joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4541e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x487783
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0047ab79
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0048020f
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0048172b
test eax, eax
je 0x4542fc
mov ecx, dword [esp + 0x3c]
call fcn.0048023c
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4542c0
push edi
mov ecx, esi
call fcn.0047d8a0
mov ecx, esi
call fcn.004544a0
cmp dword [esp + 0x38], 1
jne 0x4542f5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047d9db
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4564d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x456503
push esi
call fcn.00459620
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4564fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x456589
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x456572
mov eax, dword [esi + 8]
test eax, eax
je 0x456527
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45656e
cmp eax, 2
je 0x456572
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45651a
cmp eax, 3
je 0x45654d
cmp eax, 1
jne 0x45651a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45651a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45651a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004565b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x456598
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004565b0
add esp, 4
pop esi
ret

Function at 0x463610
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4636b3
test eax, eax
jbe 0x4636b3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4636b3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46365e
xor esi, esi
jmp 0x463664
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46368f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00419990
add esi, eax
push esi
mov ebx, esi
call fcn.00419990
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x463670
pop ebp
test edi, edi
pop edi
jne 0x4636b3
test ebx, ebx
je 0x4636b3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046a150
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4637f5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46390d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46390d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047afcb
mov esi, eax
test esi, esi
je 0x46390d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46390d
mov ecx, esi
call fcn.00463760
cmp edi, eax
jge 0x46390d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x463893
mov dword [esp + 0x34], 1
jmp 0x4638ee
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46390d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00461f80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x467600
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
push edi
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x467628
xor eax, eax
pop edi
add esp, 0x10
ret 0xc
push ebx
push ebp
push esi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x467674
xor ebp, ebp
mov ecx, dword [esp + 0x24]
test ecx, ecx
jge 0x467684
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x10]
cmp ebx, ecx
jle 0x46768e
mov ebx, ecx
cmp edi, eax
jle 0x467694
mov edi, eax
mov edx, dword [esp + 0x24]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x24]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x28]
pop esi
sub eax, 0
pop ebp
pop ebx
je 0x46771c
dec eax
jne 0x467733
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x467733
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 4]
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esp + 8], 1
jmp 0x467733
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0x14]
push edx
call fcn.00467830
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 8]
pop edi
add esp, 0x10
ret 0xc
Function at 0x467750
Capabilities:
Capture screenshot

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x46776c
xor eax, eax
pop edi
add esp, 8
ret 4
push ebx
push ebp
push esi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x4677b8
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jge 0x4677c8
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
cmp ebx, ecx
jle 0x4677d2
mov ebx, ecx
cmp edi, eax
jle 0x4677d8
mov edi, eax
mov edx, dword [esp + 0x1c]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 4
Function at 0x47b96f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47b9a7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00479a23
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004799fb
jmp 0x47b9b3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47d05d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47d09f
call fcn.00482b16
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47d09f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47d096
xor eax, eax
jmp 0x47d0a7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047d0ad
pop edi
pop esi
pop ebx
ret 4

Function at 0x483046
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x483074
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x483092
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00482fac
jmp 0x483092
mov eax, dword [esi + 0x14]
test eax, eax
je 0x483092
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00482fac
test edi, edi
mov eax, edi
jne 0x48307c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4054a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 4]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov esi, dword [eax]
push esi
call fcn.0040cfc5
add esp, 4
mov dword [esp + 0x34], eax
inc eax
je 0x42558e
add eax, 7
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
xor ecx, ecx
mov dword [esp + 0x38], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040d3db
mov ecx, dword [esp + 0x38]
add esp, 4
lea edx, [ecx + ecx + 2]
push edx
push esi
push eax
mov dword [esp + 0x3c], eax
call fcn.0040cc64
add esp, 0xc
push 4
call fcn.0040d3db
add esp, 4
test eax, eax
je 0x425598
mov dword [eax], 1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x140], 0
mov dword [esp + 0x3c], eax
je 0x42566e
cmp dword [eax], 1
jg 0x42559f
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call dword [0x482644]
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x13c]
test esi, esi
jne 0x425606
mov esi, dword [eax + 0x134]
test esi, esi
je 0x42566e
mov dword [esp + 0x1c], esi
lea esp, [esp]
mov edx, dword [esi + 4]
cmp edx, dword [esp + 0x34]
jne 0x406479
test edx, edx
je 0x4055bd
mov ecx, dword [esp + 0x30]
mov eax, dword [esi]
jmp 0x4055a4
mov si, word [eax]
cmp si, word [ecx]
jne 0x406475
add eax, 2
add ecx, 2
dec edx
jne 0x4055a4
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
dec dword [eax]
jne 0x4055df
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0040cfe0
mov edx, dword [esp + 0x40]
add esp, 4
push edx
call fcn.0040cfe0
add esp, 4
mov eax, esi
test eax, eax
je 0x425677
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x10]
mov eax, dword [edi]
mov dword [esp + 0x44], ecx
mov dword [esp + 0xcc], edx
mov edx, dword [ebx + 4]
mov ecx, dword [edx + eax*4]
movsx edx, word [ecx + 0xa]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x148]
inc eax
mov dword [edi], eax
mov esi, dword [ebx + 4]
mov dword [esp + 0xdc], ecx
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ecx
mov esi, dword [esi + eax*4]
mov esi, dword [esp + 0x1c]
mov esi, dword [esi + 0x20]
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x405584
jmp 0x42566e
pushfd
add al, 0xff
call dword [eax + 0x53]
call fcn.004067b3
pop ecx
pop ecx
call [ecx + 0x59]
test eax, eax
jne 0x4255c7
mov ebx, dword [ebp - 4]
push dword [ebx + 0x20]
call edi
push eax
call fcn.00415a2e
push eax
push 0x528ab4
call fcn.004067b3
pop ecx
pop ecx
test eax, eax
jne 0x4255c7
mov esi, dword [esi + 0x20]
mov dword [ebx + 0xca8], esi
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x4adfac
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
and bl, byte [eax + 0x1d6c9a2b]
out 0xff, eax
xchg ecx, eax
mov al, byte [0x2404dfc5]
adc dword [eax], 1
test byte [ebx], 0x39
dec esp
je 0x4adfe9
and eax, 0x1584ab44
pop eax
push bp
dec esp
inc esp
stosd dword es:[edi], eax
test byte [0x4c556658], dl
lodsd eax, dword [esi]
xor dword [eax], ebx
pop esp
push ebx
sbb byte [ebx + 0x61ac4a8d], ch
sti
xlatb
lahf
push ds
aad 0x7d
jp 0x4adfc3
int 0x95
outsd dx, dword [esi]
mov edx, 0x893a05d0
setp ah
ror dword [edx - 0x14], 1
cmpsd dword ds:[esi], dword es:[edi]
cld
test dword [ecx], esp
cmp dword fs:[eax - 6], esp
cli
push ds
inc edi
add byte [edi + 0x5f1e415e], 0x31
sub edi, dword [esi + 0x25]
fidiv word es:[eax + 0x34]
and byte [edi + 0x758542c7], bl
pushfd
or dword [esi + 0x555921fd], edi
jecxz 0x4ae07e
int3
sub dword [eax + 0x56], ecx
invalid
stosb byte es:[edi], al
test byte [ecx + ebx*8], bh
sub al, 0xdf
mov edx, 0x22ba46ee
int 0xc1
invalid
add dword [edi - 0x7c], ecx
test eax, 0x8660b52f
in al, dx
xchg esi, eax
jae 0x4ae080
push cs
or ch, byte [eax]
xchg ebp, eax
movsd dword es:[edi], dword [esi]
mov ah, 0x80
sub dword [edi - 0x36], esp
mov al, 0xd1
pop ecx
or byte [ebp - 0xd9f1964], bh
mov ecx, 0xa6bddba7
pushfd
out 0x60, al
pushal
mov ecx, 0xa6bddba7
je 0x4ae092
arpl word [edi], ax
mov ch, 0xf3
jo 0x4ae061
insb byte es:[edi], dx
jge 0x4ae04d
add al, 0x19
test eax, 0x7021218f
wait
and al, 0xa6
invalid

Function at 0x4be081
Capabilities:
Encode data using xor

Disassembly:
push es
sub byte [ebp - 0xc], al
outsb dx, byte [esi]
shl byte [edx + 0x6c], 1
inc esp
cli
aam 0xbd
mov ch, 0x3c
inc esi
mov edi, dword [edx + 0x25]
mov eax, 0x919aec94
jo 0x4bdfb5
inc ebp
sub ecx, dword [eax + 0x31050434]
sti
std
adc eax, 0xabcb4cbb
mov byte [edi], ch
xor al, 4
add eax, 0x15fdfb31
mov ebx, 0x88abcb4c
das
add al, 0xab
push ecx
and eax, 0xd5bf57a9
sbb dword [esi + 0xd], 0x1b
loop 0x4bdfc9
pop eax
pop ecx
mov esi, 0xfd17da46
or dh, byte [0xcde2ce3c]
sahf
cld
sub eax, esi
mov byte [0xd46a19cd], al
inc esp
arpl word [eax + 0x42e9e51e], cx
push ebp
scasb al, byte es:[edi]
lea esi, [ebp*8 + 0x60555306]
popal
sub dword [eax], ecx
call dword [esp + edi*4 - 0x5c707723]
inc ecx
rcr byte [ecx - 0x6f826827], cl
jge 0x4bdfad
mov bh, al
push ds
lahf
das
push ebx
mov edx, 0x5a333469
push 0x4784120b
ljmp 0xc723
adc al, byte [edi + eax*2 - 0x7c9ef016]
test dword [ebx], esp
invalid
jnp 0x4be02a
loopne 0x4be01b
or dl, bh
out dx, al
mov eax, 0x5147ef92
fdiv st(1), st(0)
mov dword [edx], esp
fmul dword [0x483b679a]
out dx, eax
rcl edx, 0x56
in eax, 0xfb
adc eax, 0x5a173b85
retf 0x8278
Function at 0x4c42ef
Capabilities:
Encode data using xor

Disassembly:
cmp al, byte [esi]
adc dword [ebx], 0x2a
mov byte [edi + 0x5b], dh
les ebp, [edi + 0x128f871d]
psrlw mm4, mm1
inc eax
loopne 0x4c435c
invalid
xor al, 0xa7
mov ebx, dword gs:[eax + 0x71f0a85d]
xlatb
push edi
or eax, 0x38e3a165
punpckhdq mm5, qword [ebx - 0x67]
add dword [bx + di - 0x28], ecx
dec ah
rcr dword [ebx + 0x2d], 1
xchg byte [eax + 0x1a], cl
or dword [ecx], 0x496cfb94
dec eax
sbb al, byte [ecx + 0x6cfb9409]
dec ecx
dec edi
sti
ror dword [ebp + 0x657e3f2b], cl
sub edi, dword [edi]
jle 0x4c43d1
inc edx
inc eax
je 0x4c433d
rcl byte [ecx + ebp*8], 0xc1
push eax
in eax, dx
jb 0x4c4368
inc ebx
cmc
invalid
out dx, al
mov byte [0xe82ec498], al
wait
pop eax
test dword [0xd474775b], ebp
mov ebp, 0x8c5fed3f
sub byte [esi + ebx*2 - 0x2ed410f4], bh
or al, 0xef
sub edx, ecx
mov esp, 0x46daf3b4
mov word [edx - 0x7bed1ac0], ds
pop es
adc al, 0x83
mov edi, 0x7417305d
adc byte [ebp + 0x42], bl
in al, dx
in al, dx
jne 0x4c43bf
xchg edx, eax
lds ecx, [eax - 0x7be43304]
sub byte [esi - 0xb], al
pop ebp
pop esp
call 0x5638a315
adc bh, 0x6d
mov dword [eax], ecx
mov ah, 0xfd
and eax, 0x84cbc5b3
mov cl, 0x17
jl 0x4c442c
push edx
out 0xb8, eax
test al, 0x21
cmc
mov dword [esi + 0x6c402da5], ecx
push esp
je 0x4c448c
mov edx, ss
call 0xcc9cf9d3
popfd
salc
push ds
adc byte [esi], dh
jae 0x4c43a7
dec ebp
cli
into
ljmp 0xa169
push 0x191214d7
pop esp
stosb byte es:[edi], al
jg 0x4c447c
mov al, byte [ecx + ecx]
cli
int3
dec esp
xchg byte [eax + eax*8 - 0x6b], dh
clc
scasd eax, dword es:[edi]
sub dword [edi], esi
dec esi
invalid
sub ch, byte [eax + 0x6ca89885]
imul ecx, dword [ebx + 0x67], 0xc40b435b
dec esp
pop es
aam 0x6e
or byte [ecx - 0x54cbf01e], ch
xlatb
mov edx, 0x1450f141
ror dword [eax + edi*4 + 0x62b271d7], 1
dec edx
adc al, byte [esi - 0x1a]
call 0x7ab15a66
mov cl, 0xa1
outsb dx, byte [esi]
imul esi, dword [eax + 0x759e4cd], 0x3e280e8e
rol dl, cl
das
cli
rol byte [ebx], cl
sub al, 0xb2
fimul word [edx - 0x52508e46]
invalid

Function at 0x4f6db9
Capabilities:
Check for software breakpoints

Disassembly:
retf 0x5316
mov byte [0x72680199], al
pop es
in eax, dx
jo 0x4f6d5b
daa
xchg ebp, eax
sar dword [edx], 1
and ecx, dword [ebp - 0x7240834c]
cmp byte [edx], 0xcc
dec ebp
inc esp
aad 0xde
inc edi
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
pop ss
sub dword [di + 3], ecx
add esp, dword [ecx - 0x35bdb704]
fcmovbe st(0), st(0)
mov dh, 2
lahf
jae 0x4f6d8e
dec ebp
adc edi, esi
dec ebp
jmp [ebx*2 - 0x5d95d80d]
Function at 0x85304a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp]
mov cx, 0xbe52
lea ebp, [esp + 8]
mov ax, word [esp]
jmp 0x8530cb
cpuid
not bx
bsf cx, dx
jb 0x85309a
jae 0x853084
add eax, 0x8e731486
dec edi
mov bh, 0x9e
jmp 0x24e9bd7e
lea ebx, [esi*4]
jmp 0x8530a1
lea ebx, [esi*4]
mov ecx, esi
mov edx, dword [esp]
mov bl, 0xc6
rcl bx, 0xc
jmp 0x8530ef
rdtsc
mov edx, dword [esp]
lea ebx, [eax + edx]
jmp 0x853125
xchg dh, bh
cpuid
sub esp, 0xb8
mov edi, esp
jmp 0x85305c
jb 0x8530b2
rdtsc
mov edx, dword [esp]
call 0x8530fc
fmul qword [ebp + 0xbc81]
add byte [esi - 0x6afb7208], al
add byte [eax], al
add byte [eax], al
lea edx, [edi - 0x11]
xchg dword [esp], esi
jmp 0x853738
add esi, 0x36154304
mov edx, esp
lea ebx, [edx + ebx]
mov ebx, dword [esp]
mov eax, dword [esp]
jmp 0x8531af
sub esp, 3
jmp 0x853172
mov dx, 0x45bb
lea esp, [esp + 3]
jmp 0x853193
push word [esp + 1]
clc
add esp, 2
jmp 0x85315c
mov dl, byte [esp]
lea edx, reloc.oleaut32.dll_SysFreeString
jmp 0x8531df
inc esi
lea edx, [edi*4]
mov dh, byte [esp]
mov ah, 0x66
not edx
jmp 0x85317d
mov edx, dword [esp]
ror esi, 0
jno 0x853138
sub esp, 3
push word [esp + 1]
clc
add esp, 2
mov dx, 0x45bb
jmp 0x853160
dec ax
rdtsc
sub esp, 0xa
xor dx, 0x1bef
not bh
jmp 0x8531fb
neg esi
lea edx, [edi*4]
and ah, ah
je 0x8531c9
jne 0x853211
xor dx, 0x1bef
not bh
jmp 0x8531fb
lea esp, [esp + 2]
jmp 0x853230
dec ax
rdtsc
sub esp, 0xa
jmp 0x8531ee
jmp 0x85334f
rol esi, 0
lea ebx, reloc.oleaut32.dll_SysFreeString
mov bx, 0x377e
rcl edx, cl
ja 0x85321a
btr bx, cx
jmp 0x853353
jmp fcn.00853281
bsf ax, si
je 0x8532a0
jne fcn.00853281
hlt
btr bx, cx
add esi, dword [ebp]
push eax
mov bl, 0x2b
jmp 0x85330d
Function at 0x8534a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x85356b
bswap edx
mov dl, bh
jmp 0x853519
jmp 0x853502
btr dx, bx
jne 0x8534d7
bswap edx
mov dl, bh
mov edx, dword [esp]
jmp 0x85351c
shl dh, 7
xchg byte [esp + 0x19], dl
inc dx
jmp 0x853548
mov edx, dword [esp]
neg al
sub esp, 0x1e
jp 0x8534dd
shl dh, 7
xchg byte [esp + 0x19], dl
inc dx
mov dl, byte [esp + 0x13]
not edx
jmp 0x85354e
mov dl, byte [esp + 0x13]
not edx
lea esp, [esp + 2]
jmp 0x853635
xchg dl, dh
lea esp, [esp + 8]
dec al
lea edx, [ebp + 0x6a]
lea edx, [ebp*4]
jmp 0x8534f3
rdtsc
mov dx, 0xcee8
bt eax, ebp
jge 0x85359e
dec dx
inc dl
jmp 0x8535ee
mov ah, dh
not ah
jmp 0x8535d1
dec dx
jmp 0x8535a6
inc dl
lea edx, [ebx*4]
xchg edx, eax
not bl
bsr edx, ecx
jmp 0x85360e
setne dh
mov ah, dh
not ah
invalid
inc esi
mov ax, 0x8363
jmp 0x853582
not edx
cmc
mov dx, 0xed8a
call fcn.00853682
out dx, eax
jne 0x8535cc
invalid
lea edx, [ebx*4]
xchg edx, eax
jmp 0x8535b0
mov dx, 0xed8a
jmp 0x853615
jp 0x8535d8
not edx
cmc
jmp 0x8535f8
not bl
mov eax, 0xda61405a
pushal
pop ax
setbe dl
jmp 0x8536a9
sub cl, al
rol edx, cl
jg 0x8535ca
setne dh
jmp 0x853598
sub bl, 0x29
xchg dh, ah
cmp ax, 0xbd75
jle 0x8536eb
neg dx
jmp 0x853713
pop word [esp + 1]
mov dl, bl
xchg dl, ah
push edi
lea esp, [esp + 0x20]
jmp 0x853693
mov ax, 0xa002
jmp 0x853755
neg dx
jmp 0x8536d5
mov ax, 0xa002
jmp 0x853755
jmp fcn.0085373f
xor bl, 0x59
rdtsc
lea edx, [ebx*4]
btr edx, eax
jg 0x853719
rdtsc
neg dx
jmp fcn.0085371b

Function at 0x853704
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, si
lea edx, [edx*4]
call fcn.008534a8

Function at 0x857a6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00857c86
pop word [esp + 0x13]
lea esp, [esp + 0x1a]
lea esp, [esp + 3]
push eax
pushal
push eax
jmp 0x857bcf
lea esp, [esp + 2]
pop word [esp + 0x17]
mov dword [esp + 0x38], edx
call fcn.00857b36
push 0x895d228b
dec esp
and al, 0x20
mov dword [esp + 0x20], ecx
pushal
mov byte [esp + 0x1c], ah
jmp 0x857a98
lea esp, [esp + 2]
jmp 0x857aae
mov word [esp + 4], cx
mov word [esp + 7], dx
push word [esp + 0xd]
jl 0x857afb
lea esp, [esp + 2]
mov dword [esp + 0x20], ecx
pushal
mov byte [esp + 0x1c], ah
lea esp, [esp + 2]
call fcn.00857acf
stc
jmp 0x857c4f
mov ebp, dword [esp + 0x2c]
xchg edx, eax
rcr ah, 2
jne 0x857c2f
lea eax, [ebp*4]
bsf eax, esp
jmp 0x857c31
jmp 0x857c69
lea edi, [esp]
call 0x857c53
sub esp, 0xbc
jmp 0x857cb0
ja 0x857c01
jbe 0x857c01
mov word [esp + 1], dx
xchg word [esp + 1], dx
jmp 0x857c39
lea eax, [ebp*4]
bsf eax, esp
jmp 0x857c31
bsr cx, si
jmp 0x857c9a
clc
bsf ax, cx
mov esi, esp
neg edx
js 0x857c90
bsr cx, si
clc
bsf ax, cx
jmp 0x857c9f

Function at 0x857b99
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf084442c
jmp 0x857bfa
mov dword [esp + 0x30], ebp
pushal
mov word [esp + 5], si
pop word [esp]
jmp 0x857ba5
mov dword [esp], eax
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x857b83
lea esp, [esp + 0xf]
lea esp, [esp + 3]
mov dword [esp + 0x38], esi
pushfd
mov word [esp], sp
push bp
jmp 0x857c1d
lea esp, [esp + 2]
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
pushfd
jmp 0x856f5f