joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4047e6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4047d5
jg 0x404740
test edx, edx
je 0x4047d5
nop dword [eax]
call fcn.00405e70
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404794
jg 0x404757
test esi, esi
je 0x404794
cmp ebx, eax
jg 0x404767
jl 0x404761
cmp edi, esi
jae 0x404767
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0040af20
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4047b9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x4047cf
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x404740
jl 0x4047cf
test edi, edi
jne 0x404740
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x404808
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40480a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x404888
jg 0x40481d
test esi, esi
je 0x404888
test eax, eax
jl 0x40486c
jg 0x404827
test ebx, ebx
je 0x40486c
cmp edi, eax
jg 0x404837
jl 0x404831
cmp esi, ebx
jae 0x404837
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0040af20
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x404888
jg 0x40486f
test esi, esi
je 0x404888
jmp 0x40486f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x404888
push eax
push esi
push 1
push edx
call fcn.0040ea0e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4048a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4048d2
jl 0x4048c5
test ecx, ecx
jne 0x4048d2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404992
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00405e90
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40493e
jg 0x4048fd
test esi, esi
je 0x40493e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x404915
mov eax, dword [esp + 0x10]
jl 0x40490f
cmp eax, esi
jae 0x404915
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0040af20
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40495f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40497b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x4048e4
jl 0x40497b
test ecx, ecx
jne 0x4048e4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4049d1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x4049d1
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0040af20
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x404a40
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x4049f7
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x404a29
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0040f077
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x404a54
cmp edi, eax
ja 0x404a05
test ecx, ecx
je 0x404a40
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0040f077
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x433050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x404df0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409864
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x404e2c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x404e2c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409864
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x404f14
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x404e54
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404e87
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0040dfcc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409864
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x404ee7
sub eax, 1
je 0x404ee7
sub eax, 2
jne 0x404f14
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0040dfcc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409864
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404f04
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040ea0e
add esp, 0x10
cmp edi, eax
jne 0x404f14
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x404e17
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409864
mov esp, ebp
pop ebp
ret 4
Function at 0x405c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x433050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x405d4a
cmp byte [esi + 0x3d], 0
je 0x405d4a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x405d38
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x405d00
sub eax, 1
je 0x405d04
sub eax, 2
jne 0x405d38
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409864
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405d21
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040ea0e
add esp, 0x10
cmp edi, eax
jne 0x405d38
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409864
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409864
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00409864
mov esp, ebp
pop ebp
ret

Function at 0x406050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423cb0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x433050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00409885
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00408ed9
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x18], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x4075c0
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 0xc], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00406120
mov edi, dword [ebx + 4]
lea eax, [esi - 1]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x407598
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
jb 0x4074ab
mov edx, dword [ebx]
mov dword [ebp - 0x10], edx
mov esi, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 4], 0x811c9dc5
mov dword [ebp - 0x14], esi
test esi, esi
je 0x4074e3
mov ecx, dword [ebp - 4]
mov eax, esi
mov ebx, dword [ebp - 0x10]
movzx esi, byte [edx + ebx]
inc edx
xor esi, ecx
imul ecx, esi, 0x1000193
cmp edx, eax
jb 0x4074c6
mov eax, dword [ebp - 8]
lea ebx, [edi + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
and esi, dword [ebp - 4]
mov edx, dword [edx + 0xc]
lea edx, [edx + esi*8]
mov esi, dword [edx]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], esi
cmp esi, ecx
jne 0x407508
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x40758e
mov esi, dword [edx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.004078f0
test al, al
jne 0x407542
mov ebx, dword [esi]
mov eax, dword [ebp - 8]
cmp ebx, edi
je 0x40753a
mov esi, dword [edi + 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
jmp 0x40758b
mov ebx, esi
cmp dword [ebp - 0x10], esi
je 0x40756b
nop dword [eax]
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.004078f0
test al, al
je 0x4075a1
cmp dword [ebp - 0x10], esi
jne 0x407550
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov edi, eax
cmp eax, ecx
jne 0x407495
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x40758b
push str.invalid_hash_bucket_count
call fcn.00408bb2
int3
Function at 0x4083f0
Capabilities:
Acquire debug privileges
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x433050]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408435
push 0x42fc88
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00409864
mov esp, ebp
pop ebp
ret
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x408452
push str.LookupPrivilegeValue
jmp 0x408492
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4084a1
push 0x42fcd8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00409864
mov esp, ebp
pop ebp
ret

Function at 0x415ccc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00415b42

Function at 0x41daa8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041d5fb
Function at 0x477f3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [esp]
mov ebx, 0x6dede5ec
jmp 0x477ed9
rol dl, 0
mov eax, dword [esp]
neg ax
jno 0x477f0c
jo 0x477ef6
mov al, byte [0x2bd8b929]
pushfd
enter 0xffffffffffff826b, 0xffffffffffffffbb
in al, dx
in eax, 0xed
insd dword es:[edi], dx
mov ebx, 0x6dede5ec
jmp 0x477ed9
bswap ebx
bswap eax
lea eax, [edi*4]
call fcn.00477f79
cmp eax, 0x11e69f0c
nop
bswap ebx
bswap eax
lea eax, [edi*4]
add ax, 0x4520
jmp 0x478201
clc
jne 0x477eb9
mov al, byte [esp]
jmp 0x477eef
not ebx
setb al
mov al, cl
mov ax, word [esp]
stc
js 0x477ffd
mov bx, word [esp]
jmp 0x477fe7
mov eax, 0x3275e8eb
lea esp, [esp + 2]
jmp 0x4780b7
mov bx, word [esp]
xor bl, cl
jmp 0x478015
xor bl, cl
not ah
jmp 0x478017
jmp 0x477fdb
xchg bl, bh
sub esp, 0
jne 0x478069
mov eax, dword [esp]
jmp 0x478051
not ah
ror dl, 0
lea ebx, [ebx*4]
lea ebx, [ebx + esi]
jmp 0x477fff
jae 0x4780a7
pop dword [esp + 0xc]
lea eax, [esi + ebp]
jmp 0x477fcd
rol dl, 0
bswap eax
mov al, dh
sub esp, 0xb
jne 0x47808c
je 0x478076
wait
adc eax, dword [ebx + reloc.KERNEL32.dll_GetProcAddress]
cmp esi, 0x48b66cc
and al, 0xb4
jmp 0xc29c9a48
dec ah
mov ax, word [esp]
mov ah, 0xe9
jmp 0x478074
mov eax, dword [esp]
dec ah
mov ax, word [esp]
mov ah, 0xe9
jmp 0x47803b
pop ax
lea esp, [esp + 1]
jmp 0x4780e1
pop ax
lea esp, [esp + 1]
jmp 0x4780e1
pop dword [esp + 0xc]
lea eax, [esi + ebp]
mov eax, 0x3275e8eb
lea esp, [esp + 2]
lea esp, [esp + 0x10]
add dl, 0x77
jmp 0x477fb5
lea esp, [esp + 2]
sub esi, 4
lea ebx, reloc.KERNEL32.dll_GetProcAddress
lea eax, [edx + edi]
sub esp, 0x16
jmp 0x47816c
and edx, 0x3c
lea eax, reloc.KERNEL32.dll_GetProcAddress
push bp
mov al, byte [esp]
xchg word [esp], ax
jmp 0x4780c3
jmp 0x478178
btr ax, ax
call 0x478115
sti
mov dx, word [esp]
not edx
setns al
lea edx, [edi*4]
jmp 0x478146
mov ebx, dword [edx + edi]
lea edx, [ebx + 0xef]
inc ah
jbe 0x47810b
btr ax, ax
jmp 0x4780f5
mov edx, 0xeae7b0ed
xchg dword [esp], ebx
xchg edx, eax
neg eax
lea ebx, [ebx - 0x1f]
xchg dword [esp], ebx
jmp 0x47818e
jno 0x4781ae
mov bx, 0xc212
lea esp, [esp + 2]
jmp 0x4781b6
mov dword [esi], ebx
btr eax, esp
jo 0x4781d1
setnp bl
jmp 0x4781bb
xchg edx, eax
mov dx, word [esp]
setns ah
btr ax, sp
bswap edx
push dword [esp]
ret 4
mov bx, 0xc212
lea esp, [esp + 2]
jmp 0x47812f
xor edx, esp
jmp fcn.004781dc
setnp bl
xor edx, esp
jmp fcn.004781dc
mov bx, word [esp]
lea esp, [esp + 4]
neg dl
sub esp, 0x16
jmp 0x478030

Function at 0x4c79a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, eax
mov bx, word [esp]
mov bl, cl
clc
jns 0x4c79a6
js 0x4c79ad
invalid
jmp 0x4c798e
cmc
jmp 0x4c79d8
cmc
jmp 0x4c79d8
mov word [esi], dx
mov bl, 0xb0
mov ebx, edx
mov bh, 0x94
jmp fcn.004781dc
Function at 0x51bb48
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0xb], dl
xchg byte [esp + 1], al
pop bp
mov dword [esp + 9], eax
jmp 0x51bb68
mov byte [esp + 0xb], ah
mov byte [esp + 6], ch
jmp 0x51bb30
push dword [esp + 0x10]
btr ax, dx
xchg ah, al
rdtsc
mov al, 0x15
jmp 0x51bb8f
xchg word [esp + 9], dx
pushal
pop ax
push edi
mov dx, word [esp + 0xf]
neg bp
jmp 0x51bb52

Function at 0x51bedb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 1]
sub esp, 0x11
add esp, 7
mov word [esp + 7], bp
jmp 0x51be0f
add esp, 4
not ebp
lea edx, [ebx + 0xff]
neg dx
bswap edx
lea eax, [ebp*4]
jmp 0x51bda6
add esp, 1
pop eax
mov ah, byte [esp + 1]
xchg word [esp + 2], dx
pop bp
lea eax, reloc.KERNEL32.dll_GetProcAddress
xchg word [esp + 2], dx
rdtsc
mov eax, 0xf099b6d3
mov bp, word [esp + 8]
jmp 0x51bdeb
mov dh, byte [esp]
xchg ebp, eax
mov word [esp + 2], dx
rdtsc
mov dword [esp], edx
lea esp, [esp + 1]
jmp 0x51bdbc
pop dword [esp]
setb dh
mov word [esp], di
xchg byte [esp + 2], dl
jmp 0x51be50

Function at 0x51c084
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt eax, edi
mov dword [esp + 0x26], edi
lea ebp, reloc.KERNEL32.dll_GetProcAddress
mov dx, 0x4a6f
jmp 0x51c5da
mov dl, byte [esp]
xchg bp, dx
cld
lea eax, [ecx*4]
jmp 0x51c16e
lea ebp, [edx*4]
bswap edx
add esp, 7
mov dword [esp], eax
add esp, 3
std
jmp 0x51c0be
mov bp, ax
rdtsc
push dword [esp + 1]
mov dword [esp + 1], ebp
jmp 0x51c10e
mov dh, bl
push bx
mov ebp, dword [esp + 3]
cmc
neg eax
push ax
jmp 0x51c0e9
lea esp, [esp + 7]
sub esp, 0x1d
rdtsc
xchg dx, ax
bswap ebp
xchg ah, dl
jmp 0x51c150
lea eax, [edx*4]
mov ebp, dword [esp]
lea eax, [esi + edi]
xchg byte [esp], al
bswap edx
mov al, byte [esp + 2]
jmp 0x51c0ff
lea eax, [edx*4]
setns ah
call fcn.0051c11f
nop
push cs
pushfd
sti
push ss
xchg ecx, eax
pop ds
mov dword [reloc.KERNEL32.dll_GetProcAddress], eax
xchg cx, ax
adc byte [edi], cl
mov ebp, 0xb65466e8
test dword [esi - 0x43], esp
hlt
bsr ebp, eax
push sp
mov dh, 0x85
mov bp, 0xf7f4
mov ebp, 0xd5867bc1
xchg byte [esp], dl
jmp 0x51c138
mov word [esp + 5], ax
xchg al, dh
xchg al, dh
bsr dx, si
add esp, 0xb
bsf ax, bp
jmp 0x51c0d4
mov dl, dh
lea eax, [ecx + ecx]
lea esp, [esp + 0x1f]
push word [esp + 0xf]
pop edx
push word [esp]
jmp 0x51c1fc
rcr ax, cl
lea ebp, [ebp*4]
xchg dword [esp + 3], ebp
bt ax, bp
lea eax, reloc.KERNEL32.dll_GetProcAddress
mov byte [esp + 0x26], bl
jmp 0x51c2a5
std
mov ax, 0x731a
xchg word [esp + 0x2b], bp
xor dl, 0xb0
xchg bp, ax
neg dx
jmp 0x51c427

Function at 0x51c623
Capabilities:
Execute anti-debugging instructions

Disassembly:
push cx
lea ebp, reloc.KERNEL32.dll_GetProcAddress
xchg al, dh
mov eax, 0xdfc5e1ea
jmp 0x51c63b
inc dh
cld
sub esp, 0x1c
neg bp
bsf edx, eax
add esp, 0x2e
jmp 0x51c5f1
xchg ebp, eax
adc ecx, dword [edx - reloc.KERNEL32.dll_GetProcAddress]
jmp 0x51c607
invalid
jmp 0x51c607
mov dh, dl
cmc
cmc
rdtsc
call fcn.0051c6a5
jb 0x51c61d
bound eax, qword [0x587973f4]
mov ebx, 0x669c0d92
push dword [esp + 6]
push word [esp + 6]
mov edx, 0x6c1c5ed
pop word [esp + 2]
pop word [esp + 3]
rdtsc
mov dh, dl
jmp 0x51c625
Function at 0x51c6a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + ebp]
inc ah
push dword [esp + 3]
mov byte [esp + 4], ch
not dx
sub esp, 0xa
jmp 0x51c674
rdtsc
clc
pop word [esp + 1]
jmp 0x51c68a

Function at 0x51ca0a
Capabilities:
Access peb ldr_data

Disassembly:
mov byte [esp], ch
pushfd
lea esp, [esp + 7]
mov byte [esp], dh
lea esp, [esp]
jmp 0x51c91d
Function at 0x4bc797
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4bc7cf
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4bc7bd
mov al, 1
jmp 0x4bc820
cmp dword [ebx + 0x54], ecx
jne 0x4bc7c6
mov al, 2
jmp 0x4bc820
cmp dword [ebx + 0x7c], ecx
jne 0x4bc820
mov al, 3
jmp 0x4bc820
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4bc7e4
mov al, 4
jmp 0x4bc820
cmp ecx, 5
jne 0x4bc804
cmp ebx, 0
jne 0x4bc7f2
mov al, 5
jmp 0x4bc820
cmp ebx, 1
jne 0x4bc7fb
mov al, 6
jmp 0x4bc820
cmp ebx, 2
jne 0x4bc804
mov al, 7
jmp 0x4bc820
cmp ecx, 6
jne 0x4bc810
cmp ebx, 0
jne 0x4bc812
mov al, 8
jmp 0x4bc820
cmp ebx, 1
jne 0x4bc819
mov al, 9
cmp ebx, 2
jne 0x4bc820
mov al, 0xa
pop ebx
mov esp, ebp
pop ebp
ret