joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447cd0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x447d03
push esi
call fcn.0044adc0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x447cfc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x447d89
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x447d72
mov eax, dword [esi + 8]
test eax, eax
je 0x447d27
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x447d6e
cmp eax, 2
je 0x447d72
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x447d1a
cmp eax, 3
je 0x447d4d
cmp eax, 1
jne 0x447d1a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x447d1a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x447d1a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00447db0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x447d98
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00447db0
add esp, 4
pop esi
ret

Function at 0x466f4b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x466f83
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00464fff
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00464fd7
jmp 0x466f8f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46863d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46867f
call fcn.0046e0ed
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46867f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x468676
xor eax, eax
jmp 0x468687
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046868d
pop edi
pop esi
pop ebx
ret 4

Function at 0x46e61d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46e64b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46e669
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046e583
jmp 0x46e669
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46e669
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046e583
test edi, edi
mov eax, edi
jne 0x46e653
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x502143
Capabilities:
Parse pe header

Disassembly:
pop eax
jmp 0x5025f1
cmp word [eax + ecx], dx
jmp 0x502610
sub esp, 0x20
jmp 0x502386
call 0x50214a
scasd eax, dword es:[edi]
xchg dword [esp], edi
lea edi, [edi + 0x71b]
xchg dword [esp], edi
jmp 0x502863
dec eax
jmp 0x5027d8
push ebp
jmp 0x50275b
jmp 0x5026fe
push dword [ebp + 8]
jmp 0x502d21
lahf
jg 0x5022db
xchg byte [ecx], ah
add eax, 0xbe90000
or byte [eax], al
add byte [ebx], al
imul ecx
push edx
pop es
add byte [eax], al
in eax, 0x33
fucomi st(1)
dec ebx
or al, byte [eax]
add bl, bh
stosd dword es:[edi], eax
mov eax, dword [esp + 4]
jmp 0x502708
push edi
js 0x502350
jns 0x502350
mov ah, 0xf4
scasd eax, dword es:[edi]
jge 0x5022c9
ret
jmp 0x502ca2
cmp word [eax], 0x5a4d
jmp 0x502b33
call 0x502357
mov ebx, 0x24148793
lea edx, [edx - 0xb8]
xchg dword [esp], edx
jmp 0x502433
mov dword [0x506239], 1
jmp 0x5021b1
cmp dword [0x506239], 0
jmp 0x5026ba
call 0x502439
cmp al, 0x87
sbb al, 0x24
lea ebx, [ebx - 0x3bb]
xchg dword [esp], ebx
jmp 0x50207d
and eax, 0xffff0000
jmp 0x502a24
mov ecx, dword [eax + 0x3c]
jmp 0x5026cf
inc eax
jmp 0x502171
jne 0x502d0f
jmp 0x502305
jne 0x5021f1
jmp 0x50236a
mov edx, 0x4550
jmp 0x5020c4
push ebx
jmp 0x502890
inc eax
jmp 0x502d0f
mov ebp, esp
jmp 0x502127
xor ax, ax
jmp 0x50230b
pushal
jmp 0x502c31
push esi
jmp 0x5022fc
call 0x50293a
cmp edx, ebx
xchg dword [esp], edx
lea edx, [edx - 0x899]
xchg dword [esp], edx
jmp 0x502198
mov ecx, 0x5a4d
jmp 0x502abf
cmp word [eax], cx
jmp 0x502ccd
jne 0x502171
jmp 0x502c38
push esp
jmp 0x502933
ret
invalid
jne 0x502d0f
jmp 0x50257b
dec eax
jmp 0x50251a
call dword [0x50623d]
jmp 0x5026fe
Function at 0x50214a
Capabilities:
Parse pe header

Disassembly:
pop eax
jmp 0x5025f1
cmp word [eax + ecx], dx
jmp 0x502610
sub esp, 0x20
jmp 0x502386
call 0x50214a
scasd eax, dword es:[edi]
xchg dword [esp], edi
lea edi, [edi + 0x71b]
xchg dword [esp], edi
jmp 0x502863
dec eax
jmp 0x5027d8
push ebp
jmp 0x50275b
jmp 0x5026fe
push dword [ebp + 8]
jmp 0x502d21
lahf
jg 0x5022db
xchg byte [ecx], ah
add eax, 0xbe90000
or byte [eax], al
add byte [ebx], al
imul ecx
push edx
pop es
add byte [eax], al
in eax, 0x33
fucomi st(1)
dec ebx
or al, byte [eax]
add bl, bh
stosd dword es:[edi], eax
mov eax, dword [esp + 4]
jmp 0x502708
push edi
js 0x502350
jns 0x502350
mov ah, 0xf4
scasd eax, dword es:[edi]
jge 0x5022c9
ret
jmp 0x502ca2
cmp word [eax], 0x5a4d
jmp 0x502b33
call 0x502357
mov ebx, 0x24148793
lea edx, [edx - 0xb8]
xchg dword [esp], edx
jmp 0x502433
mov dword [0x506239], 1
jmp 0x5021b1
cmp dword [0x506239], 0
jmp 0x5026ba
call 0x502439
cmp al, 0x87
sbb al, 0x24
lea ebx, [ebx - 0x3bb]
xchg dword [esp], ebx
jmp 0x50207d
and eax, 0xffff0000
jmp 0x502a24
mov ecx, dword [eax + 0x3c]
jmp 0x5026cf
inc eax
jmp 0x502171
jne 0x502d0f
jmp 0x502305
jne 0x5021f1
jmp 0x50236a
mov edx, 0x4550
jmp 0x5020c4
push ebx
jmp 0x502890
inc eax
jmp 0x502d0f
mov ebp, esp
jmp 0x502127
xor ax, ax
jmp 0x50230b
pushal
jmp 0x502c31
push esi
jmp 0x5022fc
call 0x50293a
cmp edx, ebx
xchg dword [esp], edx
lea edx, [edx - 0x899]
xchg dword [esp], edx
jmp 0x502198
mov ecx, 0x5a4d
jmp 0x502abf
cmp word [eax], cx
jmp 0x502ccd
jne 0x502171
jmp 0x502c38
push esp
jmp 0x502933
ret
invalid
jne 0x502d0f
jmp 0x50257b
dec eax
jmp 0x50251a
call dword [0x50623d]
jmp 0x5026fe
Function at 0x50293a
Capabilities:
Parse pe header

Disassembly:
pop eax
jmp 0x5025f1
cmp word [eax + ecx], dx
jmp 0x502610
sub esp, 0x20
jmp 0x502386
call 0x50214a
scasd eax, dword es:[edi]
xchg dword [esp], edi
lea edi, [edi + 0x71b]
xchg dword [esp], edi
jmp 0x502863
dec eax
jmp 0x5027d8
push ebp
jmp 0x50275b
jmp 0x5026fe
push dword [ebp + 8]
jmp 0x502d21
lahf
jg 0x5022db
xchg byte [ecx], ah
add eax, 0xbe90000
or byte [eax], al
add byte [ebx], al
imul ecx
push edx
pop es
add byte [eax], al
in eax, 0x33
fucomi st(1)
dec ebx
or al, byte [eax]
add bl, bh
stosd dword es:[edi], eax
mov eax, dword [esp + 4]
jmp 0x502708
push edi
js 0x502350
jns 0x502350
mov ah, 0xf4
scasd eax, dword es:[edi]
jge 0x5022c9
ret
jmp 0x502ca2
cmp word [eax], 0x5a4d
jmp 0x502b33
call 0x502357
mov ebx, 0x24148793
lea edx, [edx - 0xb8]
xchg dword [esp], edx
jmp 0x502433
mov dword [0x506239], 1
jmp 0x5021b1
cmp dword [0x506239], 0
jmp 0x5026ba
call 0x502439
cmp al, 0x87
sbb al, 0x24
lea ebx, [ebx - 0x3bb]
xchg dword [esp], ebx
jmp 0x50207d
and eax, 0xffff0000
jmp 0x502a24
mov ecx, dword [eax + 0x3c]
jmp 0x5026cf
inc eax
jmp 0x502171
jne 0x502d0f
jmp 0x502305
jne 0x5021f1
jmp 0x50236a
mov edx, 0x4550
jmp 0x5020c4
push ebx
jmp 0x502890
inc eax
jmp 0x502d0f
mov ebp, esp
jmp 0x502127
xor ax, ax
jmp 0x50230b
pushal
jmp 0x502c31
push esi
jmp 0x5022fc
call 0x50293a
cmp edx, ebx
xchg dword [esp], edx
lea edx, [edx - 0x899]
xchg dword [esp], edx
jmp 0x502198
mov ecx, 0x5a4d
jmp 0x502abf
cmp word [eax], cx
jmp 0x502ccd
jne 0x502171
jmp 0x502c38
push esp
jmp 0x502933
ret
invalid
jne 0x502d0f
jmp 0x50257b
dec eax
jmp 0x50251a
call dword [0x50623d]
jmp 0x5026fe
Function at 0x41cf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x41cf7f
pop dword [ebp - 0x14]
mov eax, 0x41cf7f
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3fe6e
push 0
mov eax, 0xacfd6544
sub eax, 0xacbb132c
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x2fa8d383
sub ecx, 0x2fa882ec
mov esi, eax
mov edx, 0x1a1e7442
sub edx, 0x19db2042
add edx, dword [ebp - 0x14]
mov ebx, 0x1d836459
sub ebx, 0xc56cc26f
add dword [ebp - 0xc], 0xd10c2310
mov edi, dword [edx]
add dword [ebp - 8], ecx
xor edi, ebx
mov dword [esi], edi
xor dword [ebp - 4], eax
add esi, 4
add edx, 0x9b4df2ad
sub edx, 0x9b4df2a9
loop 0x41cfd9
add eax, 0xd028554e
add eax, 0x2fd8dfe1
mov ebx, eax
add eax, 5
mov ecx, 0x2ba4382c
add ecx, 0xd49bc7d4
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x12fd1ebf
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x21a125e
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403473
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0xc6ad9c], 0x594
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x4034b8
push 0x402b40
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push 0x402b6c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x805d28]
mov ebx, dword [0x805d2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.0040346c
mov eax, dword [0x805d30]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x805d34]
add edi, 0x23f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0xc6ad9c], 0xc
mov dword [ebp - 4], ecx
jne 0x403559
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x444]
push eax
push esi
push 0x402b7c
push 0x402b8c
push 0x402bac
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
add dword [ebp - 4], ecx
mov ecx, dword [0xc6ad9c]
cmp ecx, 0xfa9
jne 0x403577
mov dword [0xc6ad98], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x403585
mov dword [0xc43f38], esi
lea ecx, [edi + eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
shr eax, cl
mov dword [0xc6ad94], 0xf4ea3dee
add eax, dword [ebp - 0x1c]
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0xc6ad9c], 0x213
mov dword [ebp - 0x14], ecx
jne 0x4035c3
push esi
push 0x402bb4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0xc6ad9c], 0xc
jne 0x40360c
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0xc44]
push eax
push 0x402bf0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [edi + eax]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
add edi, 0x61c88647
dec dword [ebp - 0x18]
jne 0x4034f1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x403657
Capabilities:
Create pipe
Get common file path
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.0040bbb0
mov eax, dword [0xc6ad9c]
mov ecx, dword [0xc43f3c]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403754
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0xc6ad9c], 0x959
jne 0x403742
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
push esi
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402cb0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x402d00
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402d40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x1030]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00403473
add ebx, 8
dec dword [ebp - 4]
jne 0x403684
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40551b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8054b4]
jne 0x405525
repz ret
jmp fcn.00408d8c

Function at 0x40abab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406b36
and dword [ebp - 4], 0
cmp dword [0x809828], 0
mov ebx, eax
jne 0x40ac5c
push 0x4021ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ad0d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021a0
push edi
call esi
test eax, eax
je 0x40ad0d
push eax
call fcn.00406ac4
mov dword [esp], 0x402190
push edi
mov dword [0x809828], eax
call esi
push eax
call fcn.00406ac4
mov dword [esp], 0x40217c
push edi
mov dword [0x80982c], eax
call esi
push eax
call fcn.00406ac4
mov dword [esp], 0x402160
push edi
mov dword [0x809830], eax
call esi
push eax
call fcn.00406ac4
pop ecx
mov dword [0x809838], eax
test eax, eax
je 0x40ac5c
push 0x402148
push edi
call esi
push eax
call fcn.00406ac4
pop ecx
mov dword [0x809834], eax
mov eax, dword [0x809834]
cmp eax, ebx
je 0x40acb4
cmp dword [0x809838], ebx
je 0x40acb4
push eax
call fcn.00406b3f
push dword [0x809838]
mov esi, eax
call fcn.00406b3f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40acb4
test edi, edi
je 0x40acb4
call esi
test eax, eax
je 0x40acab
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40acab
test byte [ebp - 0xc], 1
jne 0x40acb4
or dword [ebp + 0x10], 0x200000
jmp 0x40aced
mov eax, dword [0x80982c]
cmp eax, ebx
je 0x40aced
push eax
call fcn.00406b3f
pop ecx
test eax, eax
je 0x40aced
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40aced
mov eax, dword [0x809830]
cmp eax, ebx
je 0x40aced
push eax
call fcn.00406b3f
pop ecx
test eax, eax
je 0x40aced
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x809828]
call fcn.00406b3f
pop ecx
test eax, eax
je 0x40ad0d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ad0f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ba7a4
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x4a556f
pushfd
or dword [esp], reloc.SHLWAPI.dll_PathFindFileNameA
popfd
cpuid
nop
jmp 0x4a5586
pop ebx
ret
lea esp, [esp + 4]
call fcn.004ba70e
mov cl, 0x28
mov esi, 0xd99d28d9
inc ebp
aad 0xbc
dec edi
sti
je 0x4ba822
mov ds, word [ecx]
js 0x4ba81f
lea esp, [esp + 0x20]
jmp 0x4a5563

Function at 0x5a9366
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 2
push dword [esp + 5]
jmp 0x5a93d9
push dword [esp + 8]
push word [esp + 9]
xchg byte [esp], al
inc cx
lea esi, [ebx + esi]
xchg word [esp + 5], si
jmp 0x5a9393
setae dh
mov dword [esp + 6], ebp
mov di, word [esp + 6]
mov bh, byte [esp + 6]
btr ebp, esp
xchg dword [esp + 2], esi
jmp 0x5a93ba

Function at 0x5a9517
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5a9550
pop bx
neg ch
add esp, 3
rcl di, cl
btr edx, esp
mov bx, di
add esp, 9
bswap edx
inc ebx
mov dword [esp + 7], esi
lea esp, [esp + 9]
not bh
jmp 0x5a9519

Function at 0x5a96b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg di, ax
push dword [esp + 2]
mov bl, bh
sub esp, 0xc
mov al, 0x26
mov bh, byte [esp + 0x13]
jmp 0x5a9717
mov al, 0x7e
mov ax, sp
xchg byte [esp + 2], al
lea ebx, [esi - 0xc5]
mov ebp, eax
jmp 0x5a969c
Function at 0x5a993d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0xb4
push word [esp + 1]
not bh
mov dl, 0x44
mov ebp, eax
sub esp, 2
jmp 0x5a9985
lea ebp, reloc.SHLWAPI.dll_PathFindFileNameA
rdtsc
lea edi, [edx*4]
jmp 0x5a9927
lea esp, [esp + 3]
bswap edi
pop ebx
add esp, 3
bsf di, si
pop word [esp]
jmp 0x5a9a34
mov ax, sp
mov si, word [esp + 0xb]
mov byte [esp + 7], bh
mov ebx, ebp
shr bh, 3
add esp, 0x10
jmp 0x5a9969
lea ebx, [esi + 0x9d]
mov edx, esi
call 0x5a99d4
push ds
call fcn.005a9a1d
clc
mov esi, 0xc8a8eb6e
mov ax, 0x99ef
ror eax, 3
mov dl, dh
jmp 0x5a9a07
mov ebx, dword [esp + 4]
mov cx, 0xe4af
sub esp, 0x1a
push dword [esp + 0x10]
cmc
push dword [esp + 0x2b]
jmp 0x5a99c6
push dword [esp + 2]
mov al, 6
mov dh, byte [esp + 0xa]
lea ebp, [eax + edx]
mov bp, sp
jmp 0x5a9e4c
rdtsc
add esp, 2
not bp
cpuid
sub esp, 0x10
mov cx, di
jmp 0x5a99f1
xchg dx, bx
lea edi, [ebp + 0x2f]
mov di, word [esp + 0x27]
lea esp, [esp + 0x1f]
call fcn.005a9a5c
jmp 0x5a9be1
xchg byte [esp], al
bsf cx, si
mov ebx, esi
pop bx
mov edi, 0xa6ac8088
mov ebp, dword [esp + 5]
jmp 0x5a9bca
setae ch
inc cx
pop dword [esp]
mov di, dx
xchg byte [esp + 8], dl
setg ah
call 0x5a9b41
push eax
popal
je 0x5a9bc2
insb byte es:[edi], dx
je 0x5a9b83
mov si, word [esp + 0xa]
xchg si, ax
mov bl, bh
mov dl, 0xb4
cpuid
setae ah
jmp 0x5a9b65
add byte [esi - 0x22], bl
dec esp
sub esp, esi
pop es
scasd eax, dword es:[edi]
pushal
mov word [esp + 0xc], sp
popal
xchg word [esp + 7], bp
call fcn.005a9baf
mov dh, 0xa1
loopne 0x5a9c02
pop edx
mov ch, 0x86
push esp
and al, 4
xchg byte [esp + 4], dl
mov dword [esp + 9], eax
mov byte [esp + 0xa], dh
cpuid
bswap edx
mov byte [esp + 8], ch
jmp 0x5a9b46
shl dword [esi - 0x75], 1
inc esp
and al, 8
push word [esp + 3]
bsf cx, ax
lea ebp, [ebp*4]
jmp 0x5a9b83
lea esp, [esp + 0xc]
pop edi
mov bx, 0xa97d
pushal
lea ecx, [edx + ebx]
setbe ch
jmp 0x5a9b2d

Function at 0x5a9c1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr bp, bp
inc si
xchg ch, dl
mov eax, dword [esp + 0xa]
rdtsc
jmp 0x5a9c45

Function at 0x5a9e9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub dx, 0x7428
add esp, 0x19
mov bx, word [esp + 5]
mov bl, bh
pop si
btc ebp, ebx
jmp 0x5a9ec4
mov dword [esp + 1], ebp
xchg dh, al
rdtsc
pop ebx
mov word [esp + 0xe], dx
mov dl, 0x24
jmp 0x5a9e61
mov dword [esp + 0xd], ecx
sub esp, 4
pop bp
push edx
not edx
jmp 0x5a9e86
lea ebp, [edi*4]
btc edi, ebx
pop eax
neg bx
add esp, 1
jmp 0x5a9eed
lea ebp, [eax + 0x29]
clc
and cl, bh
mov dword [esp + 1], ebp
mov dx, 0x8be3
xchg ch, dl
jmp 0x5a9eac
Function at 0x5aca13
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dx
jmp 0x5aca1c
mov eax, 0xdf4f0a70
mov esi, ecx
lea eax, [ecx + edx]
mov esi, 0x6f4c0de6
mov dh, byte [esp + 0x1f]
jmp 0x5aca6c
xchg word [esp + 3], si
ror ax, cl
btc edx, ebx
pushal
lea esp, [esp + 0x4d]
xchg ah, dh
jmp 0x5acc29
lea eax, [edx + edx]
and dx, 0xb19a
mov dh, byte [esp + 0xc]
xchg byte [esp + 0x1a], dl
inc edx
jmp 0x5aca43
mov dx, word [esp]
stc
mov si, word [esp]
rdtsc
setg dh
jmp 0x5acb0c
lea esi, [ecx + 0x1b]
rdtsc
bt eax, esp
inc edx
mov esi, 0x2d6ced58
mov dh, byte [esp]
jmp 0x5aca98
mov si, 0x4ce5
lea eax, [ecx - 0x7b]
xchg esi, eax
rdtsc
btc edx, esp
neg esi
jmp 0x5acaae
bsf dx, si
mov dx, word [esp]
not dh
inc al
mov dword [esp], ecx
bswap eax
jmp 0x5acb3c
rdtsc
mov dx, cx
lea eax, [edx + edi]
rdtsc
cld
push edx
jmp 0x5acad9
mov dx, word [esp]
rdtsc
mov edx, 0x4bd3d1c2
sub eax, ebp
mov edx, 0x2aa25894
xchg si, ax
jmp 0x5acaf4
pop eax
bsf si, ax
mov al, ah
mov dh, 0x5a
mov al, byte [esp]
mov ax, di
jmp 0x5acb95
shr ah, 1
push dword [esp]
mov dword [esp + 3], eax
xchg dh, dl
lea eax, [esi*4]
pop dword [esp]
jmp 0x5acb23
mov esi, dword [esp + 3]
xchg dword [esp], eax
bsr si, bp
bsf ax, si
pop esi
bsr dx, cx
jmp 0x5acac7
mov si, bx
mov ax, 0x217
rdtsc
neg eax
dec ax
neg eax
jmp 0x5acc0c
mov dl, byte [esp]
rdtsc
setns dh
lea esi, reloc.SHLWAPI.dll_PathFindFileNameA
btr eax, edi
rdtsc
jmp 0x5acb7f
mov dx, word [esp]
inc dx
mov ax, word [esp]
push edx
mov ax, 0xfc8d
mov dh, 0x1a
jmp 0x5acb66
mov eax, dword [esp]
clc
mov dh, byte [esp]
bswap eax
bt eax, edx
mov edx, 0x8f799b2a
jmp 0x5acd59
mov dl, 0x24
rdtsc
mov ax, word [esp]
rcr edx, 0xd
lea edx, [edx + edi]
dec si
jmp 0x5acbc7
not eax
setae ah
rdtsc
lea eax, [ecx*4]
mov al, byte [esp]
bswap eax
jmp 0x5acbeb
not ax
mov ax, bp
btc edx, ebx
mov esi, dword [esp]
mov si, 0x5a59
lea edx, reloc.SHLWAPI.dll_PathFindFileNameA
jmp 0x5acbb4
mov dword [esp], eax
lea esi, [ebx + esi]
add esp, 2
call fcn.005accc8
leave
dec eax
fidivr word [ecx - 0x6b9a55b8]
pop es
scasb al, byte es:[edi]
mov ecx, 0x4605d8c1
rcr eax, 5
inc esi
mov word [esp + 2], dx
mov ax, word [esp + 4]
lea esp, [esp + 3]
mov esi, esp
jmp 0x5acc44
mov si, word [esp + 4]
add al, dh
ror ah, 1
cld
mov word [esp], sp
clc
jmp 0x5acc5d
rdtsc
push dword [esp + 2]
shr ah, 1
mov eax, esp
mov ah, byte [esp + 1]
bswap esi
jmp 0x5acc77
bsr dx, cx
mov eax, dword [esp]
push esp
cld
mov word [esp], dx
bswap edx
jmp 0x5acc95
adc si, 0xfe3c
shr dh, 7
btr esi, esp
mov dh, byte [esp]
neg si
xchg dh, al
jmp 0x5accdf