0d
mov eax, 0xad4e8220
xchg byte [esp + 0x18], al
push esp
add esp, 0x29
mov word [esp + 4], dx
jmp 0x8c5be4
jmp 0x8c5bb8
xchg ch, dl
bsf bp, si
mov byte [esp + 3], ch
mov ah, byte [esp + 1]
pushal
lea eax, [esp + edx]
jmp 0x8c5c48
neg ebx
lea edi, [edx*4]
bswap ebx
rdtsc
cpuid
sub esp, 0x16
jmp 0x8c5bc9
Function at 0x8c63d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
pop dword [esp]
lea eax, [eax - 0xe9]
xchg ch, dl
push dword [esp + 0xe]
lea esp, [esp + 9]
jmp 0x8c63d4
jmp 0x8c63b5
mov cx, 0xb507
rdtsc
mov cl, 0xda
mov edx, dword [esp + 3]
push dword [esp + 6]
jmp 0x8c641b
xchg word [esp + 1], si
setle ah
lea ebp, [ecx + ebx]
pop dword [esp + 2]
mov dh, byte [esp + 1]
jmp 0x8c6480
pop ax
mov ebx, dword [esp + 3]
mov word [esp + 6], dx
mov dword [esp + 9], esi
jmp 0x8c6400
push word [esp + 4]
pushal
xchg dword [esp + 0xf], edi
push word [esp + 0x25]
jmp 0x8c64b0
lea esi, [edx + ebx]
mov dword [esp], ecx
xchg byte [esp + 2], bl
mov esi, dword [esp]
mov bh, byte [esp + 1]
xchg ch, dl
jmp 0x8c6436
lea eax, [ebp*4]
pop edi
mov al, 0x96
lea edi, [esi*4]
bswap edx
jmp 0x8c644c
mov bp, word [esp]
cpuid
pop word [esp + 4]
mov esi, dword [esp]
push dword [esp + 2]
pop eax
jmp 0x8c6467
xchg ch, dl
xchg dword [esp + 0xd], esi
mov ecx, esi
bswap ebx
mov bx, dx
lea ebp, [edi*4]
jmp 0x8c652d
pop bp
lea edx, [ebx + ebx]
xchg word [esp + 0xc], bp
mov ch, byte [esp + 0xd]
setns dh
pop cx
jmp 0x8c6495
lea esp, [esp + 0x1c]
popal
pushal
push word [esp + 7]
pushal
lea esp, [esp + 0x42]
jmp 0x8c655d
mov byte [esp + 0x17], bh
mov bx, word [esp + 9]
mov ah, byte [esp + 0x1c]
lea ecx, reloc.kernel32.dll_DeleteCriticalSection
mov bp, dx
lea esp, [esp + 3]
jmp 0x8c64ed
pop dword [esp + 9]
push dword [esp + 0x14]
pop dx
pop dword [esp + 6]
xchg ch, dl
cpuid
jmp 0x8c6503
pushal
push dword [esp + 0x10]
call fcn.008c6541
mov byte [esp + 2], ah
push esp
pop word [esp + 3]
pop word [esp + 1]
jmp 0x8c6740

Function at 0x8cb52b
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 2]
push dword [esp + 4]
mov dword [esp + 0x34], ebp
pushal
mov word [esp + 0x10], sp
mov word [esp + 0xe], di
jmp 0x8cb53a
pop word [esp]
push word [esp + 1]
mov word [esp], sp
jmp 0x8cb50c
mov word [esp], bx
mov byte [esp + 0x12], bh
mov dword [esp + 0x50], esi
call fcn.008cb584
and al, 0x88
jl 0x8cb565
adc cl, byte [ecx - 0x17afdb8c]
cmp dword [eax], eax
add byte [eax], al
jb 0x8cb53d
add ax, si
and al, 0x6c
in eax, dx
jge 0x8cb559
not dword [ebx]
jle 0x8cb557
insb byte es:[edi], dx
or eax, dword [esi]
out 0x4f, eax
invalid

Function at 0x8cb55e
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
call fcn.008cb501

Function at 0x8cb567
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
pop dword [esp]
jmp 0x8cb5b5
push word [esp + 3]
call fcn.008cb58d

Function at 0x8cb584
Capabilities:
Parse pe header

Disassembly:
mov word [esp], dx
call fcn.008cb567

Function at 0x8cb58d
Capabilities:
Parse pe header

Disassembly:
call fcn.008cb02c
mov word [esp + 6], bx
call 0x8cb598
push ebp
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x8cb5dd
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8cb027
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8cb5bf
Function at 0x8cb598
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.008cb02c
mov word [esp + 6], bx
call 0x8cb598
push ebp
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x8cb5dd
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8cb027
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8cb5bf
Function at 0x405e70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x406023
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
nop dword [eax]
push 0
call esi
add byte [edi + ebp], 0x29
push 0
call esi
add byte [edi + ebp], 0xf
push 0
call esi
xor byte [edi + ebp], 0xbc
push 0
call esi
add byte [edi + ebp], 0x87
push 0
call esi
add byte [edi + ebp], 0xd2
push 0
call esi
add byte [edi + ebp], 0x77
push 0
call esi
add byte [edi + ebp], 0x43
push 0
call esi
xor byte [edi + ebp], 0xf3
push 0
call esi
add byte [edi + ebp], 0x3f
push 0
call esi
add byte [edi + ebp], 0x9f
push 0
call esi
xor byte [edi + ebp], 0x47
push 0
call esi
sub byte [edi + ebp], 0x80
push 0
call esi
add byte [edi + ebp], 0x4c
push 0
call esi
add byte [edi + ebp], 0x62
push 0
call esi
add byte [edi + ebp], 0x58
push 0
call esi
add byte [edi + ebp], 0xb2
push 0
call esi
xor byte [edi + ebp], 0x96
push 0
call esi
add byte [edi + ebp], 0x8b
push 0
call esi
add byte [edi + ebp], 0x98
push 0
call esi
add byte [edi + ebp], 0x97
push 0
call esi
add byte [edi + ebp], 7
push 0
call esi
add byte [edi + ebp], 0xa6
push 0
call esi
add byte [edi + ebp], 5
push 0
call esi
add byte [edi + ebp], 0x16
push 0
call esi
add byte [edi + ebp], 0x99
push 0
call esi
xor byte [edi + ebp], 0x35
push 0
call esi
add byte [edi + ebp], 0xeb
push 0
call esi
add byte [edi + ebp], 0xf7
push 0
call esi
add byte [edi + ebp], 0x65
push 0
call esi
add byte [edi + ebp], 0x78
push 0
call esi
add byte [edi + ebp], 0xbb
push 0
call esi
xor byte [edi + ebp], 0x93
push 0
call esi
xor byte [edi + ebp], 0x47
push 0
call esi
xor byte [edi + ebp], 0x9e
push 0
call esi
add byte [edi + ebp], 0xdb
push 0
call esi
add byte [edi + ebp], 0x82
push 0
call esi
xor byte [edi + ebp], 0x67
push 0
call esi
add byte [edi + ebp], 0x1b
push 0
call esi
add byte [edi + ebp], 0x7c
push 0
call esi
xor byte [edi + ebp], 0x2f
push 0
call esi
add byte [edi + ebp], 0x79
push 0
call esi
xor byte [edi + ebp], 0x6b
push 0
call esi
add byte [edi + ebp], 0x9e
push 0
call esi
xor byte [edi + ebp], 0xfd
push 0
call esi
add byte [edi + ebp], 0x99
push 0
call esi
xor byte [edi + ebp], 0x84
push 0
call esi
add byte [edi + ebp], 0xd1
push 0
call esi
add byte [edi + ebp], 0x4e
push 0
call esi
add byte [edi + ebp], 0x37
inc edi
cmp edi, ebx
jb 0x405e90
pop esi
pop ebp
pop edi
pop ebx
ret