joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460a30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x857140]
xor edx, edx
cmp eax, edx
jne 0x460a56
xor eax, eax
mov byte [eax + 0x857040], al
inc eax
cmp eax, 0x100
jl 0x460a3e
mov dword [0x857140], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x857040
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x460ae7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x460aba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x460a88
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x460b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x460bb3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x460b9a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475620
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bf0a8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x475659
inc eax
mov dword [esi + 0x10], eax
jmp 0x47576c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x47566d
mov eax, 0xffffffc7
jmp 0x47576e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x47567e
cmp dword [esi + 8], eax
jne 0x47566d
cmp dword [esi + 8], eax
jne 0x475697
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x475697
mov eax, 0xffffffc7
jmp 0x47576e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x4756ab
push eax
mov ecx, ebx
call fcn.00474e50
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00441400
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4756dc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00441420
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.004745c0
test eax, eax
mov dword [esp + 0x38], eax
je 0x47570f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x825418
call fcn.00441600
mov eax, dword [esp + 0x38]
jmp 0x47576e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00475480
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x475753
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004754a0
mov esi, eax
test esi, esi
jne 0x475783
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00475480
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x475725
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x825418
call fcn.00441600
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x825418
call fcn.00441600
mov eax, esi
jmp 0x47576e
Function at 0x4c8fc5
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004c9044
jae 0x4c8fd1
xor ecx, ecx
call fcn.004c9044
jae 0x4c8ffb
xor eax, eax
call fcn.004c9044
jae 0x4c900c
mov al, 0x10
call fcn.004c9044
adc al, al
jae 0x4c8fed
jne 0x4c9039
stosb byte es:[edi], al
jmp 0x4c8fd2
call fcn.004c9050
dec ecx
loop 0x4c9018
mov eax, ebp
call fcn.004c904e
jmp 0x4c903a
lodsb al, byte [esi]
shr eax, 1
je 0x4c9060
adc ecx, 2
mov ebp, eax
jmp 0x4c903a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004c904e
cmp eax, 0x7d00
jae 0x4c9038
cmp eax, 0x500
jae 0x4c9039
cmp eax, 0x7f
ja 0x4c903a
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4c8fd2
pop ebp
ret 8
Function at 0x6145dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
jmp 0x6145b8
lea esp, [esp + 3]
and cl, 0xfc
call fcn.0061451e
push dword [esp]
push word [esp + 1]
add esp, 3
jle 0x6145b4
jg 0x61455d

Function at 0x614685
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x18
push dword [esp]
sub esp, 0x1a
pop dword [esp + 0x10]
pop dword [esp + 0x14]
jmp 0x61466c

Function at 0x614a90
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
pushal
mov byte [esp + 8], dh
jmp 0x6144d6
sub ecx, eax
cmc
jl 0x614490
stc
jmp 0x6144cb
add esp, 1
stc
lea esp, [esp + 3]
jmp 0x6144fe
pushal
mov byte [esp + 8], dh
jmp 0x6144d6
mov esp, ecx
pushfd
lea edi, [eax + ecx - 0x40]
jmp 0x614500
add esp, 1
stc
lea esp, [esp + 3]
jmp 0x6144aa
push esi
push edi
push ecx
call fcn.0061453a
mov esi, edx
jmp 0x6145f0
clc
jge 0x6144f6
jl 0x6144c1
mov edi, ecx
mov ecx, eax
cld
jmp 0x6145fb
rep movsb byte es:[edi], byte [esi]
inc cl
jne 0x614652
je 0x614637
cmc
push esp
jmp 0x61465c
bsr cx, bp
clc
mov ecx, dword [esp]
jmp 0x614603
bsr cx, bp
clc
mov ecx, dword [esp]
cmc
push esp
push word [esp + 1]
pushal
lea esp, [esp + 2]
call fcn.00614685
dec esp
lea esp, [esp + 2]
xchg dword [esp + 0x2c], ebx
push esp
mov byte [esp + 1], bh
clc
clc
jmp 0x614a04
push esp
lea ebx, [ebx + 0x38]
pushal
clc
call fcn.00614851
lea esp, [esp + 4]
not cl
setp dh
rdtsc
lea edx, [ebp - 0x2f]
jmp 0x614a83
mov eax, 0xd27e92
rdtsc
jmp 0x614a5f
mov eax, 0xd27e92
rdtsc
call 0x614a28
xchg dx, ax
jmp 0x614ab2
xchg dx, ax
sete ah
jmp 0x614ab5
setnp dh
and ecx, 0x3c
shl eax, 0x1b
jb 0x614a64
jae 0x614a6d
mov edx, dword [esi]
bswap eax
not ax
jmp 0x614b35
sub esp, 0x10
jmp 0x614b04
sete ah
call 0x614a90
insb byte es:[edi], dx
sti
imul ecx, dword [esi], 0xfffffffd
inc ebp
inc edx
fdiv qword [edx + 0x15]
in al, 0x5b
test eax, 0x8d826bc8
and al, 0x20
xor cl, 0x2f
shr edx, 5
jge 0x614a58
jl 0x614a3f
xchg word [esp + 1], dx
jmp 0x614b11
rdtsc
xchg dx, cx
jmp 0x614b1e
xchg dx, cx
btc eax, esp
jmp 0x6132b0
mov dword [ecx + edi], edx
xchg dx, cx
mov cl, 0x62
call 0x614adc
add esi, 4
bsr ax, cx
jno 0x614ae3
rdtsc
jmp 0x614aee
btc eax, esp
jmp 0x6132b0
sub esp, 8
js 0x614a9c
sub esp, 0x10
jmp 0x614b04
Function at 0x614adc
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
pushal
mov byte [esp + 8], dh
jmp 0x6144d6
sub ecx, eax
cmc
jl 0x614490
stc
jmp 0x6144cb
add esp, 1
stc
lea esp, [esp + 3]
jmp 0x6144fe
pushal
mov byte [esp + 8], dh
jmp 0x6144d6
mov esp, ecx
pushfd
lea edi, [eax + ecx - 0x40]
jmp 0x614500
add esp, 1
stc
lea esp, [esp + 3]
jmp 0x6144aa
push esi
push edi
push ecx
call fcn.0061453a
mov esi, edx
jmp 0x6145f0
clc
jge 0x6144f6
jl 0x6144c1
mov edi, ecx
mov ecx, eax
cld
jmp 0x6145fb
rep movsb byte es:[edi], byte [esi]
inc cl
jne 0x614652
je 0x614637
cmc
push esp
jmp 0x61465c
bsr cx, bp
clc
mov ecx, dword [esp]
jmp 0x614603
bsr cx, bp
clc
mov ecx, dword [esp]
cmc
push esp
push word [esp + 1]
pushal
lea esp, [esp + 2]
call fcn.00614685
dec esp
lea esp, [esp + 2]
xchg dword [esp + 0x2c], ebx
push esp
mov byte [esp + 1], bh
clc
clc
jmp 0x614a04
push esp
lea ebx, [ebx + 0x38]
pushal
clc
call fcn.00614851
lea esp, [esp + 4]
not cl
setp dh
rdtsc
lea edx, [ebp - 0x2f]
jmp 0x614a83
mov eax, 0xd27e92
rdtsc
jmp 0x614a5f
mov eax, 0xd27e92
rdtsc
call 0x614a28
xchg dx, ax
jmp 0x614ab2
xchg dx, ax
sete ah
jmp 0x614ab5
setnp dh
and ecx, 0x3c
shl eax, 0x1b
jb 0x614a64
jae 0x614a6d
mov edx, dword [esi]
bswap eax
not ax
jmp 0x614b35
sub esp, 0x10
jmp 0x614b04
sete ah
call 0x614a90
insb byte es:[edi], dx
sti
imul ecx, dword [esi], 0xfffffffd
inc ebp
inc edx
fdiv qword [edx + 0x15]
in al, 0x5b
test eax, 0x8d826bc8
and al, 0x20
xor cl, 0x2f
shr edx, 5
jge 0x614a58
jl 0x614a3f
xchg word [esp + 1], dx
jmp 0x614b11
rdtsc
xchg dx, cx
jmp 0x614b1e
xchg dx, cx
btc eax, esp
jmp 0x6132b0
mov dword [ecx + edi], edx
xchg dx, cx
mov cl, 0x62
call 0x614adc
add esi, 4
bsr ax, cx
jno 0x614ae3
rdtsc
jmp 0x614aee
btc eax, esp
jmp 0x6132b0
sub esp, 8
js 0x614a9c
sub esp, 0x10
jmp 0x614b04

Function at 0x754600
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0075467f
jae 0x75460c
xor ecx, ecx
call fcn.0075467f
jae 0x754636
xor eax, eax
call fcn.0075467f
jae 0x754647
mov al, 0x10
call fcn.0075467f
adc al, al
jae 0x754628
jne 0x754674
stosb byte es:[edi], al
jmp 0x75460d
call fcn.0075468b
dec ecx
loop 0x754653
mov eax, ebp
call fcn.00754689
jmp 0x754675
lodsb al, byte [esi]
shr eax, 1
je 0x75469b
adc ecx, 2
mov ebp, eax
jmp 0x754675
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00754689
cmp eax, 0x7d00
jae 0x754673
cmp eax, 0x500
jae 0x754674
cmp eax, 0x7f
ja 0x754675
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x75460d
pop ebp
ret 8
Function at 0x8827ac
Capabilities:
Encode data using xor

Disassembly:
push word [esp + 0x17]
mov byte [esp + 0x12], ah
pop word [esp + 5]
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x88], ebp
call fcn.00882766
lea esp, [esp + 3]
lea esi, [esi + 6]
jmp 0x8827e1
pushal
mov dword [esp + 0x17], esi
pop dword [esp + 0x12]
pop dword [esp + 6]
pop dword [esp + 4]
xchg dword [esp + 0x48], esi
call 0x88281b
xor ah, byte [edx + 0x5a25730]
jo 0x8827ea
ja 0x882817
loope 0x882825
lcall 0x224, 0x448f60f5
mov word [esp], sp
mov dword [esp + 0xd], ecx
call fcn.008827db
jmp 0x8829a3
sar bh, 0xff
invalid
fild dword [edx]
wait
or ebp, dword [esi - 0x63]
xor bh, byte [esi + 0x49]
call 0x6165ca3e
pushal
mov byte [esp + 0x10], bh
jmp 0x882789
push word [esp + 3]
pop word [esp + 1]
push dword [esp]
lea esp, [esp + 1]
lea esp, [esp + 3]
push dword [esp + 0x4c]
ret 0x50
Function at 0x8a348b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x88cf52
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x88cf6e
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x88cf5a
jmp 0x88cf79
ret
push word [esp + 3]
mov dword [esp], eax
bswap esi
xchg dword [esp], esi
push dword [esp + 2]
mov esi, 0xf5117768
call fcn.008a33fc
mov esi, dword [esp + 0x32]
lea esp, [esp + 0x38]
jmp 0x88cf47
bswap esi
jmp 0x8a341a

Function at 0x8a3e2e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 3]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp fcn.0088ab1d

Function at 0x8bdfa5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x1c]
cmp eax, 0x40
call fcn.008bdfe3
fimul word [edi - 0x21]
mov edx, 0xe0749349
jbe 0x8bdf96
loopne 0x8bdfd9
popfd
in al, dx
inc esi
jno 0x8bdffd
lea esp, [esp + 1]
jmp 0x8bdf6f
add dh, cl
cmp dword [edx - 0x18], esi
jle 0x8bdfb6
call 0x27c064fe
dec esi
fnstcw word [eax]
add esp, 7
mov dword [esp + 1], ebp
jmp 0x8bdf8d
add byte [edx], al
lahf
punpckhdq mm3, qword [ecx + 0x66f06865]
add eax, esi
inc esp
insd dword es:[edi], dx
jl 0x8be015
pop ebp
rcl dword [ecx + 0x30], 0xc3
jle 0x8bdfa3
jp 0x8be037
les ecx, [ebp + 0xf042464]
test esi, ecx
cld
invalid
and al, 8
out dx, eax
jg 0x8be032
jmp 0xcc9628d
rcl ebp, cl
xchg ecx, eax
add dword [eax - 0x6d], esp
xchg ecx, eax
adc al, byte [eax + 0x13d412e7]
mov ah, byte [0x648dc933]
and al, 4

Function at 0x8bdfe3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esp
lea esp, [esp + 4]
test edi, edi
push esp
jmp 0x8be3f5
lea ecx, [esi + 0xfd]
xor ecx, ecx
call fcn.008bdfae
int 0x54
retf 0x5cad
lea esp, [esp + 4]
jne 0x8bdcbb
je 0x8bdfc6
push 0xfffffffffffffffb
imul ecx, dword [esi], 0xfffffffd
dec ebp
inc eax
fdiv qword [edx + 0x15]
in al, 0x20
test eax, 0x824648d
pushal
pop dword [esp + 8]
jmp 0x8be451
lea esp, [esp + 0x24]
jne 0x8bdd11
lea ebp, [eax*4]
jmp 0x8be3c4
pushal
push word [esp + 0x17]
mov word [esp + 8], bx
lea esp, [esp + 2]
jmp 0x8be3de
lea esp, [esp + 0x1c]
pop ebp
jmp 0x88b9f8

Function at 0x8be28b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x14]
movzx ebp, byte [eax + 0xb]
call 0x8be28b
dec ebx
shl edx, 8
pushal
jmp 0x8be2c7
push dword [esp]
or edx, ebp
lea ebp, [ebx + ebx]
lea ebp, [ecx + edx]
mov bp, word [esp]
jmp 0x8be27d
jmp 0x8be2a6
add esp, 7
lea esp, [esp + 1]
or edx, ebp
mov bp, word [esp]
jmp 0x8be37e
add eax, 0x10
cmp ecx, 0x10
push edx
jmp 0x8be368
lea esp, [esp + 4]
lea ecx, [esi + 8]
lea eax, [ebp - 0x2f]
lea eax, [ecx + ebx]
not al
jmp 0x8be3a6
sub esp, 0
stc
mov dword [esp + ecx*4 + 0x18], edx
add ecx, 4
jmp 0x8be336
lea esp, [esp + 4]
jb 0x8bdd55
mov eax, edx
mov eax, dword [esp]
push esp
jmp 0x8be33f
lea esp, [esp + 0x1c]
movzx ebp, byte [eax + 0xa]
shl edx, 8
or edx, ebp
jmp 0x8be35b
lea eax, [esp + 0xc]
call fcn.008bedd1
setb byte [eax]
xchg edx, eax
push esp
mov bl, 0x17
xchg edx, esp
adc dword [eax + 0x47d4a50a], ebx
lea eax, [esp + edi]
jmp 0x8be38d
Function at 0x8be2c5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x14]
movzx ebp, byte [eax + 0xb]
call 0x8be28b
dec ebx
shl edx, 8
pushal
jmp 0x8be2c7
push dword [esp]
or edx, ebp
lea ebp, [ebx + ebx]
lea ebp, [ecx + edx]
mov bp, word [esp]
jmp 0x8be27d
jmp 0x8be2a6
add esp, 7
lea esp, [esp + 1]
or edx, ebp
mov bp, word [esp]
jmp 0x8be37e
add eax, 0x10
cmp ecx, 0x10
push edx
jmp 0x8be368
lea esp, [esp + 4]
lea ecx, [esi + 8]
lea eax, [ebp - 0x2f]
lea eax, [ecx + ebx]
not al
jmp 0x8be3a6
sub esp, 0
stc
mov dword [esp + ecx*4 + 0x18], edx
add ecx, 4
jmp 0x8be336
lea esp, [esp + 4]
jb 0x8bdd55
mov eax, edx
mov eax, dword [esp]
push esp
jmp 0x8be33f
lea esp, [esp + 0x1c]
movzx ebp, byte [eax + 0xa]
shl edx, 8
or edx, ebp
jmp 0x8be35b
lea eax, [esp + 0xc]
call fcn.008bedd1
setb byte [eax]
xchg edx, eax
push esp
mov bl, 0x17
xchg edx, esp
adc dword [eax + 0x47d4a50a], ebx
lea eax, [esp + edi]
jmp 0x8be38d

Function at 0x9786c5
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 7]
lea esp, [esp]
jmp 0x97867f

Function at 0xa41600
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa4165d
mov cl, ch
rcl ax, cl
lea ebx, [esp + edx]
mov bl, byte [esp]
mov cl, byte [esp]
rcr ebp, 1
jmp 0xa41696
mov edi, dword [esp]
cpuid
xchg ch, dl
lea edi, [edi*4]
mov ebp, dword [esp]
xchg ebp, ecx
jmp 0xa4162b
lea esp, [esp + 0x40]
pushal
xchg dh, al
mov ebx, dword [esp]
xchg di, dx
lea edx, [edx + esi]
jmp 0xa41643
mov ecx, dword [esp]
rdtsc
mov dl, dh
push edx
cpuid
push esp
jmp 0xa41680
lea ebx, [esi*4]
mov bl, bh
bswap edi
btr edx, edx
jmp 0xa416a5
mov eax, dword [esp]
not eax
xchg ch, dl
mov bl, 0xf8
mov edi, eax
xchg edi, edx
jmp 0xa4166f
xchg dword [esp + 2], edx
lea ebx, [ebp + 0x4f]
not edi
pop dword [esp]
pop word [esp]
jmp 0xa41f56
sub esp, 0x14
pop dword [esp + 2]
push edx
bsf ax, si
jmp 0xa4170b
lea ebx, [edx + edx]
bswap ebp
cpuid
setae ah
ror dh, 7
clc
jmp 0xa416c3
mov cx, di
setbe bh
mov ax, word [esp]
rol dx, cl
bsr si, cx
mov dx, word [esp]
jmp 0xa416d9
pop word [esp + 0xb]
push word [esp + 0x11]
xchg bp, di
bswap esi
bswap ecx
bswap esi
jmp 0xa4179e
lea esi, [esp + edx]
cpuid
rdtsc
btc esi, ebx
bsf ax, si
bswap ebx
jmp 0xa416f4
mov di, dx
cpuid
mov dl, dh
mov si, word [esp]
mov cx, 0x717f
mov si, dx
jmp 0xa4172a
pop word [esp + 3]
mov esi, ebp
lea esi, [esp + eax]
lea ecx, [ecx - 0x322505fd]
lea ebp, [ecx*4]
rdtsc
jmp 0xa417ea
bsf dx, si
setae ch
cpuid
xchg word [esp + 0xf], bx
jmp 0xa4175f
inc bl
mov word [esp + 2], dx
mov byte [esp + 7], ah
pop word [esp + 5]
not dh
setno ah
jmp 0xa41787
mov ax, di
add esp, 9
sub esp, 0xa
mov dx, word [esp + 9]
mov byte [esp + 1], bh
pop edx
call fcn.00a417b5
insb byte es:[edi], dx
jg 0xa41830
and cl, bh
pop edx
mov byte [esp + 4], ah
mov cx, 0x364d
rdtsc
mov si, 0x5f21
jmp 0xa417cf
cmp al, 0xeb
retf 0xecb8
invalid
in al, dx
pop edx
neg ah
mov dx, word [esp]
and ebx, ecx
xchg ecx, eax
mov dl, dh
jmp 0xa4174b
bsf si, si
pop word [esp + 1]
cpuid
mov dword [esp], ebp
bswap esi
rdtsc
jmp 0xa418e7
mov di, 0xd413
xchg dh, al
lea esi, [eax + 0xe1]
push esp
pop word [esp + 1]
push word [esp + 3]
jmp 0xa41a68
Function at 0xa41bad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 9]
inc di
push word [esp + 9]
pop esi
xor dl, ch
btr ecx, edx
jmp 0xa41bb1
cpuid
xchg byte [esp + 6], cl
mov ebp, esi
mov al, 0x8e
mov bh, byte [esp + 3]
setp ch
jmp 0xa41b6a
xchg dh, al
jmp 0xa41b91
add dx, 0xe136
lea ecx, [edx + ebx]
neg esi
lea ebp, [ecx - 0xf3]
not dh
setne ah
jmp 0xa41c12
mov edx, dword [esp + 9]
rcl bx, cl
mov cl, 2
inc ax
xchg word [esp + 7], si
jmp 0xa41d41
not cx
lea esp, [esp + 0x16]
cpuid
bswap ecx
bswap edi
lea ecx, [eax + 0x75832311]
jmp 0xa41ca3
mov byte [esp + 1], dh
pushal
xchg dh, al
lea esp, [esp + 6]
mov ch, byte [esp + 0xe]
rcr ah, 1
jmp 0xa41c47
xchg word [esp + 3], bp
bsr bp, bp
not ch
rdtsc
neg esi
mov dword [esp], ecx
jmp 0xa41d15
not ax
mov eax, dword [esp + 4]
ror ebp, 0x17
lea esp, [esp]
mov ebp, dword [esp + 3]
jmp 0xa41c7a
mov dword [esp + 4], eax
lea ebx, [edx + esi]
sub esp, 0x18
bswap ebp
rdtsc
popal
jmp 0xa41c67
lea edi, [esi + edi]
push dword [esp + 4]
pop cx
mov ax, word [esp + 8]
add esp, 1
not dh
jmp 0xa41cbd
btr edx, esp
neg ah
pop dword [esp]
and cl, bh
btc ecx, ebx
xor dl, ch
jmp 0xa41cfe
pop di
inc al
bsr cx, cx
btc edx, ebx
lea esp, [esp + 1]
jmp 0xa41d2a
xchg edi, esi
push word [esp + 3]
xchg byte [esp], al
mov cl, 0xca
bsr si, bp
neg si
jmp 0xa41ce9
mov si, 0x9d6f
inc eax
xchg dh, al
lea esp, [esp + 1]
mov ebp, esi
jmp 0xa41e20
mov word [esp], bx
mov byte [esp + 3], ch
mov ebp, dword [esp + 3]
xchg word [esp + 3], dx
xchg dx, cx
inc edx
jmp 0xa41cd4
mov edi, 0xf3de3a32

Function at 0xa41fb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov al, 0x4e
cpuid
jmp 0xa41fe6

Function at 0xa42191
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 5]
lea esp, [esp + 0xc]
lea esp, [esp]
jmp 0xa421bf
inc bl
xchg bh, cl
push esp
pop ecx
bsr dx, cx
setae dh
jmp 0xa4222b
add esp, 0
not ax
bsf dx, si
lea edi, [edx + esi]
inc si
jmp 0xa4220b
stc
xchg dh, al
lea edx, [ebp - 0x9f]
inc eax
bswap eax
shr esi, 0x1b
jmp 0xa4223e
mov edx, 0xdcc857a8
mov bl, 0x70
bswap eax
clc
rdtsc
mov cl, ch
jmp 0xa421f4
mov bh, byte [esp]
xchg di, cx
cpuid
mov esi, dword [esp]
btc ebx, ebx
lea esp, [esp]
jmp 0xa421ce
mov bx, word [esp]
rdtsc
bswap ebx
lea esp, [esp]
not bx
lea esi, [ecx + edi]
jmp 0xa42ac7
pushal
Function at 0xa4262c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x5a35
pop dword [esp + 0x1e]
pop si
rdtsc
mov word [esp + 0x1a], dx
jmp 0xa4268a
neg ah
add esp, 1
xchg bx, ax
lea edi, [esi + 0x75]
lea esp, [esp + 9]
sub esp, 0xc
jmp 0xa426e3
stc
mov byte [esp + 4], bh
mov cl, ch
mov cx, bx
xchg dword [esp + 0x22], edi
mov dl, 0x8c
jmp 0xa4263f
neg cx
pop ax
mov byte [esp + 0x22], dh
pop word [esp + 0x1b]
jmp 0xa42730
mov dword [esp + 3], ebp
mov word [esp + 0x1c], di
setae ah
pop edx
bsr bp, bp
xchg ch, dl
jmp 0xa426cd
sub esp, 0x18
rdtsc
bswap edi
lea ecx, [edx + edx]
xchg ebp, eax
cld
jmp 0xa4276a
xchg byte [esp + 1], cl
pop edx
neg edx
mov ebx, 0xcdf6f7c6
bsr bp, cx
xchg byte [esp + 0x14], dl
jmp 0xa4270f
pop dword [esp + 0x1c]
mov bl, 0xb0
cpuid
mov bl, 0x78
lea esp, [esp + 0xf]
lea esp, [esp + 3]
jmp 0xa42783
mov ecx, dword [esp + 0x17]
xchg bx, dx
xchg esi, eax
pop word [esp + 0x25]
push word [esp + 3]
xchg dword [esp + 0x2e], esi
jmp 0xa42746
lea esp, [esp + 0x20]
popal
call fcn.00a4278e
invalid

Function at 0xa47320
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push word [esp + 9]
lea esp, [esp + 2]
mov dword [esp + 0x78], edi
jmp 0xa46fdf

Function at 0x10002620
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x10002632
jmp 0x10002649
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x10002480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404fc4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00405ab4
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00405ab4
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x405040
mov eax, dword [0x498244]
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 8
call fcn.00405ac0
cmp dword [ebp - 0x18], esp
je 0x40506c
push 6
call fcn.00405aba
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x1d
call fcn.00405ac0
cmp dword [ebp - 0x18], esp
je 0x40509a
push 6
call fcn.00405aba
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 0x1e
call fcn.00405ac0
cmp dword [ebp - 0x18], esp
je 0x4050c6
push 6
call fcn.00405aba
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x1f
call fcn.00405ac0
cmp dword [ebp - 0x18], esp
je 0x405155
push 6
call fcn.00405aba
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 9
call fcn.00405ac0
cmp dword [ebp - 0x18], esp
je 0x40517a
push 6
call fcn.00405aba
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x405182
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00405aa8
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00405aa8
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8