joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438880
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47f448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00476437
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00438220
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00476365
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00472b4f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00472b4f
push 1
push 0
push 0
mov ecx, esi
call fcn.00472af7
push 1
push 0
push 1
mov ecx, esi
call fcn.00472af7
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004764a9
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x438a00
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47f468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00476437
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00438220
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00476365
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x438ac4
cmp dword [esp + 0x40], 1
jne 0x438ac2
cmp ecx, eax
jge 0x438ac4
mov eax, ecx
cmp eax, 0xc8
jge 0x438ad0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00438880
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004764a9
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x439250
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47f4d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00470f70
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004766df
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00477c37
test eax, eax
je 0x43936c
mov ecx, dword [esp + 0x3c]
call fcn.0047670c
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x439330
push edi
mov ecx, esi
call fcn.00473cce
mov ecx, esi
call fcn.004394d0
cmp dword [esp + 0x38], 1
jne 0x439365
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00473e38
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43bd90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43bdc3
push esi
call fcn.0043eea0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43bdbc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43be49
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43be32
mov eax, dword [esi + 8]
test eax, eax
je 0x43bde7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43be2e
cmp eax, 2
je 0x43be32
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43bdda
cmp eax, 3
je 0x43be0d
cmp eax, 1
jne 0x43bdda
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43bdda
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43bdda
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043be70
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43be58
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043be70
add esp, 4
pop esi
ret

Function at 0x4492e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x449383
test eax, eax
jbe 0x449383
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x449383
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44932e
xor esi, esi
jmp 0x449334
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44935f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00402220
add esi, eax
push esi
mov ebx, esi
call fcn.00402220
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x449340
pop ebp
test edi, edi
pop edi
jne 0x449383
test ebx, ebx
je 0x449383
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00460460
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4494c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4495dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4495dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004713c2
mov esi, eax
test esi, esi
je 0x4495dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4495dd
mov ecx, esi
call fcn.00449430
cmp edi, eax
jge 0x4495dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x449563
mov dword [esp + 0x34], 1
jmp 0x4495be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4495dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004489d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x452030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x45207c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x45207c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x452066
push eax
call ebp
test ax, ax
jl 0x452074
inc esi
add edi, 4
cmp esi, 6
jb 0x452058
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00451d30
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x455de0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x455e40
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x455e40
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x455e40
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x455e40
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x455e50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x471d65
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x471d9d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046fe19
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046fdf1
jmp 0x471da9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x473457
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x473499
call fcn.004792c9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x473499
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x473490
xor eax, eax
jmp 0x4734a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004734a7
pop edi
pop esi
pop ebx
ret 4

Function at 0x4797f9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x479827
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x479845
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047975f
jmp 0x479845
mov eax, dword [esi + 0x14]
test eax, eax
je 0x479845
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047975f
test edi, edi
mov eax, edi
jne 0x47982f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x406a0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a30
xor eax, eax
test eax, eax
je 0x406a43
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a43
xor ecx, ecx
jmp 0x406a46
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b69
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5e2c], 0
push esi
jne 0x406ba0
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b7a
mov dword [ecx*4 + 0x7a5e28], eax
inc ecx
cmp ecx, 0x100
jl 0x406b75
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bd1
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a5e28]
xor eax, esi
inc ecx
dec edx
jne 0x406bb3
pop edi
not eax
pop esi
ret 0xc
Function at 0x10009170
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000933d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x1000919a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100091a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10009190
mov eax, 1
add ebx, ebx
jne 0x100091b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100091a8
jne 0x100091c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100091a8
xor ecx, ecx
sub eax, 3
jb 0x100091d8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000924a
mov ebp, eax
add ebx, ebx
jne 0x100091e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100091f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10009214
inc ecx
add ebx, ebx
jne 0x10009200
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100091f5
jne 0x10009211
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100091f5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10009234
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10009225
jmp 0x10009196
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10009234
add edi, ecx
jmp 0x10009196
pop esi
mov edi, esi
mov ecx, 0x73
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10009252
cmp byte [edi], 1
jne 0x10009252
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10009257
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x100092cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9080]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10009284
mov ecx, edi
jns 0x100092b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9084]
or eax, eax
je 0x100092c9
mov dword [ebx], eax
add ebx, 4
jmp 0x100092a1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10009300
cmp al, 0xef
ja 0x100092f3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100092d5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100092e2
mov ebp, dword [esi + 0x9088]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10009334
sub esp, 0xffffff80
jmp 0x10002b08
Function at 0x52bb54
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
lea esp, [esp + 4]
mov dword [esp + 0x38], 0
jmp 0x52c17c
je 0x52b67b
add cl, byte [ebp - 0x72f0db9c]
and al, 1
jmp 0x52c158
loope 0x52b6ea
std
test byte [edi - 0x3f], dh
cld
pushal
lea esp, [esp + 0xd]
mov word [esp + 0xc], dx
lea esp, [esp + 3]
jmp 0x52c0db
call fcn.0052bd9e
out 0x7b, al
jmp 0x52b655
sahf
pop ds
xchg cx, ax
adc al, ch
inc ebp
or dword [eax], eax
add byte [eax + 0x11e28717], al
ficomp dword [esi]
mov byte [esi], bl
jns 0x52b687
cmp eax, 0xee47d4a5
stc
neg ax
rdtsc
jmp 0x52bbfc
push edx
call 0x52bb54
xchg ebp, eax
jmp 0x52bbcc
mov si, dx
mov cx, bp
mov dl, dh
jmp 0x52bb9b
mov al, byte [edx]
mov byte [esp + 0x38], al
setb cl
jmp 0x52bbad
mov edx, dword [esp + 0x3c]
rol si, cl
setb ch
lea edi, [ebp + 0xe7]
jmp 0x52bb82
movzx eax, al
mov dword [esp + 0x28], eax
jmp 0x52b82a
push word [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 0xc]
js 0x52b612
mov dl, dh
jmp 0x52bb56
rdtsc
mov esi, dword [esp]
mov ecx, dword [esp + 0x10]
call fcn.0052bbe6
bsf ax, ax
lea esp, [esp + 4]
lea eax, [ecx + ebx]
bswap edi
lea edx, [ecx*4]
jmp 0x52bc37
mov ch, byte [esp]
cdq
sub eax, edx
adc cx, 0xdfbc
jmp 0x52bca8
mov eax, dword [esp + 0x24]
mov ch, 0x8c
jmp 0x52be87
lea esi, [edi*4]
mov ecx, ebp
mov cl, ch
mov esi, eax
mov edi, 0x6d402dfc
jmp 0x52bc68
mov ch, bh
mov ecx, dword [esp]
mov dx, word [esp]
mov edx, dword [esp + 0x3c]
ror edi, 1
jmp 0x52bc80
lea ecx, [edx + ebx]
movzx ecx, byte [edi]
call fcn.0052bd06
lea esp, [esp + 2]
sub edi, edx
lea esp, [esp + 4]
jmp 0x52b6be
mov ecx, dword [eax + esi*4]
bt edi, esp
mov di, word [esp]
lea edi, [ecx + ebp]
jmp 0x52bd2b
sar esi, 1
lea edi, [edi*4]
stc
lea edi, [ecx + 0xe3]
not edi
jmp 0x52be3a
mov dword [esp + 0x10], esi
jmp 0x52b768
lea esp, [esp + 0x10]
inc esi
pushal
lea esp, [esp + 0x20]
jmp 0x52c0c4
lea esp, [esp + 0x14]
mov esi, dword [esp + 0x1c]
lea edi, [esi + 0xd]
bswap edi
mov di, word [esp]
jmp 0x52c173
mov edi, dword [esp + 0x18]
jmp 0x52b612
push esp
add esp, 3
call fcn.0052c1c0
rcl byte [esi - 0x3c]
mov dword [reloc.KERNEL32.dll_GlobalDeleteAtom], eax
pop ebx
int 0x74
out dx, al
stc
fadd dword [ebx]
sar eax, 1

Function at 0x6147c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
pop cx
bswap ebx
btc eax, edi
not bh
jmp 0x6147ed

Function at 0x614944
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [edx*4]
mov edi, 0xff63d45a
mov ebx, ebp
jmp 0x61490c
Function at 0x615074
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ax
cpuid
lea ebx, [esi + 0x7d]
mov cx, 0x9551
jmp 0x615126
not bx
push dword [esp + 8]
mov byte [esp + 0xf], dh
cld
xor ebp, esi
mov bx, word [esp + 4]
jmp 0x6150fd
pop dword [esp]
lea ebx, [esi*4]
push edx
mov cl, ch
mov cx, bx
jmp 0x6150b0
mov ecx, 0x3f1bf3e2
pop dword [esp + 2]
xchg dh, al
xchg dword [esp + 0xa], ebp
rdtsc
bswap esi
jmp 0x6150d1
xchg bx, di
bswap esi
stc
lea ecx, [ebp + 0x37]
mov bh, byte [esp + 0xb]
lea ebx, [esp + esi]
jmp 0x6151f1
xchg word [esp + 0x13], dx
mov ax, dx
mov edi, 0x9e888136
mov bl, bh
mov byte [esp + 0x18], ch
mov word [esp + 0xa], bx
jmp 0x6150e8
xchg dword [esp + 4], ebx
xchg word [esp + 6], di
mov bh, byte [esp + 2]
mov dword [esp], esi
mov esi, eax
jmp 0x6151bc
lea edx, reloc.KERNEL32.dll_GlobalDeleteAtom
push esp
pop word [esp + 4]
mov esi, ebp
setle ah
jmp 0x615140
mov byte [esp + 5], bh
btc edi, edi
pop word [esp]
push word [esp + 4]
mov word [esp + 4], bx
jmp 0x615158
xor dl, ch
xchg di, si
xchg dh, al
mov bl, bh
setno ch
mov edx, dword [esp + 2]
jmp 0x615170
xchg ebp, eax
lea esp, [esp + 3]
mov dx, word [esp]
push word [esp + 1]
sub esp, 0x1e
setbe ah
jmp 0x6151d0
mov di, word [esp + 2]
btc ebx, edi
inc cl
mov byte [esp + 1], dh
pop edi
xchg bx, di
jmp 0x6151a0
lea edi, [eax*4]
ror ebp, 5
push word [esp + 0x17]
mov edx, dword [esp + 1]
inc esi
pop dword [esp + 2]
jmp 0x6152f6
cmc
pop dword [esp + 0xc]
lea ebp, reloc.KERNEL32.dll_GlobalDeleteAtom
bsr di, cx
lea esp, [esp + 0x11]
xchg dword [esp], edx
jmp 0x61518e
cpuid
rcr ebx, 0xd
stc
mov bp, word [esp]
mov cl, ch
mov byte [esp + 4], dh
jmp 0x6152c5
mov byte [esp + 5], ah
inc edx
xchg ebx, ecx
xchg byte [esp + 3], dl
mov ax, dx
pop edx
jmp 0x615209
mov bp, di
mov al, ah
sub esp, 0x10
bswap ecx
pop dword [esp + 4]
pop si
jmp 0x615231
cpuid
mov dl, 0x4c
add cx, 0xf9ae
lea esp, [esp]
not cx
mov ax, word [esp]
jmp 0x61529f
setne bh
mov dword [esp], ecx
neg ax
mov cx, sp
sub edx, eax
mov byte [esp + 3], ch
jmp 0x615267
mov dx, 0xf835
mov dx, di
bsr bp, cx
pop word [esp]
mov al, 0xce
lea ebx, [edi + ebp]
jmp 0x6152d5
mov ax, 0x7713
mov bx, word [esp]
cld
add esp, 1
inc esi
stc
jmp 0x61528b
mov byte [esp + 1], dh
pushal
push dword [esp + 0xa]
pop bx
xchg word [esp + 0x17], cx
bsr bp, bp
jmp 0x61532f
shl cx, cl
rdtsc
neg esi
mov byte [esp + 0x17], ah
popal
add cx, 0xca96
jmp 0x615255
shr ecx, 5
pop ecx
mov bx, word [esp]
mov ax, 0x8c69
xor dl, ch
mov esi, 0xa6945950
jmp 0x6153e4
mov bl, bh
popal
xchg byte [esp + 2], dl
ror ebx, 0xb
xchg di, bx
stc
jmp 0x61530c
xchg ebp, eax
inc esi
mov word [esp + 3], bx
shr ch, 5
add esp, 4
call fcn.00615379
add dword [eax + 3], 0x8d0495ba
add al, 0x3b
lea eax, [ebx + edi]
shr esi, 0x1b
neg bp
btc ebp, ebx
not ecx
sub esp, 6
jmp 0x615390
mov edx, 0x210e6314
mov byte [esp], bh
inc eax
inc ecx
mov byte [esp], ah
mov cx, di
jmp 0x6153a9
Function at 0x6155ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf cx, ax
cpuid
pop word [esp]
cpuid
pop di
neg bx
jmp 0x615606
rdtsc
jmp 0x615587
lea edi, [ebx + edi]
call fcn.006155b2
out 0x7e, eax
in al, dx
mov eax, dword [esi - reloc.KERNEL32.dll_GlobalDeleteAtom]
cmpsb byte [esi], byte es:[edi]
push ebp
aam 0x56
aam 0x4a
sub eax, 0x80c108dc
inc ebx
mov ebp, dword [esp]
neg edx
neg ax
pop si
btc edi, edi
mov ah, byte [esp]
jmp 0x6155cf
rdtsc
inc dl
pop ebp
sub esp, 2
inc bp
mov ebx, 0x80a8b0f0
jmp 0x6155ec