joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b950
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49b113
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0048ba6f
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004911e7
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00492782
test eax, eax
je 0x44ba6c
mov ecx, dword [esp + 0x3c]
call fcn.00491214
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x44ba30
push edi
mov ecx, esi
call fcn.0048e7cd
mov ecx, esi
call fcn.0044bc10
cmp dword [esp + 0x38], 1
jne 0x44ba65
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0048e937
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x44dc70
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44dca3
push esi
call fcn.0045c010
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44dc9c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44dd29
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44dd12
mov eax, dword [esi + 8]
test eax, eax
je 0x44dcc7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44dd0e
cmp eax, 2
je 0x44dd12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44dcba
cmp eax, 3
je 0x44dced
cmp eax, 1
jne 0x44dcba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44dcba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44dcba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044dd50
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44dd38
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044dd50
add esp, 4
pop esi
ret

Function at 0x44e5c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x44e5e1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x44e5e1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44e5e1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x469340
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4693e3
test eax, eax
jbe 0x4693e3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4693e3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46938e
xor esi, esi
jmp 0x469394
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4693bf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00403df0
add esi, eax
push esi
mov ebx, esi
call fcn.00403df0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4693a0
pop ebp
test edi, edi
pop edi
jne 0x4693e3
test ebx, ebx
je 0x4693e3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0047a2e0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x469505
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46961d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46961d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048bec1
mov esi, eax
test esi, esi
je 0x46961d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46961d
mov ecx, esi
call fcn.00469490
cmp edi, eax
jge 0x46961d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4695a3
mov dword [esp + 0x34], 1
jmp 0x4695fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46961d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00468a60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46b450
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x46b4b6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x46b4b6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x46b497
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x46bff0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0046c140
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x46c010
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x46bff1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0046c140
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x46c010
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x46c040
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x46c097
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x46c0ad
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.0046c0d0
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x46c0d0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x46c160
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x46c1a9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x46c620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49b8b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0046c1d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0046c250
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0046c250
lea ecx, [esi + 0xc]
call fcn.0048a35f
lea ecx, [esi + 0x10]
call fcn.0048a35f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0046ea80
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0046ea80
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0046ea80
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0048a3d4
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048a3d4
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x46d2c8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49bad8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x46d2d8
call fcn.0046d7f0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x46d3bb
cmp byte [edi], 0
je 0x46d3bb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x46d2fd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0046bff0
test eax, eax
jne 0x46d31d
push 0x54d7a0
lea ecx, [esi + 0x38]
call fcn.0048a55d
jmp 0x46d3bb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0046c040
test eax, eax
jne 0x46d34c
mov ecx, esi
call fcn.0046c140
push edi
add esi, 0x38
push 0x54d77c
push esi
call fcn.00487d6a
add esp, 0xc
jmp 0x46d3bb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0046e070
test eax, eax
je 0x46d3b4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0046d490
test eax, eax
jne 0x46d3d0
push edi
lea eax, [esi + 0x38]
push 0x54d758
push eax
call fcn.00487d6a
add esp, 0xc
mov ecx, esi
call fcn.0046d7f0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x46d478
mov ecx, dword [0x54e648]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00487d6a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0046c0f0
test eax, eax
jne 0x46d43a
push 0x54d73c
lea ecx, [esi + 0x38]
call fcn.0048a55d
jmp 0x46d44a
push 0xfa
mov ecx, esi
call fcn.0046e070
test eax, eax
jne 0x46d467
mov ecx, esi
call fcn.0046d7f0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0048a3d4
jmp 0x46d3bb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0048a3d4
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x48c864
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48c89c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048a87b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048a853
jmp 0x48c8a8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48df56
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48df98
call fcn.00493d43
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48df98
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48df8f
xor eax, eax
jmp 0x48dfa0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048dfa6
pop edi
pop esi
pop ebx
ret 4

Function at 0x494273
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4942a1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4942bf
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004941d9
jmp 0x4942bf
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4942bf
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004941d9
test edi, edi
mov eax, edi
jne 0x4942a9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x59acff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x2c]
jne 0x5cc920
cmp dl, bl
test ch, dl
cmp dword [ebp + 0x14], 4
pushfd
lea esp, [esp + 4]
je 0x5c8522
movsx ax, bl
pushal
lahf
mov eax, 0xc0000001
pushal
pushfd
lea esp, [esp + 0x44]
jmp fcn.005bc7a1
pushfd
pushfd
jmp 0x59bebf
mov byte [esp + 4], bh
call fcn.005ca5a9
mov dword [esp], 0x1b85f60b
lea esp, [esp + 0x50]
je 0x5ac42e
jb 0x5c8560
or dh, dh
shr dh, cl
mov edx, dword [ebp - 0x58]
bt eax, ebp
pushal
jmp 0x5c6e5b
cmp dl, cl
cmp dword [edx], 0
pushal
pushfd
jmp 0x5c99c6
stc
pushal
lea ecx, [0xbce6cc06]
xadd edx, ecx
mov ecx, dword [ebp + 0x10]
rcl dl, cl
add dl, 0x3c
mov dword [ebp - 0x18], ecx
push edx
movsx dx, bl
shrd dx, ax, cl
mov edx, dword [ebp - 0x18]
jmp 0x5b8b2e
shld edx, ebp, 8
mov edx, dword [ebp - 0x58]
pushal
pushal
stc
cmp dword [edx], 0
pushfd
pushfd
pushfd
call fcn.005c59c1
lea esp, [esp + 0x44]
je 0x5ac42e
sbb al, 0xdd
setne ah
rol ah, cl
sal ah, cl
mov eax, dword [ebp - 0x58]
cmp eax, 0xc1534bd
stc
cmp eax, dword [ebp - 0x54]
pushal
lea esp, [esp + 0x20]
je 0x5aaa75
pushal
lea esp, [esp + 0x20]
jb 0x5abe44
push 0x64d5ff10
push 0xe12a07da
pushfd
lea esp, [esp + 0xc]
jmp 0x5ac42e
push esi
cmp cx, 0x207e
jmp 0x5c4594

Function at 0x59b6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap cx
pushfd
lahf
mov eax, dword [ebp - 0x3c]
movzx cx, bl
push 0x2c849ba
sets ch
mov dword [edx + 0x18], eax
lea ecx, [ecx*4 - 0x6d9b3708]
lea edx, [ebx + 0x7785b695]
mov ecx, dword [ebp + 8]
xchg dx, ax
setge dh
movzx dx, cl
mov edx, dword [ebp - 0x38]
movsx ax, dl
cwde
mov dword [ecx + 0x1c], edx
lea eax, [edi + 0x4684c060]
lahf
xchg cl, al
mov eax, dword [ebp + 8]
pop ecx
sets ch
mov ecx, dword [ebp - 0x34]
mov byte [esp], dh
mov dword [eax + 0x20], ecx
mov word [esp], 0x3770
pushfd
mov byte [esp + 8], 0x54
lea esp, [esp + 0x3c]
jmp 0x5a6ca0
lea edx, [ecx*8 - 0x2c7f6aa4]
mov edx, dword [ebp + 8]
pushfd
lea esp, [esp + 4]
jmp fcn.005bf993
Function at 0x59c031
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
je 0x5a3ea9
aaa
bsf dx, dx
mov eax, edi
bsr ax, si
mov ecx, dword [ebp - 0x44]
ror al, 6
add ecx, dword [ebp - 0x40]
push 0xafda026b
bswap edx
mov dword [ebp - 0x48], ecx
lea esp, [esp + 4]
dec ebp
mov esp, 0x306c8c0
dec ebp
shr byte [eax + 0x6b], 2
fisubr dword [edi + 0x4d89ca0f]
mov eax, 0x424648d
ja 0x5a5ed8
lahf
mov edx, dword [ebp - 0x24]
call fcn.005bd568
adc edi, dword [edx - 0x77]
rcr byte [edx], cl
mov dword [0xdb74a376], eax
insb byte es:[edi], dx
mov eax, dword [ebx + ebp*4 + 0x54]
scasd eax, dword es:[edi]
push esp
sub byte [ecx + 0x1bc8df92], ch
mov byte [esi - 0x31], cl
salc
fcom dword [ebx]
pop ds
jae 0x59c058
js 0x59c047
lds esi, [ebx + ebp*4]
adc al, 0xb3
insb byte es:[edi], dx
wait
insb byte es:[edi], dx
push edi
inc esp
mov al, 0x4c
mov eax, 0x647f3d0c
mov ebp, 0x41631763
inc eax
mov dh, 0x33
inc ebp
pop ebx
fcmove st(0), st(2)
xchg byte [edi + ebp*4], bh
push esi
fisubr dword [ecx + 0x58cb4c39]
cmpsb byte [esi], byte es:[edi]
arpl word [edx - 0x16], di
rcr dword [ebx], cl
jae 0x59c0e4
push ds
pop ebx
fstpnce st(6), st(0)
push ss
jmp 0x59c10e
mov esp, 0x76f7b15f
sub bl, byte [ebp + ebp*2 - 0x4b2f68b1]
dec ebp
outsd dx, dword [esi]
mov esi, 0x971e62be
and ebp, dword [edx + 0x1aefaf41]
jmp 0xf4d6d598
test eax, 0xdc7fba2c
push ebx
fcom dword [ebx - 0x19]
push ds
and eax, 0xe5def1dd
insb byte es:[edi], dx
in eax, dx
salc
sub eax, 0x778203a8
ret
lea eax, [edi - 0x6a0cfaee]
rdtsc
rdtsc
mov edx, dword [ebp - 0x24]
call fcn.0059c6d4
pushfd
mov dword [ebp - 0x18], 3
lea esp, [esp + 4]
movzx cx, al
mov ecx, dword [ebp - 0x34]
push 0xdeb5803b
mov dword [esp], ecx
call fcn.005aad27
jmp 0x5a2717

Function at 0x59c6b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi - 0x20f3b566]
call fcn.0059adf8

Function at 0x5a0a7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [eax + 0x20], ecx
mov byte [esp], dl
lea esp, [esp + 0x60]
jmp 0x5a6ca0
Function at 0x5a5f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg dword [esp + 0x2c], eax
call fcn.005b2fac
sub esp, 0x10
cwde
pushfd
lea ecx, [esp + 4]
not dl
jmp 0x59c968
mov al, bh
cdq
lea esp, [esp + 4]
mov dword [ebp - 0x5a0], esp
cdq
jmp 0x5ca248
mov dword [esp + 0x4c], ecx
pop ecx
not cx
pushfd
mov ecx, 0x5898f3
mov byte [esp + 4], bl
mov ecx, dword [ecx + 0x1d41a]
call fcn.005a3ec9
bswap ax
pushfd
lahf
nop
movzx ax, dl
mov ax, word [esp]
setl ah
lahf
mov eax, dword [esp + 4]
pushfd
xchg dword [esp + 0xc], eax
pushal
mov byte [esp + 0xc], 0x53
push dword [esp]
jmp 0x59a8dd
mov eax, dword [edx]
inc ch
movsx edx, bl
rol cx, cl
add eax, dword [ebp + 0x10]
movzx cx, cl
shld cx, cx, 8
rol dl, 3
push ecx
mov ecx, dword [ebp - 0x58]
neg dl
push edi
bsr edx, esp
mov dword [ecx], eax
bswap dx
cdq
and dx, 0x99df
rdtsc
mov edx, dword [ebp - 0x58]
dec eax
das
bts ax, di
aad 0x73
mov eax, dword [ebp - 0x58]
test ah, bh
bt si, bp
pushfd
add eax, dword [edx + 4]
pushal
jmp 0x5c5b51
test cl, al
rol ch, cl
mov ecx, dword [ebp - 0x58]
test bl, bl
stc
cmc
pushal
cmp dword [ecx + 4], 0
jmp 0x5b7889
pushal
lea esp, [esp + 0x40]
je 0x5ac42e
rcr edx, 0xd
bswap dx
pushal
mov edx, dword [ebp - 0x58]
push 0xcc83aed2
call fcn.005b22a5
rcr dl, cl
adc dl, al
bts dx, 5
mov dword [ecx + 0x14], eax
adc ch, dh
mov ecx, dword [ebp - 0x24]
movsx ax, bl
mov edx, dword [ebp - 0x24]
das
mov eax, dword [ecx + 0x10]
test sp, sp
cmp eax, dword [edx + 8]
pushal
pushal
lea esp, [esp + 0x40]
jbe 0x5b8ba4
jmp 0x5bdd23
mov cl, 0x62
pushfd
movzx ecx, dl
mov eax, dword [ebp - 0x24]
seto cl
mov ecx, dword [eax + 8]
lahf
bswap dx
movsx dx, al
setnp ah
mov dword [ebp - 0x8c], ecx
lea esp, [esp + 4]
cwde
mov edx, dword [ebp - 0x8c]
xchg cx, ax
bswap ax
mov dword [ebp - 0x50], edx
lahf
rdtsc
lea eax, [eax*8 + 0x38419f3e]
lahf
mov eax, dword [ebp - 0x34]
movzx cx, cl
bswap cx
jmp 0x5c0325
pushal
call fcn.005aeba9
call fcn.0059f7e1
call fcn.005c165a
xchg dword [esp + 0x50], ecx
jmp 0x5a42d4
mov word [esp], bx
mov byte [esp], 0x19
mov dword [ebp - 0x58], eax
pushfd
lea esp, [esp + 0x34]
jmp 0x5ac23e
lea edx, [ebp - 0x5a4]
lea eax, [eax*8 + 0x294dcb0c]
push edx
cwde

Function at 0x5a83c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [0x592900], eax
movzx eax, cl
movzx dx, bl
mov ecx, dword [ebp - 0x10]
rol edx, cl
rdtsc
rdtsc
stc
imul ecx, ecx, 0x28
rol al, cl
bt bp, 1
mov word [esp + 8], ax
lea edx, [ebx - 0x1021c938]
mov edx, dword [ebp - 8]
mov ax, 0xb53b
movsx ax, bl
mov eax, dword [0x592900]
stc
cmp dh, 6
add eax, dword [edx + ecx + 8]
push ebx
jmp 0x59c68f

Function at 0x5aaf55
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x5ae323
and dh, bl
xadd ch, dl
mov edx, dword [ebp - 0x38]
shrd ax, bx, 6
bsf cx, ax
add edx, dword [ebp - 0x20]
mov eax, esp
bswap ax
mov al, cl
lea ecx, [edi*2 + 0x4c823c6f]
mov dword [ebp - 0x84], edx
movsx ax, cl
mov eax, dword [ebp + 0x10]
lea edx, [ebp*4 + 0x50b8aec]
mov dx, 0xefd9
setge cl
jmp 0x5bab57
push eax
movsx dx, cl
call fcn.0059c1d4
Function at 0x5ac1fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
je 0x5ac42e
xadd ecx, eax
setnp dh
cwde
mov edx, dword [ebp - 0x38]
bswap ax
add edx, dword [ebp - 0x30]
test dh, bl
xadd cl, al
shl ax, 6
mov dword [ebp - 0x58], edx
pushfd
not cl
shr cl, 1
rcl al, cl
mov eax, dword [ebp - 0x58]
neg cx
add eax, dword [ebp - 0x2c]
shl cl, cl
bswap cx
dec cx
mov dword [ebp - 0x54], eax
sub esp, 0xfffffffc

Function at 0x5acd9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd1f1e86b
bsr cx, si
adc ch, 0xde
mov ecx, dword [ebp - 0x80]
bt sp, dx
bt ax, 0xd
mov dword [esp + 4], 0x64b7642c
cmp dword [ecx + 0x24], 0
pushfd
lea esp, [esp + 0xc]
je 0x5cc87c
add ax, 0xcc51
mov edx, dword [ebp - 0x80]
movsx ax, dl
aam 0xb7
pushfd
shrd ax, bp, 4
mov eax, dword [edx + 0x24]
sal cl, cl
xadd ch, dl
shrd dx, si, 5
add dl, 0xe8
add eax, dword [ebp + 0x10]
rcl ecx, 0x1f
shrd cx, sp, 1
bsr edx, edx
mov ecx, dword [ebp - 0x80]
lea edx, [eax + 0x2b113029]
shr dx, cl
mov dword [ecx + 0x24], eax
ror ch, 6
jmp 0x5c7bd5
xor dx, 0x7b32
mov edx, dword [ebp - 0x34]
movzx ecx, bl
seto al
mov eax, dword [edx + 0x88]
bsf ecx, eax
and ch, ah
mov ecx, dword [edx + 0x8c]
clc
mov dword [ebp - 0x20], eax
mov byte [esp], dl
bt cx, si
mov dword [ebp - 0x1c], ecx
test bx, bx
cmp dword [ebp - 0x20], 0
call fcn.005bca3c

Function at 0x5ae0d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0x5ae323
add dl, ah
neg al
shrd dx, bx, cl
mov dx, si
mov edx, dword [ebp - 0x38]
shrd ax, bx, cl
neg ax
add edx, dword [ebp - 0x20]
sets al
setge ah
call fcn.005abc45
add byte [eax], al
add byte [eax], al
mov byte [esp], ch
jmp 0x5a7545

Function at 0x5ae2ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x20], eax
xchg cx, dx
mov ecx, dword [ebp - 0x84]
not dl
mov dword [esp + 0x1c], ecx
pushfd
pushal
mov dh, byte [esp]
mov edx, dword [ebp - 0x84]
push dword [esp + 4]
mov dword [esp + 0x40], edx
pushfd
lea esp, [esp + 0x44]
call fcn.0058e0cf
pushfd
clc
add esp, 0x10

Function at 0x5b0caa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor cl, bh
mov dword [edx + 0x18], eax
stc
xor cl, bh
rcl dl, 7
mov ecx, dword [ebp + 8]
btc ax, dx
setbe dl
dec dh
mov edx, dword [ebp - 0x38]
pushfd
neg al
stc
mov dword [ecx + 0x1c], edx
neg cl
xor ah, 0x30
btc ax, di
stc
mov eax, dword [ebp + 8]
setae ch
stc
push dword [esp]
mov ecx, dword [ebp - 0x34]
push ebp
sub dh, cl
mov dword [eax + 0x20], ecx
rcr edx, cl
cwde
bsf dx, ax
mov edx, dword [ebp + 8]
bsr cx, dx
xor ch, ah
mov eax, dword [ebp - 0x30]
btr cx, si
lea ecx, [ebp + 0x63b3871a]
mov dword [edx + 0x24], eax
dec cl
cwde
inc dh
mov ecx, dword [ebp + 8]
bsr edx, ecx
lea edx, [ecx + 0x5fca69e6]
not dx
lahf
mov edx, dword [ebp - 0x2c]
neg ax
seta ah
movsx ax, al
jmp 0x5c7945