joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f93c016
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93c038
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93c038
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93c038
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93c038
test word [ebx + 0x16], 2
je 0x4f93c038
test word [ebx + 0x16], 0x100
je 0x4f93c038
cmp word [ebx + 0x18], 0x10b
jne 0x4f93c038
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93c038
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93c0c4
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93c058
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f922fa3
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93c038
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4f93c0c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93c038
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93c038
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93c038
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93c038
test word [ebx + 0x16], 2
je 0x4f93c038
test word [ebx + 0x16], 0x100
je 0x4f93c038
cmp word [ebx + 0x18], 0x10b
jne 0x4f93c038
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93c038
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93c0c4
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93c058
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f922fa3
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93c038
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x4f93c17b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93c1d4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93c17b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93c18a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd41e2d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93c1db
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f923051
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93c27a
add edi, 4
add eax, 2
dec ecx
jne 0x4f93c1c0
call 0x4f93c227
loope 0x4f93c21d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93c277
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93c288
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93c23b
cmp eax, ecx
ja 0x4f93c23b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93c2c5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93c2bb
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f923530
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4f93c18a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93c1d4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93c17b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93c18a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd41e2d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93c1db
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f923051
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93c27a
add edi, 4
add eax, 2
dec ecx
jne 0x4f93c1c0
call 0x4f93c227
loope 0x4f93c21d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93c277
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93c288
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93c23b
cmp eax, ecx
ja 0x4f93c23b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93c2c5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93c2bb
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f923530
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40192e
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
cmp edi, 0xaca
jge 0x401949
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45be4d9
jg 0x401963
inc edi
cmp edi, 0x332fe31
jl 0x40193a
cmp dword [0x2087264], 0x400
jne 0x4019a2
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call fcn.00401ef2
call fcn.00401da1
push esi
call fcn.004020e4
pop ecx
pop ecx
xor edi, edi
cmp edi, 0xd036
jge 0x4019b3
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x4019d9
inc edi
cmp edi, 0x263ff
jl 0x4019a4
mov eax, dword [0x43a5e4]
mov dword [0x2087264], eax
call fcn.004016c1
mov edi, 0x3078f
cmp dword [0x2087264], 0x51f
jne 0x401a05
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4019ed
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x404374
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420338]
jne 0x40437e
repz ret
jmp fcn.0040551d
Function at 0x4044e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420338]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040375a
and dword [ebp - 0x14], 0
cmp dword [0x4450d0], 0
mov dword [ebp - 0x18], eax
jne 0x40459c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404644
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404644
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4450d0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4450d4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4450d8], eax
call edi
push eax
call esi
mov dword [0x4450e0], eax
test eax, eax
je 0x40459c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4450dc], eax
mov eax, dword [0x4450dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4045f5
cmp dword [0x4450e0], ecx
je 0x4045f5
push eax
call esi
push dword [0x4450e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4045f5
test ebx, ebx
je 0x4045f5
call edi
test eax, eax
je 0x4045ec
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4045ec
test byte [ebp - 8], 1
jne 0x4045f5
or dword [ebp + 0x10], 0x200000
jmp 0x404628
mov eax, dword [0x4450d4]
cmp eax, dword [ebp - 0x18]
je 0x404628
push eax
call esi
test eax, eax
je 0x404628
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404628
mov eax, dword [0x4450d8]
cmp eax, dword [ebp - 0x18]
je 0x404628
push eax
call esi
test eax, eax
je 0x404628
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4450d0]
call esi
test eax, eax
je 0x404644
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404646
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404374
leave
ret
Function at 0x401977
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x58ced85
jg 0x40199d
inc edi
cmp edi, 0x1f6502b1
jl 0x401983
cmp dword [0x280fac4], 0x400
jne 0x4019e6
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push esi
push esi
call fcn.00401de1
push esi
call fcn.00401f57
push esi
call fcn.00401f66
add esp, 0x10
xor edi, edi
cmp edi, 0xd09a
jge 0x4019f7
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp edi, 0xd2ced2
jg 0x401a1f
inc edi
cmp edi, 0x263ff
jl 0x4019e8
mov eax, dword [0x421c14]
mov dword [0x280fac4], eax
call fcn.004016ec
mov edi, 0x3078f
cmp dword [0x280fac4], 0x51f
jne 0x401a4b
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x401a33
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10
Function at 0x404f9b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403353
and dword [ebp - 0x14], 0
cmp dword [0x42c784], 0
mov dword [ebp - 0x18], eax
jne 0x40504e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4050f6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4050f6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c78c], eax
call edi
push eax
call esi
mov dword [0x42c794], eax
test eax, eax
je 0x40504e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c790], eax
mov eax, dword [0x42c790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4050a7
cmp dword [0x42c794], ecx
je 0x4050a7
push eax
call esi
push dword [0x42c794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4050a7
test ebx, ebx
je 0x4050a7
call edi
test eax, eax
je 0x40509e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40509e
test byte [ebp - 8], 1
jne 0x4050a7
or dword [ebp + 0x10], 0x200000
jmp 0x4050da
mov eax, dword [0x42c788]
cmp eax, dword [ebp - 0x18]
je 0x4050da
push eax
call esi
test eax, eax
je 0x4050da
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4050da
mov eax, dword [0x42c78c]
cmp eax, dword [ebp - 0x18]
je 0x4050da
push eax
call esi
test eax, eax
je 0x4050da
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c784]
call esi
test eax, eax
je 0x4050f6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4050f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405306
leave
ret

Function at 0x405306
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421a80]
jne 0x405310
repz ret
jmp fcn.004060bf
Function at 0x465dc7
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x465df5
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x465dec
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x465de4
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x465e16
mov esp, ebp
pop ebp
ret

Function at 0x465e1a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x465e86
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x465eb3
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x465ea2
xor ecx, eax
xor edx, ebx
dec edi
jne 0x465e93
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x465ed9
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x465e7a
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x465f05
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47134b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x60b910
push eax
xchg byte [edi], al
add byte [eax], al
add byte [ebx - 0x7a9939], cl
cmp ch, ch
cmp eax, ecx
jmp 0x6562ed
invalid
add al, 0
jbe 0x6562f7
mov eax, ecx
cwd
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x44]
mov dx, 0x3089
mov ecx, eax
bsf dx, si
mov edx, ecx
clc
stc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
movsx ecx, si
bsr ecx, eax
dec cx
mov ecx, edx
rcl dx, 0x16
cdq
sbb dx, 0x7639
mov edx, dword [esp + 0x1c]
test esi, ecx
and ecx, 3
cmc
test si, si
sub edx, eax
jmp 0x4b58a1

Function at 0x471f4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
movsx ebx, bp
movzx esi, di
pop esi
movzx bx, dh
setl bh
mov dword fs:[0], ecx
pop ebx
jmp 0x4998fc
mov eax, 0x100e0814
jmp 0x50c6ff
call fcn.004ef689
mov dword [ebp - 4], edi
jmp 0x4cf202
leave
ret 4
cmp dword [esi], edi
jmp 0x4ebd89
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc]
movsx esi, ax
jmp 0x47161c
jne 0x4ebd96
call dword [ebp + 8]
mov dword [esi], eax
test esp, edi
or dword [ebp - 4], 0xffffffff
jmp 0x60b197
call fcn.0051e840
push ecx
cmp bx, 0x1187
test esi, esi
stc
push ecx
cmp ah, dh
push ebx
cmp edi, esi
push esi
sal esi, 0x72
shl esi, 0x6b
xor si, cx
push edi
mov esi, ecx
cmp cx, 0x5df3
clc
sub edi, edi
mov dword [ebp - 0x10], esp
cmp dword [esi], edi
jmp 0x520de7
jne 0x4de35d
push 0x10
jmp 0x4789cc
test si, 0x3fe5
cmc
add edi, 4
dec eax
jmp 0x4a670a

Function at 0x47581f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
jmp 0x545a90
push ebp
mov ebp, esp
shl ax, 0x61
rcr eax, 0x73
sub esp, 0x28
push esi
cbw
jmp 0x51f52e
pop ecx
push ecx
lea eax, [ebp + 8]
jmp 0x473b39
push eax
lea eax, [ebp - 0xc]
jmp 0x607ce3
mov dword [eax + 0x10], 0x100a2c80
jmp 0x605b2f
mov dword [eax + 0x14], 0x100ae5b0
jmp 0x6294de
mov edx, dword [esp + 0xc]
mov si, 0x7946
not esi
pop esi
mov dword [eax + 8], 0x100a2c00
mov dword [eax + 0xc], 0x100a2c10
jmp 0x5fcc19
mov dword [eax + 0x18], 0x100b9090
jmp 0x49eefa

Function at 0x47b29b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
stc
add esp, 0xfffffff4
jmp 0x609412
or al, 0xf9
cmp ecx, eax
ja 0x60d963
imul ecx, esi
cwde
mov ah, 0xbb
movsx eax, cx
mov eax, dword [esp + 8]
jmp 0x4bdec7
sub eax, eax
movsx esi, bx
mov si, 0x1c3
pop esi
jmp 0x4b34ec
Function at 0x49885a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6052d3
shl byte [esi - 0x67], cl
mov edx, dword [esp + 0x24]
and al, 0x16
cmp ecx, 0x29bc1d24
and ecx, 3
bswap eax
cmova eax, edi
rep movsb byte es:[edi], byte [esi]
jmp 0x4b644d

Function at 0x49887b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4f7d29
xor dword [ecx + 0x68673fa], eax
xor esi, dword [ebp - 0xa]
push ebp
sbb ebp, 0x694314b6
mov ebp, esp
jmp 0x50606c
sub esp, 0x20
mov dword [ebp - 4], 0
jmp 0x53f578
mov dword [ebp - 8], 0
push 0xff
jmp 0x656397
xlatb
rep movsd dword es:[edi], dword [esi]
mov edi, esp
mov ecx, dword [ebp - 0xc]
cmovne bx, ax
xchg si, di
pop edi
pop esi
movzx ebx, si
mov dword fs:[0], ecx
pop ebx
jmp 0x4c02aa

Function at 0x49c8c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
not byte [eax - 0x7c36cc70]
rol dword [ecx], 0x81
stc
adc eax, dword [ecx + 0x77]
push ebp

Function at 0x4a16bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x64a62c
pop ss
add bh, bh
jne 0x503265
jmp 0x605b1f
push ds
adc byte [ecx + 0xf102206], cl
int3
push esp
cmpsd dword [esi], dword es:[edi]
add eax, dword [eax]
jne 0x64a62c
nop
xor eax, 0x6a492254
nop
movsx ax, ah
nop
sbb ax, si
sal dx, cl
rdtsc
clc
cmp eax, ecx
jmp 0x635574
jne 0x60cb04
nop
shrd edx, ebx, 0x45
nop
ror dl, cl
shl dx, 0x81
rdtsc
jmp 0x503250
rdtsc
sub eax, 0x91144142
cmp eax, 0x94738062
jmp 0x60caec
Function at 0x4a1701
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ecx
mov eax, 0x124254
mov ecx, 0x256
pop ecx
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xd07701ff
xor esi, eax
xor esi, 0x4a409c8c
popal
nop dword [eax]
pushal
mov ecx, 0x4a4cef1c
xor ecx, 0xb0ee77f2
mov eax, 0x883fa0ac
xor eax, 0x82f95559
mov edx, 0x26491991
xor edx, 0x87128dd1
mov ebx, 0x3c02473c
xor ebx, 0xb54c1974
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x51bf99f5
xor esi, eax
xor esi, 0xcb096c2d
popal
nop dword [eax]
pushal
mov ecx, 0x7fee09d8
xor ecx, 0x34d2a606
mov eax, 0x95b7956e
xor eax, 0x4a9c2fef
mov edx, 0xc3e60227
xor edx, 0x605985d2
mov ebx, 0x153e220a
xor ebx, 0x8e87f28b
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x436c8ebe
xor esi, eax
xor esi, 0xa4517e2b
popal
nop dword [eax]
pushal
mov ecx, 0x59361bc3
xor ecx, 0xd27fedfb
mov eax, 0x6ef36e7c
xor eax, 0x5f72d4b4
mov edx, 0xa8fe5e1f
xor edx, 0x457e193f
mov ebx, 0xbec7e9bf
xor ebx, 0x73ac85f8
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0x28912078
xor esi, eax
xor esi, 0x8969da23
popal
nop dword [eax]
pushal
mov ecx, 0x3e4e7a39
xor ecx, 0xb7984aba
mov eax, 0x541805da
xor eax, 0xcd61d65a
mov edx, 0x82467293
xor edx, 0x372b103d
mov ebx, 0x9803c6be
xor ebx, 0x4ce862f6
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xc6323699
xor esi, eax
xor esi, 0x62b1ee89
popal
nop dword [eax]
pushal
mov ecx, 0x17968c37
xor ecx, 0x90e05e67
mov eax, 0x4a1dbfff
xor eax, 0xe6914238
mov edx, 0x6bb795a2
xor edx, 0xe50d9f0b
mov ebx, 0x81812143
xor ebx, 0x3665bbc3
popal
nop dword [eax]
nop dword [eax]
pushal
mov eax, 0xafaf8dfc
xor esi, eax
xor esi, 0x4c23119c
popal
nop dword [eax]
pushal
mov ecx, 0xc56ce3d5
xor ecx, 0x7a517e55
mov eax, 0x2f4254e8
xor eax, 0x901b09f6
mov edx, 0x44ffa7a1
xor edx, 0xbe4979d9
mov ebx, 0x5abcfa59
xor ebx, 0xd406cc92
popal
nop dword [eax]
nop dword [eax]
pushal

Function at 0x4a2d45
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cmp eax, 0x75290933
jne fcn.004a2d45
nop
nop
nop
rdtsc
cmp eax, 0x8694853
jne 0x4a2d51
nop
nop
nop
rdtsc
cmp edx, 0x33068673
jne 0x4a2d5d
nop
nop
nop
nop
nop
nop
mov eax, 0x36461593
mov ecx, 0x60045411
cmp eax, ecx
jne 0x4a2d6d
nop
nop
nop
nop
mov ebp, 0x93411231
mov esp, 0x8815151
cmp ebp, esp
jne 0x4a2d7f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4a7827
Capabilities:
Execute anti-debugging instructions

Disassembly:
nop
nop
nop
nop
nop
push eax
push ecx
mov eax, 0x124254
mov ecx, 0x256
pop ecx
pop eax
nop
nop
nop