joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf1cf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xf319fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xf1d002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00f20dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xf1d002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00f186e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00f2120b
push 0x10
call fcn.00f211d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xf1cfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00f0d1c0
jmp 0xf1cfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00f1cb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xf1cff0
mov ecx, edi
call fcn.00f0d2c0
push edi
call fcn.00f211c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xf1d021
inc ebx
cmp ebx, 0x20
jb 0xf1cf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xf1e250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf32808
push 0xf22288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xf1e329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xf1e329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00f211d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xf1e329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xf1e329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xf1e32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00f1e351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf1ed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf1ed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xf1ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf1ed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xf1ed94
push eax
push esi
call fcn.00f2120b
add esp, 8
pop esi
ret 0x10

Function at 0xf1eda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf1ee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xf1ee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xf37320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f20dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xf1edda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xf1ee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf1eec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xf1eeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xf37320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f20dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xf1eeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xf1ee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xf1f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xf1f131
push esi
call fcn.00f22145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00f11080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xf1f131
push 0
push ebp
call fcn.00f113a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00f11260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xf1f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00f112f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xf1f121
push 0xf37918
push edi
call fcn.00f203f0
push eax
push ebx
push esi
call fcn.00f1ef60
push 0xf378f8
push edi
call fcn.00f203f0
push eax
push ebx
push esi
call fcn.00f1ef60
push 0xf378d8
push edi
call fcn.00f203f0
push eax
push ebx
push esi
call fcn.00f1ef60
push 0xf378c0
push edi
call fcn.00f203f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00f1ef60
push 0xf378a0
push edi
call fcn.00f203f0
push eax
push ebx
push esi
call fcn.00f1ef60
push 0xf37888
push edi
call fcn.00f203f0
push eax
push ebx
push esi
call fcn.00f1ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xf201b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00f20140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00f20140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00f20140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00f20140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xf20bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf20c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xf3287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf20c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf20c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1016eb79
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x1016eaeb
sub esp, 0xa
lea esp, [esp + 2]
lea esp, [esp + 8]
inc ebp
setbe ah
xchg edx, ebx
jmp 0x1016eb11
lea edx, [edx + esi]
lea eax, [eax + esi]
jmp 0x1016eb4b
cmc
jp 0x1016eaf7
lea edx, [edx + esi]
lea eax, [eax + esi]
shr ax, cl
neg ah
jmp 0x1016eb35
rdtsc
ror bl, cl
jno 0x1016eae4
sub esp, 0xa
jmp 0x1016eace
lea edx, [esi*4]
jmp 0x1016eb57
shr ax, cl
neg ah
lea edx, [esi*4]
xor ebp, 0x2d1794f0
mov edx, 0xde5137e1
rdtsc
bsr ebx, esi
jmp 0x1016ebcd
lea eax, [ebx + 0xdd]
mov dx, si
jmp 0x1016eb2a
push esp
mov ax, dx
mov byte [esp + 2], bl
jmp 0x1016ebb7
mov byte [esp + 2], bl
push word [esp]
mov bx, word [esp + 3]
jmp 0x1016ebc0
je 0x1016eb84
push esp
mov ax, dx
jmp 0x1016eb92

Function at 0x101acfd4
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, esi
movzx esi, byte [eax + 7]
not bp
setl bh
shl edx, 8
jmp 0x101acf83
xor edx, esi
sub esp, 0xc
mov byte [esp + 4], cl
jmp 0x101acf99

Function at 0x101ad3f9
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 1], di
lea esp, [esp + 4]
popal
jmp 0x101ad4cf
lea esp, [esp + 2]
jmp 0x101ad48d
shr edi, 0x10
sub esp, 2
push word [esp + 1]
mov dword [esp], esp
push word [esp]
jmp 0x101ad431
and edi, esi
call 0x101ad471
xor ecx, edi
call fcn.101ad4e6
push ecx
salc
inc esp
and ebx, esi
push 0xbedb4bc1
dec ebp
stc
outsb dx, byte [esi]
jns 0x101ad502
lea esp, [esp + 0x14]
and ecx, 0xff0000
and edi, 0xff000000
jmp 0x101ad494
lea ebp, [ebp*4]
lea ebp, reloc.MSVCRT.dll___dllonexit
mov ecx, dword [ebp]
pop ebp
cmc
jmp 0x101ad447
adc al, 0xb5
add byte [eax], al
add byte [eax], al
jmp 0x101ad51f
add ebx, 4
bsf edx, esi
setl dh
jmp 0x101ad547
mov dword [edi], ecx
call 0x101ad54f
lahf
bswap edx
mov edx, dword [eax + 4]
jmp 0x101ad9a3
mov dword [eax + 0x14], edx
push esi
mov esi, eax
jmp 0x101ad61c
mov dword [eax + 0x18], ecx
lea edx, [edx + 0x66]
mov edx, dword [eax + 0xc]
clc
jmp 0x101ad5d1
xor ecx, edx
mov dh, byte [esp]
neg dl
push bx
lea esp, [esp + 2]
jmp 0x101ad57b
xor edx, ecx
mov dword [eax + 0x1c], edx
call 0x101ad587
pop edi
mov bp, bx
push edi
jmp 0x101ad5fd
lea esp, [esp + 4]
pop esi
xchg ebp, ebx
pop ebp
jmp 0x101ad6cf
add esi, 8
mov ecx, dword [esi]
pop esi
cmc
jmp 0x101ad5a6
mov bx, bp
mov bx, word [esp]
xchg bh, bl
pop ebx
ret
xor edx, ecx
neg ecx
lea ecx, [ebp*4]
setbe cl
lea ecx, [ecx*4]
jmp 0x101ad559

Function at 0x101ad4e6
Capabilities:
Encrypt data using aes

Disassembly:
lea edi, [edx*4]
xchg word [esp + 1], di
jmp 0x101ae40a
xor ecx, dword [eax]
inc dl
mov edx, dword [esp]
dec dh
lea edx, [esi*4]
lea edi, [eax + 0x10]
mov dl, 0xe5
mov dx, 0xebb7
setp dl
not dx
jmp 0x101ad4f8
lea esp, [esp + 0x44]
xor ecx, dword [ebx]
cmc
btr edx, edi
jmp 0x101ad50e
xor ecx, edi
and edx, ebp
xor ecx, edx
jmp 0x101ad53b
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
pushal
shr edi, 0x18
movzx edi, byte [edi*4 + 0x101672e0]
jmp 0x101ad573
mov edi, edx
pushal
and edx, esi
jmp 0x101adbc3
Function at 0x104c2f18
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp dl
push dword [esp + 7]
pop dword [esp + 2]
pop edi
add esp, 4
jmp 0x104c2ef9
push dword [esp + 7]
inc bh
pop word [esp + 0xb]
pop di
lea ebp, [edx + esi]
add esp, 0
jmp 0x104c2ece
push dword [esp + 2]
cpuid
mov edi, 0xdecd7e80
mov byte [esp], dl
rdtsc
btc ebx, esi
jmp 0x104c2f40
mov esi, dword [esp + 8]
xchg dword [esp + 5], ecx
cld
xchg bh, ch
push word [esp + 6]
jmp 0x104c2ee4
mov bx, 0xdb75
pop edx
rdtsc
bsr eax, ecx
stc
rcr ecx, cl
jmp 0x104c2f5a
mov ch, byte [esp + 5]
mov byte [esp + 5], al
push word [esp + 1]
lea ecx, reloc.MSVCRT.dll___dllonexit
neg ch
mov cx, sp
jmp 0x104c2f2a
mov esi, 0x21920eba
pop cx
or ecx, 0x4d66e2f5
xchg si, cx
rdtsc
push dword [esp + 3]
jmp 0x104c2fbf
push word [esp]
btc eax, edi
xchg word [esp + 1], ax
std
neg dl
mov di, 0x2815
jmp 0x104c2f88
std
bsf bx, dx
lea ebp, [ecx + ebx]
lea esp, [esp + 4]
pop word [esp]
not esi
jmp 0x104c2f9e

Function at 0x104c326d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0xa], bl
rol cl, 5
mov dl, byte [esp + 0xc]
jmp 0x104c329e
pop word [esp + 3]
xchg edx, edi
mov dh, byte [esp + 9]
xchg dword [esp + 6], eax
jmp 0x104c32c1

Function at 0x104c375a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, eax
mov ch, byte [esp + 8]
clc
push dword [esp + 0x14]
lea esp, [esp + 0x15]
jmp 0x104c3794
mov dword [esp + 4], esp
pop word [esp + 1]
std
bsf bp, sp
cpuid
push word [esp + 5]
jmp 0x104c47f7
mov dl, ch
xchg edi, eax
call 0x104c37d4
bt bp, bx
rdtsc
xchg word [esp], si
neg ebx
neg al
mov dh, 0xd7
jmp 0x104c37f1
xchg edx, edi
rdtsc
xchg word [esp], cx
setnp dl
lea ebx, [edx*4]
rdtsc
jmp 0x104c388d
xor ax, bx
std
lea esp, [esp]
xchg bx, ax
bsf bx, bx
not cx
jmp 0x104c392b
add esp, 7
xchg word [esp], di
std
neg si
mov edx, 0xc6c95f8b
xchg esi, eax
jmp 0x104c3ac7
cmc
cld
mov ch, 0x66
mov ax, 0xe9cf
clc
rcl cl, 4
jmp 0x104c3dd0
Function at 0x104c3a41
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop si
push di
xchg bp, di
push word [esp + 5]
btc eax, ebp
pop esi
jmp 0x104c3a69
lea ecx, reloc.MSVCRT.dll___dllonexit
jmp 0x104c3a22
mov esi, esp
mov bp, word [esp + 3]
xchg byte [esp + 6], bl
mov edi, 0x4d0a0176
lea eax, [ebp - 0x55]
mov bh, ah
jmp 0x104c3a9b
xchg si, dx
push word [esp + 3]
mov bl, ah
lea edx, reloc.MSVCRT.dll___dllonexit
mov word [esp], bx
lea ecx, reloc.MSVCRT.dll___dllonexit
jmp 0x104c3a49
pop cx
xchg cl, bh
mov di, word [esp + 2]
sbb ebx, 0x74962bff
jmp 0x104c3ab1
clc
push word [esp + 1]
mov byte [esp + 5], cl
mov cx, word [esp + 1]
xchg ah, al
mov si, di
jmp 0x104c3a85
shl dx, cl
dec ebx
rdtsc
cmp edx, esi
xchg ebx, ecx
push dword [esp + 5]
jmp 0x104c3b8f
mov si, bx
bswap ebp
sub esp, 0x10
mov dword [esp + 4], ebp
cpuid
jmp 0x104c3b09
stc
sub esp, 0x1f
lea esp, [esp + 0x41]
neg bh
mov bx, si
lea edi, [ebx*4]
jmp 0x104c3add
mov ebp, 0x7462f280
xchg dword [esp], ecx
lea esp, [esp + 0xa]
mov bp, word [esp]
jmp 0x104c3b44
cpuid
cpuid
xchg word [esp + 1], si
pushal
pop cx
pop edi
jmp 0x104c3af3
sub esp, 2
lea edi, [eax + eax]
clc
mov dl, 0xe4
neg ax
shl dl, 7
jmp 0x104c3b77
xchg dh, ch
mov byte [esp + 1], dl
mov ebp, dword [esp]
mov edx, dword [esp]
xchg ebp, eax
lea esi, [ebx + esi]
jmp 0x104c3b2e
xchg byte [esp + 4], bl
xchg dword [esp + 4], ecx
xchg al, ah
pop word [esp + 5]
mov ax, 0x71e5
mov al, dl
jmp 0x104c3b1f
xchg esi, ecx
pop ax
bsf ecx, edx
lea eax, [ecx*4]
neg ebp
neg ecx
jmp 0x104c3c52
std
pop dword [esp]
sub esp, 0x18
lea esp, [esp + 0x18]
not bp
push word [esp + 1]
jmp 0x104c3b60
lea esp, [esp + 2]
xchg bx, cx
mov al, 0xa5
bts si, ax
inc di
jmp 0x104c3bcb
add esp, 2
bswap edi
mov dh, 0x46
mov dh, 0x98
setl al
lea ebx, [ecx + ebp]
jmp 0x104c3ba4
xchg byte [esp], ch
mov ah, 0xef
mov edi, 0x639f3b6
lea esp, [esp]
lea esi, reloc.MSVCRT.dll___dllonexit
add dh, ah
jmp 0x104c3c22
mov word [esp], sp
neg bh
mov ebx, ecx
bswap esi
mov word [esp + 1], di
xchg ch, dh
jmp 0x104c3bba
xchg edx, edi
cmc
add esp, 0
bsr bx, bx
mov bh, dl
std
jmp 0x104c3c35
mov si, word [esp]
bsr edi, edi
mov ebp, ebx
mov di, 0x553e
rdtsc
xor eax, ebp
jmp 0x104c3c09
mov ebp, esi
ror ax, cl
mov bp, sp
xchg bp, ax
lea eax, [eax + edx]
push eax
jmp 0x104c3d6a
add esp, 1
rdtsc
bswap ebx
lea ebx, [esi + edi]
xchg si, cx
lea esi, [eax + ebx]
jmp 0x104c3bf6
lea ecx, [esi*4]
xchg esi, eax
push word [esp]
call fcn.104c3d24
push dword [esp + 0xa]
mov byte [esp + 0xa], bh
mov byte [esp + 2], al
jmp 0x104c3db1
mov word [esp + 1], di
mov word [esp + 1], cx
pop word [esp + 0x15]
jmp 0x104c40b9
push word [esp + 0xa]
pushal
lea esp, [esp + 0x12]
push word [esp + 0x1e]
push dword [esp + 0x12]
lea esp, [esp + 0xa]
jmp 0x104c3d9b
mov dword [esp + 1], edx
push dword [esp + 9]
pop dword [esp + 7]
lea esp, [esp + 0x17]
lea esp, [esp + 1]
lea esp, [esp]
call fcn.104c4030
Function at 0x104c4dd8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x104c4e4d
mov byte [esp + 0x15], ch
pop dword [esp + 0xb]
add esp, 0xd
push dword [esp + 0xa]
jmp 0x104c4e78
mov dword [esp], ebx
lea esp, [esp + 1]
mov word [esp], cx
lea esp, [esp + 3]
pushal
pop dword [esp + 2]
jmp 0x104c4e37
pop dword [esp + 2]

Function at 0x104c5051
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0xd]
not ah
mov esi, 0xc9ce5d1d
xchg edx, eax
bsf si, dx
xchg dword [esp + 4], eax
mov eax, edi
rcl eax, 6
cmc
jmp 0x104c5023
xchg al, dl
jmp 0x104c5039
Function at 0x104c54cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
lea edx, reloc.MSVCRT.dll___dllonexit
mov dx, 0xb290
xor dh, 0xe
not esi
jmp 0x104c54e7
xchg dl, al
jmp 0x104c54b7
setle ah
pop edx
mov al, byte [esp + 5]
xchg dx, ax
add esp, 0xd
mov ah, byte [esp]
jmp 0x104c5544
push dword [esp + 7]
mov dword [esp + 0xc], edi
xchg word [esp + 0x16], dx
lea esi, [eax + eax]
xchg esi, eax
add esp, 0x14
jmp 0x104c54d1
sub esp, 2
mov edx, dword [esp]
bsf dx, ax
xchg byte [esp + 1], dh
clc
lea esi, [eax + esi]
jmp 0x104c551b

Function at 0x104c56ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov word [esp + 0xf], di
push dword [esp + 5]
jmp 0x104c56f1
pop ax
rdtsc
pop dword [esp + 9]
add esp, 4
rcr dl, 7
xchg esi, edx
jmp 0x104c5710

Function at 0x104c57d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x19], dl
mov ax, di
std
push dword [esp + 9]
mov dl, dh
mov dh, ch
jmp 0x104c57f4
xchg si, ax
mov ah, 0xe9
jmp 0x104c57c2
pop word [esp + 7]
pop dword [esp + 0xc]
rdtsc
bswap eax
std
jmp 0x104c5881
pop esi
bt eax, esp
push dword [esp + 0x11]
xchg dh, ah
std
xchg byte [esp + 0x22], dl
jmp 0x104c57de
mov al, 0x9f
xchg dword [esp + 7], eax
mov word [esp + 8], si
xchg dword [esp + 0x12], edx
dec al
xchg dx, si
jmp 0x104c5867
mov edx, eax
stc
xchg dword [esp + 0xf], edx
clc
xchg al, ah
mov esi, eax
jmp 0x104c5825
pop word [esp + 0xf]
mov ah, 0x19
pop eax
lea edx, reloc.MSVCRT.dll___dllonexit
mov edx, eax
jmp 0x104c58b7
pop si
pop dx
mov word [esp + 5], sp
mov edx, 0x84f9289f
cld
push edx
jmp 0x104c5851
push word [esp + 0xc]
mov word [esp + 0xb], bx
and dh, 0xb5
mov dword [esp + 1], edi
rdtsc
lea eax, reloc.MSVCRT.dll___dllonexit
jmp 0x104c5843
mov esi, dword [esp + 3]
mov dh, byte [esp + 0xf]
btc ax, sp
xchg esi, eax
bsr esi, eax
mov edx, ecx
jmp 0x104c5951
pop edx
sete dl
pop word [esp + 2]
inc dl
mov ah, byte [esp + 0x13]
pop dword [esp + 2]
jmp 0x104c589c
lea esi, [eax*4]
cmc
xchg dword [esp + 0xc], eax
add esp, 9
jmp 0x104c592e
mov si, 0x6006
mov eax, edi
lea eax, [ebp + 0xe3]
pop esi
lea esi, [ebp + 0x1e]
mov eax, 0x26c57e91
jmp 0x104c58cc
btc eax, eax
xchg word [esp + 7], ax
xchg byte [esp + 0x12], al
rdtsc
rdtsc
xchg si, dx
jmp 0x104c58e2
xchg byte [esp + 2], dl
pop dword [esp]
bswap esi
call fcn.104c5918
invalid
push dword [esp + 6]
pop word [esp + 4]
add dl, 0xa8
mov edx, 0xc3cdf405
pushfd
bsf ax, di
jmp 0x104c5903
Function at 0x104c5b32
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x1a], al
mov ah, 0xf5
pop word [esp + 0xc]
jmp 0x104c5ae4
mov dx, 0xbe16
push word [esp + 0x19]
rdtsc
not si
push dword [esp + 0xf]
bsf ax, sp
jmp 0x104c5a86
sub esp, 0x1b
setb ah
lea esi, [esp - 0x74]
neg al
push word [esp + 4]
inc eax
jmp 0x104c5a9c
mov word [esp + 0x21], si
or edx, 0x158bb67
pop eax
jmp 0x104c5b16
lea edx, reloc.MSVCRT.dll___dllonexit
lea eax, [edi*4]
mov al, dh
pop dword [esp + 0x12]
mov dx, bp
bsr si, bx
jmp 0x104c5ace
clc
xchg word [esp + 0x26], dx
neg dl
bsf si, bp
mov dh, bh
pop edx
jmp 0x104c5b55
mov si, word [esp + 0xa]
stc
push dword [esp + 0x1a]
cld
mov dh, bh
push dword [esp + 0x17]
jmp 0x104c5b00
inc si
rdtsc
pop ax
rdtsc
jmp 0x104c5aba
lea eax, [ecx + ebp]
push dword [esp]
not ah
bswap eax
dec esi
pop ax
jmp 0x104c5b84
mov eax, 0x5e719791
mov dword [esp + 4], esp
lea edx, [edi + ebp]
mov byte [esp + 0x17], dl
mov dx, bx
xchg dword [esp + 0x10], edx
jmp 0x104c5b3f
btr ax, ax
bsr si, sp
bsr si, bp
rdtsc
clc
cmc
jmp 0x104c5bf8
std
lea edx, [ebp*4]
pushal
lea esp, [esp + 0x48]
xchg al, dl
not eax
jmp 0x104c5b6e
not dx
mov dx, cx
neg eax
rdtsc
std
setp dl
jmp 0x104c5be2
mov dl, 0xf0
mov eax, dword [esp]
mov dx, sp
stc
xchg dx, ax
mov esi, esp
jmp 0x104c5bbc
mov eax, edi
bsf si, di
neg ah
cmc
not al
setae dl
jmp 0x104c5c1c
btc eax, eax
cmc
lea eax, [ecx + 0x1f]
mov eax, edi
cmc
rol ah, cl
jmp 0x104c5bd2
btc si, bx
bts esi, eax
mov al, dl
std
lea edx, [edx + edi]
mov edx, edi
jmp 0x104c5f20
mov edx, dword [esp]
bsf ax, bp
btr ax, dx
mov dh, 0xd2
bsr ax, sp
mov dh, byte [esp]
jmp 0x104c5c06
bswap esi
lea esi, [edi*4]
call fcn.104c5caf
bt si, cx
call fcn.104c5d3c
push esp
salc
inc esp
and ebx, esi
ror dword cs:[edi - reloc.MSVCRT.dll___dllonexit], 0x6e
mov ah, 0x96
lea eax, [edx*4]
lea esi, reloc.MSVCRT.dll___dllonexit
adc al, 0xbb
mov word [esp + 5], ax
add esp, 9
jmp 0x104c5d0b
xchg dx, ax
bswap esi
lea eax, [ebx + ebp]
mov si, word [esp]
setae al
mov dh, byte [esp]
jmp 0x104c5cfd
mov eax, dword [esp]
sub dh, 0x2d
mov dl, 0xd1
neg esi
setae al
lea esi, [ebx*4]
jmp 0x104c5d58
mov eax, ebx
xchg esi, edx
setle dh
mov dh, byte [esp]
rdtsc
lea edx, [esp + edx]
jmp 0x104c5e30

Function at 0x104c5ebc
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x104c5e89
Function at 0x40ff50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40ff7b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004107f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x40ff9d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40ff9f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x410023
jg 0x40ffb4
test esi, esi
je 0x410023
test ecx, ecx
jl 0x40fffd
jg 0x40ffbe
test eax, eax
je 0x40fffd
cmp edi, ecx
jg 0x40ffd2
jl 0x40ffc8
cmp esi, eax
jae 0x40ffd2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00450dc0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x410000
mov edx, dword [ebp + 8]
test edi, edi
jl 0x410023
jg 0x41000a
test esi, esi
je 0x410023
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x410023
push eax
push esi
push 1
push edx
call fcn.00464970
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc