joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x481bea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x481b6f
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.004028f8
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x481bc6
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.004186c0
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x481bc6
lea edx, [ebp - 4]
mov eax, dword [0x4c178c]
call fcn.00406148
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004819e0
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481bf1
lea eax, [ebp - 4]
call fcn.00404234
ret

Function at 0x48253c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
cmp eax, 5
jb 0x482581
cmp dword [ebp - 0x8c], 0
jbe 0x482578
mov byte [0x4c08f4], 8
jmp 0x4825f5
mov byte [0x4c08f4], 7
jmp 0x4825f5
cmp eax, 3
jbe 0x4825f5
cmp dword [ebp - 0x84], 2
jne 0x482598
mov byte [0x4c08f4], 1
jmp 0x4825f5
and dword [ebp - 0x88], 0xffff
mov eax, dword [ebp - 0x8c]
cmp eax, 0x5a
jb 0x4825b6
mov byte [0x4c08f4], 6
jmp 0x4825f5
cmp eax, 0xa
jb 0x4825d9
cmp dword [ebp - 0x88], 0x8ae
jb 0x4825d0
mov byte [0x4c08f4], 5
jmp 0x4825f5
mov byte [0x4c08f4], 4
jmp 0x4825f5
cmp dword [ebp - 0x88], 0x3e8
jb 0x4825ee
mov byte [0x4c08f4], 3
jmp 0x4825f5
mov byte [0x4c08f4], 2
mov esp, ebp
pop ebp
ret
Function at 0x4a91c4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4a91cc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a93be
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4a93d4
mov eax, esi
call fcn.0049c6f8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404288
lea ecx, [ebp - 0x10]
mov edx, 0x4a93e8
mov eax, esi
call fcn.0049c6f8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404288
lea ecx, [ebp - 0x14]
mov edx, 0x4a9400
mov eax, esi
call fcn.0049c6f8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404288
lea ecx, [ebp - 0x18]
mov edx, 0x4a941c
mov eax, esi
call fcn.0049c6f8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404288
lea ecx, [ebp - 0x1c]
mov edx, 0x4a9438
mov eax, esi
call fcn.0049c6f8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404288
lea ecx, [ebp - 0x24]
mov edx, 0x4a9450
mov eax, esi
call fcn.0049c6f8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004085c4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408b0c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4a9468
mov eax, esi
call fcn.0049c6f8
mov eax, dword [ebp - 0x28]
call fcn.0049969c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4a9478
mov eax, esi
call fcn.0049c6f8
mov eax, dword [ebp - 0x2c]
call fcn.0049969c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4a9490
mov eax, esi
call fcn.0049c6f8
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408b0c
inc eax
je 0x4a9361
lea ecx, [ebp - 0x34]
mov edx, 0x4a9490
mov eax, esi
call fcn.0049c6f8
mov eax, dword [ebp - 0x34]
call fcn.00408ad0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a41c
fstp qword [ebp - 0x3c]
wait
call fcn.0040a780
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4a937c
lea ecx, [ebp - 0x40]
mov edx, 0x4a9490
mov eax, esi
call fcn.0049c6f8
mov eax, dword [ebp - 0x40]
call fcn.0049969c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4a94a0
mov eax, esi
call fcn.0049c6f8
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404288
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a93c5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404258
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404258
ret
Function at 0x4b5e78
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b5f46
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b6704
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004046f4
push eax
push 0x4b5f54
mov eax, dword [0x4c1890]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
test ebx, ebx
jns 0x4b5ecd
call fcn.0040335c
test ebx, ebx
je 0x4b5f1e
cmp ebx, 0x20
jg 0x4b5f1e
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00408994
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4c1c38]
call fcn.00406148
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.00409b10
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407684]
call fcn.0040c5a0
call fcn.00403bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5f4d
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404258
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404258
ret

Function at 0x4b5f5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6031
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b6704
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004046f4
push eax
mov eax, dword [ebx + 0x60]
call fcn.004046f4
push eax
push 0x4b6040
mov eax, dword [0x4c1890]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4b5fb6
call fcn.0040335c
mov ebx, eax
test ebx, ebx
je 0x4b6009
cmp ebx, 0x20
jg 0x4b6009
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00408994
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4c1c38]
call fcn.00406148
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.00409b10
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407684]
call fcn.0040c5a0
call fcn.00403bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6038
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404258
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404258
ret
Function at 0x4b6048
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b611d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b6704
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004046f4
push eax
mov eax, dword [ebx + 0x68]
call fcn.004046f4
push eax
push 0x4b612c
mov eax, dword [0x4c1890]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4b60a2
call fcn.0040335c
mov ebx, eax
test ebx, ebx
je 0x4b60f5
cmp ebx, 0x20
jg 0x4b60f5
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00408994
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4c1c38]
call fcn.00406148
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.00409b10
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407684]
call fcn.0040c5a0
call fcn.00403bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6124
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404258
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404258
ret

Function at 0x4b6134
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6209
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b6704
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004046f4
push eax
mov eax, dword [ebx + 0x6c]
call fcn.004046f4
push eax
push 0x4b6218
mov eax, dword [0x4c1890]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4b618e
call fcn.0040335c
mov ebx, eax
test ebx, ebx
je 0x4b61e1
cmp ebx, 0x20
jg 0x4b61e1
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00408994
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4c1c38]
call fcn.00406148
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.00409b10
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407684]
call fcn.0040c5a0
call fcn.00403bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6210
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404258
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404258
ret
Function at 0x4b6220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b62f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b6704
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004046f4
push eax
mov eax, dword [ebx + 0x64]
call fcn.004046f4
push eax
push 0x4b6304
mov eax, dword [0x4c1890]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4b627a
call fcn.0040335c
mov ebx, eax
test ebx, ebx
je 0x4b62cd
cmp ebx, 0x20
jg 0x4b62cd
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00408994
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4c1c38]
call fcn.00406148
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.00409b10
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407684]
call fcn.0040c5a0
call fcn.00403bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b62fc
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404258
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404258
ret

Function at 0x4b9be4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046e4
xor eax, eax
push ebp
push 0x4b9c62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004046f4
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4b9c2d
mov eax, dword [ebx + 4]
call fcn.004046f4
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9c69
lea eax, [ebp - 4]
call fcn.00404234
ret
Function at 0x4bac64
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bae01
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402a84
cmp word [ebx + 0xa2], 0
je 0x4bacad
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4bacc1
lea esi, [ebp - 8]
jmp 0x4bacc3
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x4bacd0
xor edi, edi
jmp 0x4bacdd
mov eax, dword [ebx + 0x80]
call fcn.004046f4
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.004046f4
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004ba39c
mov eax, dword [ebp - 0x14]
call fcn.004046f4
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.004046f4
push eax
mov eax, dword [ebp - 0x10]
call fcn.004046f4
push eax
mov eax, ebx
call fcn.004ba4d0
push eax
mov eax, ebx
call fcn.004ba4a4
push eax
mov eax, ebx
call fcn.004ba458
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004ba268
mov eax, dword [ebp - 0x18]
call fcn.004046f4
push eax
mov eax, dword [ebx + 8]
call fcn.004046f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x4bad66
call fcn.0040dd34
xor edx, edx
push ebp
push 0x4baddf
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4bada4
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4bad9a
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4badc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bade6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x4bae10
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4bae3c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004046f4
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4bae61
call fcn.0040dd34
xor eax, eax
push ebp
push 0x4bae98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4bae81
call fcn.0040dd34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bae9f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4a2782
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4a2779
and edx, dword [esi + reloc.MSVCRT.dll_strncpy]
or byte [ecx + 0xf382444], cl
mov fs, word [esi - 0xd]
invalid
adc eax, 0x1c788b84
push edx
call fcn.004a2816
add byte [edx - 0x15], dl
jbe 0x4a276b
invalid
call fcn.004a27e1
and eax, 0xbd4e2bbb
pop edx
add byte [eax], al
add byte [0xbd4e2bbb], ah
jns 0x4a279b
pushfd
xor dl, byte [ebp - 0x5c]
jge 0x4a277e
jns 0x4a27af
jmp 0x4a27f0
add edi, ebp
push edx
mov word [esp], bx
lea esp, [esp + 0x28]
and al, 0x8d
and al, 0x28
sub byte [ecx - 0x16dfdb84], cl
dec edi
invalid
mov dword [esp + 0x20], edi
jmp 0x4a1afe
push edi
rcl byte [esi + 0x31], 0xc0
je 0x4a27a1
jge 0x4a27a5
je 0x4a2741
inc eax
int3
xchg esi, eax
add al, 0x63
sahf
pop edi
xchg dword [esi], ebp
cmp dword [ebp + reloc.MSVCRT.dll_strncpy], ecx

Function at 0x552d97
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
push word [esp + 3]
lea esp, [esp + 3]
mov word [esp], sp
lea esp, [esp + 1]
mov byte [esp], dh
jmp 0x552dc0
pop word [esp + 1]
lea esp, [esp + 3]
mov dword [esp], ebp
jmp 0x552d74
push edx
mov dword [esp], eax
mov word [esp + 2], dx
push esp
lea esp, [esp + 9]
mov byte [esp], dh
call fcn.00552da5
Function at 0x552e58
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
mov dword [esp], ebp
push word [esp + 5]
add esp, 1
add esp, 1
push word [esp + 5]
jmp 0x552e11
pushal
lea esp, [esp + 0x28]
sub esp, 8
pop dword [esp]
mov byte [esp + 1], ch
push dword [esp + 2]
jmp 0x552ebc
call 0x552e58
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor dword cs:[esi], ebp
aaa
xor byte cs:[eax], al
pushfd
push edx
jmp 0x552dd6
sub esp, 0x1a
push edx
xchg word [esp + 0x19], bp
pop word [esp + 0xb]
mov dword [esp + 0x28], eax
neg ebp
jmp 0x552f0e
add esp, 7
push word [esp + 2]
lea esp, [esp + 1]
mov dword [esp], ebp
pushal
lea ebp, [ecx - 0x5b]
jmp 0x552e73
mov dword [esp + 3], esi
add esp, 7
sub esp, 0xa
mov dword [esp], esi
lea esp, [esp + 1]
mov byte [esp + 5], bh
jmp 0x552e97
mov dh, 0xa0
lea ebp, [ecx + 0x8b]
xchg ebp, edx
rdtsc
mov al, ah
lea ebp, [esi + 0x2d]
jmp 0x552f3b
lea esp, [esp + 2]
mov dword [esp + 0x30], edx
lea ebp, [ecx + ebx]
mov dh, byte [esp]
lea eax, [edx + edx]
lea edx, [esp + ebp]
jmp 0x552ed3
neg bp
lea ebp, [ecx - 0x4b]
mov bp, si
mov bp, bx
mov al, 0xf2
sub esp, 0x1a
jmp 0x552ef4
rdtsc
add esp, 0x14
lea esp, [esp + 4]
mov dl, dh
push edx
pop word [esp + 0xa]
jmp 0x55307e
pushal
add esp, 0xb
sub esp, 0xa
push dword [esp + 0xc]
xchg dh, al
and ebp, ecx
jmp 0x552f21
xchg ebp, eax
lea ebp, [ebp*4]
sub esp, 0x18
xchg word [esp + 0x1d], dx
jmp 0x552faa
lea ebp, [edi + ebp]
xor ebp, esi
btr ebp, ebx
lea esp, [esp + 0x1e]
lea ebp, [ebp*4]
sub esp, 2
jmp 0x552f5b
lea esp, [esp + 5]
dec ebp
bsr ax, bp
pop word [esp + 2]
mov eax, dword [esp + 0xc]
pushal
jmp 0x553049
mov dword [esp + 3], ebp
xchg word [esp + 9], bp
add esp, 0x17
mov bp, 0x1b7f
lea eax, [esi + edi]
mov eax, 0xc7210db8
jmp 0x552f8a
setnp ah
mov dl, dh
mov bp, ax
mov bp, si
sub esp, 0x1e
clc
jmp 0x552f72
stc
neg ebp
add esp, 5
push word [esp + 0xf]
mov ebp, 0xb468ed70
jmp 0x553031
mov ebp, dword [esp + 0x25]
pop bp
push word [esp + 0x25]
add esp, 0xf
neg bp
mov ebp, 0x46224452
jmp 0x552fe9
add esp, 0xd
call fcn.0055305b
inc edx
aam 0x4a
sub eax, 0x41d469dc
sal dword [eax + reloc.MSVCRT.dll_strncpy], 1
cli
aad 0x44
mov ebp, dword [esp + 0x11]
setnp dh
mov ebp, 0x2d05dac8
mov ebp, dword [esp + 0xb]
xchg dh, al
jmp 0x553018
inc bp
lea eax, [eax + 0x61]
setp dh
btr eax, esp
mov dh, bh
lea ebp, [esp + ebx]
jmp 0x553000
xchg dword [esp], ebp
shl ebp, 0xd
push dword [esp + 1]
bswap ebp
bswap ebp
xchg byte [esp + 6], dl
jmp 0x552fd8
Function at 0x55305b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 6]
mov ebp, dword [esp + 0xb]
mov dh, 0xe8
xchg dword [esp + 8], ebp
sub esp, 6
jmp 0x5530bb
rdtsc
and edx, ecx
cld
bsr bp, cx
lea ebp, [ebx + ebx]
inc edx
jmp 0x553110
mov bp, 0xb129
bt eax, edx
mov edx, 0x85232912
add esp, 0
mov ebp, eax
jmp 0x5530f8
rdtsc
lea ebp, [edx + ebx]
lea esp, [esp + 0x13]
mov dx, 0x2a95
add esp, 0
lea ebp, [esi*4]
jmp 0x553095
mov ebp, esp
mov ebp, 0xa25b1dac
lea ebp, [esp + ecx]
shr ebp, 0x1b
call fcn.005530d4
lea ebx, [edi + ebp*2]
jbe 0x553170
mov al, byte [0x310fcd0f]
bswap ebp
rdtsc
mov byte [esp], dh
cmc
shl bp, cl
rdtsc
jmp 0x5530a4
mov dh, byte [esp]
xchg ebp, edx
mov dh, byte [esp]
sub esp, 0
xchg ebp, eax
mov bp, 0x5417
jmp 0x553138
xchg ebx, eax
xor eax, 0x66c50333
mov ebp, esi
btc edx, ebx
jmp 0x553151

Function at 0x5530d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
clc
jmp 0x5530df
mov eax, ecx
rdtsc
stc
lea eax, [edi + ebp]
setbe dh
add esp, 0
jmp 0x553168
add esp, 0
mov byte [esp], bh
mov ebp, 0x33359372
add eax, ebp
mov bp, si

Function at 0x55343a
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ebp, 0xe07cfa3a
bsr bp, cx
add ax, 0xca6
mov bp, di
bsr ax, bp
jmp 0x5533a6
btr eax, esp
pushal
lea esp, [esp + 0x4d]
xchg ebp, eax
mov dl, dh
mov ax, word [esp]
jmp 0x5533cc
btc edx, edi
rdtsc
mov bp, 0x5bd
mov al, ah
pushal
jmp 0x55340c

Function at 0x553761
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
mov ax, bx
cld
jmp 0x55376f
not ebp
sub esp, 2
sub esp, 0xa
mov dword [esp + 0x1b], esi
sub edx, eax
push esp
jmp 0x55379c

Function at 0x553a6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x553b57
mov bp, sp
btr ebp, edx
bsf bp, ax
mov dx, 0x6e6d
mov ebp, dword [esp]
bsr bp, cx
jmp 0x553ae2
bsr dx, bp
xchg edx, eax
mov dh, ch
bswap eax
rdtsc
rdtsc
jmp 0x553ac6
lea esp, [esp + 0x42]
lea ebp, [ebp - 0x5f]
mov ebp, dword [esp]
inc ax
shr dh, 7
mov edx, ecx
jmp 0x553a71

Function at 0x55430a
Capabilities:
Parse pe header

Disassembly:
call fcn.00554060
mov word [esp], bx
mov dword [esp], ecx
mov dword [esp], eax
lea esp, [esp + 1]
jmp 0x55446a
push dword [esp + 0x12]
lea esp, [esp + 7]
pop word [esp + 0xc]
mov byte [esp + 0x13], ah
call fcn.00554371
mov eax, dword [eax + 0xc]
jmp 0x5543e4
mov eax, dword [eax]
jmp 0x55442b
mov eax, dword [eax + 0x1c]
jmp 0x5543cd
push eax
jmp 0x55405b
mov eax, dword [eax + 8]
jmp 0x554413
lea esp, [esp + 3]
mov dword [esp + 0x44], esp
pushal
push edx
mov dword [esp + 7], esi
pop word [esp + 0x1b]
jmp 0x55438b
mov word [esp], dx
push edx
pushal
pop dword [esp + 0x1c]
push edx
pop dword [esp + 0x18]
jmp 0x554443

Function at 0x55432f
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x28], ebx
call fcn.0055430a
mov byte [0x38c9ae38], al
Function at 0x554359
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
mov word [esp], di
lea esp, [esp + 7]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x5543fb
lea esp, [esp + 2]
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
mov eax, dword fs:[0x30]
jmp 0x5543a1
mov dword [esp + 0x5c], esi
pushal
mov dword [esp + 0x1b], esi
pop dword [esp + 0x10]
pop dword [esp + 2]
pop word [esp + 0xf]
jmp 0x5543b9