joyce8/EMBER2024-capa huggingface dataset:
Function at 0x605900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x605967
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x605984
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x6059ed
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0064e8d0
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x6059c0
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x6059b0
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x6059e7
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x605a41
inc edi
cmp edi, ecx
jb 0x6059d4
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00639270
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d14c
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x6059e7
cmp dword [esi + 0x14], 0x10
jb 0x605a50
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x605a6a
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0064e8d0
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x605aa0
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x605a90
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x605ade
cmp ecx, edx
je 0x605b55
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x605ac6
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.00624840
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.006393a0
mov eax, esi
jmp 0x605a26
or ecx, 0xffffffff
jmp 0x605ae0
Function at 0x605d80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639270
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x605ea3
push ecx
lea ecx, [esi + 0x18]
call fcn.006255a0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x605eba
push ecx
lea ecx, [esi + 0x24]
call fcn.006254b0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x62fa90
Capabilities:
Encode data using xor

Disassembly:
invalid
in al, dx
inc ebx
sub dword [ebp + 5], edx
jne 0x62faa4
xchg edx, eax
mov ebp, 0x5a8b9157
mov al, byte [ecx + 0x24]
pop ebx
mov eax, dword [0xfdcffec2]
dec bh
std
jno 0x62faf1
xchg esi, eax
sbb eax, 0xca3156f4
inc ecx
cli
mov ah, 0x42
sub byte [edi + eax*2], 0x53
test ah, 0x68
mov bl, 0x49
rcl dl, cl
inc esp
or dword [eax + eax*8 + 0x27], ebp
jo 0x62fa78
test eax, edx
push edx
sub edi, dword [eax]
lodsb al, byte [esi]
xchg ebp, eax
sub al, 0x90
scasd eax, dword es:[edi]
pop ecx
jne 0x62fb52
mov ch, 0x3f
mov ch, 0x36
add al, 0xa0
or esp, ebp
invalid
push cs
pop esp
push ebx
cmpsd dword [esi], dword es:[edi]
sub eax, 0xbb1a3963
cmpsd dword [esi], dword es:[edi]
fisub word [eax]
ret 0xb067
lodsb al, byte [esi]
popal
mov ecx, 0x7ef80ef3
loopne 0x62fb71
cmp eax, 0x9050a111
dec esi
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
mov ah, 0xac
out dx, al
mov edi, 0xddf45211
fcomi st(4)
leave
int 0x79
cmp al, 0x2b
dec edx
int 0x27
pop ecx
sub dword [edx], ecx
pushal
sar dword [ebx + 0x23], 6
test al, 0x1d
push eax
cld
invalid
je 0x62fae8
pop ebx
mov al, 0xd0
jne 0x62fafe
mov dword [0x39bb68da], eax
mov esp, 0x5de42cc0
fcom dword [ebp - 0x11]
sahf
sbb byte [0xbd601d05], bl
dec edx
jb 0x62fbb8
shr dword [ebp - 0x23], 0x59
in eax, dx
insd dword es:[edi], dx
fstp qword [ecx - 0x13]
inc ecx
inc eax
test esi, esp
xchg ch, ch
add byte [eax + eax*8], cl
mov ebp, 0xfeb9ef27
push 0xfe05498d
ret
pop ebp
cmc
xlatb
adc eax, 0x49f1187f
cmc
retf

Function at 0x64cd4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654390
cmp edx, dword [eax]
je 0x64cd6f
add eax, 8
inc ecx
cmp eax, 0x654420
jl 0x64cd60
push esi
mov esi, ecx
shl esi, 3
add edi, dword [ebx]
xchg esi, eax
nop
inc ebx
add byte gs:[edi], cl
test dword [ecx + eax], ebx
add byte [eax], al

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x44b98a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x44b9e4
push eax
push 0x44a4ee
call fcn.0044ba22
push 7
push 0x4ae0bc
push dword [eax + 0x30]
call fcn.0044bd7b
cmp eax, 0
jne 0x44b9be
inc eax
jmp 0x44b9e6
push 0x44a506
call fcn.0044ba22
push 7
push 0x4ae0bc
push dword [eax + 0x30]
call fcn.0044bd7b
cmp eax, 0
jne 0x44b9df
inc eax
jmp 0x44b9e6
pop eax
mov eax, dword [eax]
jmp 0x44b998
xor eax, eax
ret

Function at 0x44b9fc
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x44ba10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x44ba22
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x4ae0bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xc1
stosw word es:[edi], ax
cmp ax, 0
jne 0x44ba30
pop edi
pop esi
leave
ret 4

Function at 0x44ba44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x4ae0bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xc1
stosb byte es:[edi], al
cmp al, 0
jne 0x44ba52
pop edi
pop esi
leave
ret 4

Function at 0x44bc86
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x44bcd7
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x44bcd7
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x44bcde
add edx, 4
loop 0x44bc9e
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x44bce5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x44bd31
cmp dx, 0x41
jb 0x44bd16
cmp dx, 0x5a
jbe 0x44bd1c
cmp dx, 0x61
jb 0x44bd28
cmp dx, 0x7a
ja 0x44bd28
xor dx, 0x20
jmp 0x44bd2a
jmp 0x44bd44
cmp dx, word [edi]
je 0x44bd31
jmp 0x44bd44
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x44bd02
mov eax, dword [eax + 0x18]
jmp 0x44bd4c
mov eax, dword [eax]
cmp ebp, eax
jne 0x44bcf7
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x4ac222
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call sub.KERNEL32.DLL_GetTickCount
mov esi, 0x1f4
mov dword [0x4ae200], eax
push esi
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x4ae204], eax
sub eax, dword [0x4ae200]
xor ecx, ecx
cmp eax, esi
pop esi
setge cl
dec ecx
mov eax, ecx
ret
Function at 0x401114
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437004]
jne 0x40111e
repz ret
jmp fcn.004016b9

Function at 0x40510b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403f31
and dword [ebp - 0x14], 0
cmp dword [0x439c78], 0
mov dword [ebp - 0x18], eax
jne 0x4051be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405266
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405266
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x439c78], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x439c7c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x439c80], eax
call edi
push eax
call esi
mov dword [0x439c88], eax
test eax, eax
je 0x4051be
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x439c84], eax
mov eax, dword [0x439c84]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405217
cmp dword [0x439c88], ecx
je 0x405217
push eax
call esi
push dword [0x439c88]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405217
test ebx, ebx
je 0x405217
call edi
test eax, eax
je 0x40520e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40520e
test byte [ebp - 8], 1
jne 0x405217
or dword [ebp + 0x10], 0x200000
jmp 0x40524a
mov eax, dword [0x439c7c]
cmp eax, dword [ebp - 0x18]
je 0x40524a
push eax
call esi
test eax, eax
je 0x40524a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40524a
mov eax, dword [0x439c80]
cmp eax, dword [ebp - 0x18]
je 0x40524a
push eax
call esi
test eax, eax
je 0x40524a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439c78]
call esi
test eax, eax
je 0x405266
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405268
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401114
leave
ret
Function at 0x42b530
Capabilities:
Create pipe

Disassembly:
sub esp, 0x41c
mov eax, dword [0x437004]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [esp + 0x420]
mov eax, dword [eax]
push ebx
mov ebx, dword [0x43ba2c]
push edi
mov edi, dword [0x43deac]
call fcn.0042b470
cmp dword [0x43deac], 0x2f
jne 0x42b5c4
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0042b4a0
mov ecx, dword [esp + 0x420]
pop edi
pop ebx
xor ecx, esp
call fcn.00401114
add esp, 0x41c
ret
Function at 0x42ba40
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1010
call fcn.0040c3b0
mov eax, dword [0x437004]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [0x43deac]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push edi
mov ebx, 0x1519af
mov edi, 0x8e46a6f0
mov dword [0x43db14], edi
cmp eax, 0x3dc
jne 0x42ba8a
push 0
push 0
push 0
call esi
mov eax, dword [0x43deac]
dec ebx
jne 0x42ba70
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor esi, esi
jmp 0x42baa0
cmp eax, 0xa5f
jne 0x42bad7
push 0
call edi
push 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x830]
push ecx
push 0x435510
call ebx
mov eax, dword [0x43deac]
cmp esi, 0x84620b
jne 0x42baee
mov eax, dword [0x438bf0]
add eax, 0xa231
mov dword [0x43deac], eax
cmp eax, 0x141
jne 0x42bb09
mov dword [0x43a1b8], 0xec58acac
mov dword [0x43a1bc], 0xffffffff
inc esi
cmp esi, 0x12d225a
jl 0x42baa0
call fcn.0042b5e0
mov ecx, dword [esp + 0x1018]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00401114
add esp, 0x1010
ret 0x10
Function at 0x47bd0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, dx
bts edx, ebx
jmp 0x47bd2d
bswap eax
xchg bx, ax
mov ax, 0x7caf
rcr bx, cl
rdtsc
jmp 0x47bd4b
jmp 0x47bce0
mov ax, 0x7caf
rcr bx, cl
rdtsc
jmp 0x47bd4b
jnp 0x47bcec
bswap eax
xchg bx, ax
jmp 0x47bd0d
mov ebx, 0x5f482fc0
push sp
btr bx, sp
lea esp, [esp + 2]
jmp 0x47bd8d
neg ebp
mov dx, word [esp]
mov bh, ch
mov al, cl
cmc
jmp 0x47be6f
xor ebp, 0x3a0bce1e
rdtsc
mov ebx, 0xae8942db
lea eax, reloc.KERNEL32.dll_GetProcAddress
lea eax, [eax*4]
jmp 0x47bd74
btr bx, sp
lea esp, [esp + 2]
jmp 0x47bd8d
jb 0x47bd35
mov ebx, 0x5f482fc0
push sp
jmp 0x47bdba
Function at 0x51dc10
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg si, cx
mov byte [esp + 3], dh
mov dx, word [esp + 7]
mov bl, 4
mov bp, word [esp + 0x12]
jmp 0x51dbc2
mov al, 0x85
rdtsc
push dword [esp + 7]
xchg esi, eax
rdtsc
xchg bl, bh
jmp 0x51db7d
bts bx, di
btr ebx, ebx
push sp
mov dl, 0xa8
pop word [esp + 0x12]
mov dword [esp + 3], esp
jmp 0x51dbf0
xchg word [esp + 0xe], si
push dword [esp + 0x13]
mov ax, sp
mov di, 0x1ec4
pop cx
bsf di, bx
jmp 0x51dba6
mov ax, word [esp + 9]
neg ah
mov dx, si
xchg dword [esp + 5], edi
jmp 0x51dc2b
clc
xchg byte [esp + 0xf], dh
xchg bp, cx
pop dword [esp + 0xe]
std
add esp, 2
jmp 0x51dbda
lea esp, [esp]
lea eax, [edi*4]
neg ebx
rcl di, 0
sbb edi, 0x7aed8e75
jmp 0x51db97
lea edx, [esp + ebx]
stc
not esi
pop si
mov di, word [esp + 0xc]
mov byte [esp], ah
jmp 0x51df34
mov dl, cl
pushfd
mov dh, byte [esp + 1]
push dword [esp + 0xc]
add esp, 0xf
jmp 0x51dca2
xchg edx, ecx
mov bh, byte [esp]
setae al
bswap ecx
mov ebx, dword [esp + 2]
xchg dword [esp + 9], eax
jmp 0x51dc62
bswap ecx
btc ax, bp
add esp, 0
pop dx
pop esi
jmp 0x51dd59
lea eax, [ecx*4]
mov bx, 0xf967
sub esp, 0x1d
mov ah, cl
cld
jmp 0x51dc8c
bsr si, sp
pop esi
xchg word [esp + 4], si
push dword [esp]
xchg ch, dl
bswap ecx
jmp 0x51dc78
bswap ecx
neg ebp
sub esp, 8
rdtsc
lea eax, reloc.KERNEL32.dll_GetProcAddress
call fcn.0051dccd
xchg byte [esp + 4], al
lea ecx, reloc.KERNEL32.dll_GetProcAddress
xchg byte [esp + 2], ah
jmp 0x51dd16
mov ch, 0xc9
pop ax
bswap ebp
bsf eax, esi
std
rcl dx, 1
jmp 0x51dd41
mov word [esp + 0x12], si
mov esi, 0xba07bb0a
dec edx
not esi
add esp, 0x1c
mov cl, byte [esp]
jmp 0x51dce3
rdtsc
xchg si, dx
mov byte [esp + 3], cl
not al
mov ah, bh
not ebx
jmp 0x51dd87
lea ebx, reloc.KERNEL32.dll_GetProcAddress
sub di, 0xb4de
add eax, ebp
mov esi, 0xd2f2cf2b
pop si
inc cl
jmp 0x51dd2c
mov si, bp
rdtsc
rdtsc
mov edx, eax
lea esp, [esp + 0xf]
bswap esi
jmp 0x51dd94
pop bp
stc
sub esp, 1
cmc
mov bh, 0x7f
rdtsc
jmp 0x51dd71
mov ebp, ecx
bsr di, sp
lea ebx, reloc.KERNEL32.dll_GetProcAddress
cmc
call fcn.0051def8
ja 0x51de06
test eax, 0x5c9f8dc8
invalid
lea ebx, [edi - 0xa4]
mov bh, 0x52
mov edx, 0x44f2fc4c
cmc
xchg bl, cl
sets dl
jmp 0x51dcba
xchg byte [esp], bh
mov byte [esp + 5], al
mov bl, byte [esp + 1]
xchg byte [esp + 2], dl
jmp 0x51de3d
add ch, bl
xor al, 0x9f
out 0x11, al
nop
adc edi, esi
shl byte [esi - 0x79], 0x4c
and al, 1
inc al
xchg word [esp + 1], cx
xchg byte [esp + 2], al
push word [esp + 3]
bswap ebp
mov word [esp + 1], ax
jmp 0x51ddf8
not ebx
mov bx, ax
push word [esp + 1]
call fcn.0051de27
pop edx
push edx
mov dword [esp + 5], ecx
not dh
lea esp, [esp + 2]
mov dl, 0x2a
call fcn.0051de93
inc ecx
fimul dword [eax + 0x2f]
fidiv dword [ebx - 0x45]
xchg edx, eax
or eax, 0xd687669c
xchg dword [esp], ebp
mov di, sp
setno bl
adc ax, 0x9aeb
mov ecx, eax
jmp 0x51de0e
not cx
mov dx, bx
mov cx, 0x8129
mov ecx, dword [esp + 5]
lea eax, [ebx*4]
mov bl, byte [esp + 1]
jmp 0x51ddaa
Function at 0x51df18
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
mov bl, 0x78
lea ecx, [edi + ebp]
rcl bl, 4
mov bx, di
lea esi, [eax + edi]
jmp 0x51dfcf
mov byte [esp + 2], bh
dec bl
add esp, 6
lea edi, reloc.KERNEL32.dll_GetProcAddress
jmp 0x51df02
rdtsc
mov si, word [esp]
xchg byte [esp], dl
add esp, 0
mov di, 0xca69
and ebp, edi
jmp 0x51dfa5
mov dword [esp + 0x31], eax
add esp, 0x1c
bsf eax, esi
sub esp, 0x14
cmc
jmp 0x51df8f
xchg di, cx
setb ah
setge dh
rdtsc
mov cl, 0xbb
mov si, 0xfe0d
jmp 0x51df52
mov si, di
mov word [esp + 3], cx
lea eax, [edi*4]
std
jmp 0x51dfb9
setg dl
push ax
sub esp, 0x1c
sub esp, 0x1b
rcr esi, cl
mov word [esp + 0x26], bx
jmp 0x51df66
mov byte [esp + 4], bh
add esp, 0x1e
sub esp, 0xd
jmp 0x51dfe4
xchg cx, di
mov ah, byte [esp]
mov ecx, 0x7b9cbbff
mov ah, 0x11
rcr di, 0xe
not ebx
jmp 0x51df7c
lea edx, [esi*4]
xchg dl, cl
xchg cx, si
btr esi, eax
popal
mov edi, dword [esp]
jmp 0x51e851
rcr cl, 5
call fcn.0051dffd
stc
bsr si, bp
setb al
bsf cx, bp
lea esp, [esp + 0x14]
mov si, dx
jmp 0x51e07a
xchg esi, edi
not eax
mov bl, byte [esp + 0x10]
rdtsc
xchg bl, ah
mov eax, dword [esp]
jmp 0x51e064
pop dx
push word [esp + 0x14]
std
mov dword [esp + 4], ebx
call fcn.0051e09e
hlt
xchg ecx, edi
push word [esp + 0xf]
pop esi
push esi
mov al, 0x43
clc
jmp 0x51e03b
pop bp
mov di, 0x535
inc ecx
push dword [esp + 1]
cpuid
mov byte [esp + 7], dl
jmp 0x51e01e
pop ebx
cpuid
push dword [esp + 0x17]
mov dword [esp + 0xd], ecx
std
lea esp, [esp + 0x16]
jmp 0x51e0b5
bswap eax
mov cl, 0x30
pushal
pop dword [esp + 0x1b]
not ebx
neg bx
jmp 0x51e188
xchg word [esp + 1], si
mov byte [esp], dl
mov cx, bp
pop cx
pushfd
rdtsc
jmp 0x51e208
mov ebx, 0x3afd86c1
mov word [esp], di
push word [esp]
mov bp, word [esp + 1]
mov di, word [esp + 3]
xchg edx, ebx
jmp 0x51e27f
lea eax, [eax + ebp]
not dh
xchg edx, esi
push cx
inc si
mov al, ch
jmp 0x51e2f3
mov dl, bh
mov esi, ecx
mov eax, 0x920294ab
xchg bh, dh
mov bp, 0xa6c4
mov edx, ebx
jmp 0x51e7d9

Function at 0x520850
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005200cb
jmp 0x520995
pushal
push edx
push word [esp + 0x15]
push dword [esp + 0xb]
push dword [esp + 0x11]
jmp 0x5208cb
mov dword [esp + 9], ebx
pop word [esp + 6]
pop dword [esp + 0x14]
lea esp, [esp + 2]
mov dword [esp + 0x64], ebp
push dx
jmp 0x5208a9
pop word [esp + 1]
pushal
push eax
mov byte [esp + 3], dl
mov dword [esp + 0x50], esp
pushal
jmp 0x520874
lea esp, [esp + 1]
push sp
lea esp, [esp + 3]
mov dword [esp + 0x60], esi
call 0x5208fa
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
xchg ebp, eax
mov ecx, 0x23d0b121
lahf
loopne 0x5208ed
pop edx
lea esp, [esp + 2]
mov dword [esp + 0x2c], ebx
push di
lea esp, [esp]
push word [esp + 1]
push word [esp + 2]
jmp 0x520897
mov eax, dword fs:[0x30]
jmp 0x520957
xor eax, 0x943fcca5
mov esi, 0x2ed3b426
cdq
xlatb
mov dword ds:[esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0x5208e4
mov eax, dword [eax + 8]
push eax
jmp 0x5200c6
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x52091a
lea esp, [esp + 2]
mov dword [esp + 8], ecx
pushfd
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 4], edx
jmp 0x520855
Function at 0x5208fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005200cb
jmp 0x520995
pushal
push edx
push word [esp + 0x15]
push dword [esp + 0xb]
push dword [esp + 0x11]
jmp 0x5208cb
mov dword [esp + 9], ebx
pop word [esp + 6]
pop dword [esp + 0x14]
lea esp, [esp + 2]
mov dword [esp + 0x64], ebp
push dx
jmp 0x5208a9
pop word [esp + 1]
pushal
push eax
mov byte [esp + 3], dl
mov dword [esp + 0x50], esp
pushal
jmp 0x520874
lea esp, [esp + 1]
push sp
lea esp, [esp + 3]
mov dword [esp + 0x60], esi
call 0x5208fa
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
xchg ebp, eax
mov ecx, 0x23d0b121
lahf
loopne 0x5208ed
pop edx
lea esp, [esp + 2]
mov dword [esp + 0x2c], ebx
push di
lea esp, [esp]
push word [esp + 1]
push word [esp + 2]
jmp 0x520897
mov eax, dword fs:[0x30]
jmp 0x520957
xor eax, 0x943fcca5
mov esi, 0x2ed3b426
cdq
xlatb
mov dword ds:[esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0x5208e4
mov eax, dword [eax + 8]
push eax
jmp 0x5200c6
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x52091a
lea esp, [esp + 2]
mov dword [esp + 8], ecx
pushfd
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 4], edx
jmp 0x520855