joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c64c
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
call fcn.00408f38
test al, al
je 0x40c6ff
mov eax, 0x40
call fcn.00408b1c
mov ebp, eax
mov eax, 0x40
call fcn.00408b1c
mov esi, eax
mov eax, 0x40
call fcn.00408b1c
mov edi, eax
push ebx
push 0x40c708
call sub.ntdll.dll_DbgPrint
add esp, 8
push ebx
push 0x40c718
push ebp
call sub.ntdll.dll_swprintf
add esp, 0xc
mov eax, dword [esp + 4]
inc eax
push eax
mov eax, dword [esp + 4]
push eax
push 0x40c738
push edi
call sub.ntdll.dll_swprintf
add esp, 0x10
mov ecx, 0x40
mov edx, esi
mov eax, edi
call fcn.0040b2ac
push edi
push esi
push ebp
push 0x40c778
call sub.ntdll.dll_DbgPrint
add esp, 0x10
mov edx, esi
mov eax, ebp
call fcn.0040eb30
mov eax, ebp
call fcn.00408b30
mov eax, esi
call fcn.00408b30
mov eax, edi
call fcn.00408b30
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c917
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 0xc], 0x411684
jmp fcn.0041fe9b

Function at 0x40ca40
Capabilities:
Print debug messages

Disassembly:
add esp, 8
push 0x59c95b0e
pushal
lea esp, [esp + 0x24]
jmp fcn.004206e4

Function at 0x40cb9e
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 4]
call sub.ntdll.dll_DbgPrint
sar ecx, cl
cmc
pop ecx
push ebx
test cl, dl
clc
mov byte [ebp - 0x14], 0
mov byte [esp], 0xfa
test bl, 0x12
cmp byte [ebp - 0x13], 0
call fcn.00421a9c

Function at 0x40cf0d
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 8]
call sub.ntdll.dll_NtClose
jmp loc.0041db8d

Function at 0x40d26e
Capabilities:
Print debug messages

Disassembly:
cmp dword [esp + 0x1c], 0
jmp loc.0041a073

Function at 0x40d385
Capabilities:
Print debug messages

Disassembly:
mov byte [esp], 0xdf
pushfd
mov dword [esp + 4], 0x4116c8
mov byte [esp], 0x16
push eax
jmp fcn.004259f9
Function at 0x40d588
Capabilities:
Create process on windows
Print debug messages
Resume thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff8c
mov edi, edx
xor ebx, ebx
mov esi, 0x7ffe0000
push 0
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 8]
push edx
push eax
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
mov eax, dword [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
lea eax, [esi + 0x30]
push eax
lea eax, [esp + 0x20]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push edi
lea eax, [esp + 0x28]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
push 0
push 0
push ebx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x50]
push eax
call sub.ntdll.dll_RtlCreateProcessParameters
mov ebx, eax
mov eax, ebx
call fcn.00407d14
test eax, eax
jne 0x40d627
push ebx
push 0x40d6bc
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40d6b3
push 0x44
lea eax, [esp + 0x34]
push eax
call sub.ntdll.dll_RtlZeroMemory
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x48]
push eax
push 0x40
lea eax, [esp + 0x38]
push eax
call sub.ntdll.dll_RtlCreateUserProcess
mov ebx, eax
mov eax, ebx
call fcn.00407d14
test eax, eax
jne 0x40d672
push ebx
push 0x40d6e4
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40d6b3
push 0
mov eax, dword [esp + 0x3c]
push eax
call sub.ntdll.dll_NtResumeThread
mov ebx, eax
mov eax, ebx
call fcn.00407d14
test eax, eax
jne 0x40d69b
push ebx
push 0x40d704
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40d6b3
push 0
push 0
mov eax, dword [esp + 0x3c]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov eax, dword [esp + 0x34]
push eax
call sub.ntdll.dll_NtClose
add esp, 0x74
pop edi
pop esi
pop ebx
ret
Function at 0x40dd08
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov byte [esp + 0xe], 0
mov byte [esp + 0xf], 0
mov dword [esp], 0xf
mov ebp, 0x41581c
mov edi, ebp
cmp dword [edi + 4], 0
jne 0x40dd36
cmp dword [edi], 0
je 0x40de57
cmp dword [edi + 0x24], 0x6e7a6674
jne 0x40de57
cmp byte [esp + 0xe], 0
jne 0x40dda6
cmp dword [edi + 0x18], 6
jne 0x40dda6
mov esi, 0xf
mov eax, esi
shl eax, 2
lea ebx, [edi + eax*8 + 0x28]
cmp dword [ebx + 4], 0
jne 0x40dd69
cmp dword [ebx], 0
je 0x40dda0
cmp byte [ebx + 0x19], 0
je 0x40dda0
lea edx, [ebx + 0x19]
lea eax, [esp + 4]
call fcn.004081ac
lea eax, [esp + 4]
call fcn.00408300
push 0
lea ecx, [esp + 8]
mov edx, 0x40dea0
mov eax, 0x40deb0
call fcn.00408a10
mov byte [esp + 0xe], 1
jmp 0x40dda6
dec esi
cmp esi, 0xffffffff
jne 0x40dd55
cmp byte [esp + 0xf], 0
jne 0x40de4d
cmp dword [edi + 0x18], 0x10
jne 0x40de4d
mov esi, 0xf
mov eax, esi
shl eax, 2
lea ebx, [edi + eax*8 + 0x28]
cmp dword [ebx + 4], 0
jne 0x40ddd4
cmp dword [ebx], 0
je 0x40de43
cmp byte [ebx + 0x19], 0
je 0x40de43
lea edx, [ebx + 0x19]
lea eax, [esp + 4]
call fcn.004081ac
lea eax, [esp + 4]
call fcn.00408300
push 0
lea ecx, [esp + 8]
mov edx, 0x40df20
mov eax, 0x40deb0
call fcn.00408a10
mov al, byte [ebx + 0x19]
push eax
push 0x40df30
call sub.ntdll.dll_DbgPrint
add esp, 8
mov edx, ebx
mov eax, edi
call fcn.0040eccc
mov al, byte [ebx + 0x19]
push eax
push 0x40df60
call sub.ntdll.dll_DbgPrint
add esp, 8
mov al, byte [ebx + 0x19]
mov ecx, esi
mov edx, dword [esp]
call fcn.0040c64c
mov byte [esp + 0xf], 1
jmp 0x40de4d
dec esi
cmp esi, 0xffffffff
jne 0x40ddc0
mov al, byte [esp + 0xf]
and al, byte [esp + 0xe]
jne 0x40de6a
dec dword [esp]
sub ebp, 0x228
cmp dword [esp], 0xffffffff
jne 0x40dd25
cmp byte [esp + 0xf], 0
jne 0x40de80
mov edx, 0x40df20
mov eax, 0x40deb0
call fcn.00408ab4
cmp byte [esp + 0xe], 0
jne 0x40de96
mov edx, 0x40dea0
mov eax, 0x40deb0
call fcn.00408ab4
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40e018
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff5c
mov edi, edx
mov dword [esp], eax
push edi
push 0x40e16c
call sub.ntdll.dll_DbgPrint
add esp, 8
test edi, edi
jne 0x40e03d
mov edi, 0x800
cmp edi, 0x20000
jl 0x40e04a
mov edi, 0x20000
lea eax, [edi + 0x1000]
dec eax
test eax, eax
jns 0x40e05a
add eax, 0xfff
sar eax, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
push eax
push 0x40e184
call sub.ntdll.dll_DbgPrint
add esp, 8
mov esi, dword [esp + 0x20]
dec esi
test esi, esi
jl 0x40e160
inc esi
xor ebx, ebx
mov eax, dword [esp + 0x20]
dec eax
cmp ebx, eax
jne 0x40e090
mov ecx, edi
jmp 0x40e09b
mov ecx, 0xfff
sub edi, 0x1000
cmp ecx, 0x1000
jne 0x40e0a4
dec ecx
mov eax, ecx
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, 0x100000
xor edx, edx
call fcn.00403b6c
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
push eax
lea eax, [esp + 0x28]
push eax
call sub.ntdll.dll_wcscpy
add esp, 8
push 0x40
lea eax, [esp + 0x68]
push eax
call sub.ntdll.dll_RtlZeroMemory
lea eax, [ebx + 1]
push eax
push 0x40e19c
lea eax, [esp + 0x6c]
push eax
call sub.ntdll.dll_swprintf
add esp, 0xc
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
push eax
call sub.ntdll.dll_wcscat
add esp, 8
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
call sub.ntdll.dll_NtCreatePagingFile
test eax, eax
je 0x40e158
push eax
push ebx
push 0x40e1b8
call sub.ntdll.dll_DbgPrint
add esp, 0xc
inc ebx
dec esi
jne 0x40e083
add esp, 0xa4
pop edi
pop esi
pop ebx
ret
Function at 0x40eb30
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ebp, edx
mov edi, eax
push 0x40ec58
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
mov ecx, 0x40
call fcn.00407d20
push 0
push 0
push 0
push 1
push 0
push 0x80
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
push 0x12019f
lea eax, [esp + 0x28]
push eax
call sub.ntdll.dll_NtCreateFile
mov esi, eax
mov eax, esi
call fcn.00407d14
test eax, eax
je 0x40ec42
mov eax, 0x68
call fcn.00408b1c
mov ebx, eax
push edi
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push edi
lea eax, [ebx + 8]
push eax
call fcn.00407f80
push ebp
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push ebp
lea eax, [ebx + 0x28]
push eax
call fcn.00407f80
mov word [ebx], 8
push edi
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
mov word [ebx + 2], ax
mov word [ebx + 4], 0x28
push ebp
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
mov word [ebx + 6], ax
push 0
push 0
push 0x68
push ebx
push 0x6dc000
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x24]
push eax
call sub.ntdll.dll_NtDeviceIoControlFile
mov esi, eax
mov eax, esi
call fcn.00407d14
test eax, eax
jne 0x40ec30
push esi
push 0x40ec8c
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, ebx
call fcn.00408b30
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtClose
jmp 0x40ec50
push esi
push 0x40ecac
call sub.ntdll.dll_DbgPrint
add esp, 8
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x410124
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, eax
push fcn.00410160
jmp fcn.00425065
Function at 0x410c28
Capabilities:
Delete registry value
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov edi, eax
mov eax, pe_nt_image_headers32
call fcn.00408b1c
mov ebx, eax
push 0x410d1c
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push 0xc
lea eax, [esp + 0x28]
push eax
call sub.ntdll.dll_RtlZeroMemory
push ebx
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0xc]
push eax
push 0x2001f
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_NtOpenKey
test eax, eax
jne 0x410cfd
push 0x410d68
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtDeleteValueKey
mov eax, 0x20
call fcn.00408b1c
mov esi, eax
push edi
push 0x410d88
push esi
call sub.ntdll.dll_swprintf
add esp, 0xc
push esi
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtDeleteValueKey
mov eax, esi
call fcn.00408b30
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtFlushKey
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtClose
jmp 0x410d0b
push eax
push 0x410da8
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, ebx
call fcn.00408b30
add esp, 0x30
pop edi
pop esi
pop ebx
ret

Function at 0x410dc8
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, 0x80
call fcn.00408b1c
mov ebx, eax
push esi
push 0x410e3c
push ebx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0x410e50
push ebx
call sub.ntdll.dll_wcscat
add esp, 8
mov eax, ebx
call fcn.00408b44
test al, al
jne 0x410e18
push ebx
push 0x410e90
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, ebx
call fcn.00408b30
pop esi
pop ebx
ret
mov eax, 0x410eac
mov edx, ebx
call fcn.004090d4
test al, al
je 0x410e2f
mov eax, esi
call fcn.00410c28
mov eax, ebx
call fcn.00408b30
pop esi
pop ebx
ret

Function at 0x410eb4
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov esi, eax
mov eax, 0x20
call fcn.00408b1c
mov ebx, eax
push esi
push 0x410f4c
push ebx
call sub.ntdll.dll_swprintf
add esp, 0xc
push ebx
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
mov ecx, 0x40
call fcn.00407d20
push 0
push 0
push 0x20
push 3
push 3
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
push 0x12019f
lea eax, [esp + 0x38]
push eax
call sub.ntdll.dll_NtCreateFile
test eax, eax
jne 0x410f37
mov eax, dword [esp + 0x10]
call fcn.00408c28
mov eax, dword [esp + 0x10]
push eax
call sub.ntdll.dll_NtClose
jmp 0x410f45
push eax
push 0x410f6c
call sub.ntdll.dll_DbgPrint
add esp, 8
add esp, 0x2c
pop esi
pop ebx
ret
Function at 0x410fc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor ebx, ebx
xor esi, esi
call fcn.00408180
test eax, eax
jne 0x410fe5
push 0x411524
call sub.ntdll.dll_DbgPrint
pop ecx
jmp fcn.004114e6
mov eax, dword [0x4123b0]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov eax, 0x411548
call fcn.0040921c
xor eax, eax
mov dword [ebp - 8], eax
mov edx, 0x411558
mov eax, 0x411570
mov ecx, dword [ebp - 8]
call fcn.004087e0
mov edx, 0x4115e0
mov eax, 0x411570
mov ecx, dword [ebp - 8]
call fcn.004087e0
mov edx, 0x4115f4
mov eax, 0x411570
mov ecx, dword [ebp - 8]
call fcn.004087e0
mov edx, 0x411608
mov eax, 0x411570
mov ecx, dword [ebp - 8]
call fcn.004087e0
push 0
mov ecx, 0x41161c
mov edx, 0x411620
mov eax, 0x411570
call fcn.00408a10
push 0
mov ecx, 0x41161c
mov edx, 0x411630
mov eax, 0x411570
call fcn.00408a10
push fcn.00411644
jmp 0x423034

Function at 0x411181
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0xc]
jne 0x41de7e
mov dl, 5
mov edx, dword [ebp - 0xc]
lahf
lea eax, [ebx - 0x1510559e]
lea eax, [esp + 0xf78cd7a]
mov eax, ebx
jmp fcn.00421957
call fcn.00421ed2
push 0x4329a1a8
mov dword [esp], ebp
mov word [esp], 0x9c79
mov word [esp], di
mov dword [esp], 0x41184c
call fcn.0041aaa1

Function at 0x411206
Capabilities:
Print debug messages

Disassembly:
mov byte [esp + 0xc], cl
lea esp, [esp + 0x10]
jne 0x42624b
pushal
push 0x1b88954d
mov dword [esp + 0x20], 0x4118e0
mov dword [esp + 4], ebp
lea esp, [esp + 0x20]
call sub.ntdll.dll_DbgPrint
call fcn.00425184

Function at 0x4112e0
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x30]
jne 0x41f3b1
push 0x945e4546
lea esp, [esp + 4]
call sub.ntdll.dll_wcscat
cmp bl, 0x18
pushal
add esp, 0x28
call fcn.004221cb

Function at 0x4113bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], ah
lea esp, [esp + 8]
je 0x42353b
pushal
pop ecx
mov dword [esp + 0x18], 0
rdtsc
mov ch, al
lea ecx, [ecx - 0x66530675]
lea ecx, [ebp - 0x11]
cdq
rdtsc
mov edx, 0x411620
push esi
mov al, cl
mov eax, 0x411570
mov byte [esp], dl
mov byte [esp], 0xf2
pushal
lea esp, [esp + 0x3c]
call fcn.00408a10
not dh
lahf
mov edx, 0x411630
push edx
movzx ax, cl
movzx ax, bl
mov eax, 0x411570
push 0x58eaf519
lea esp, [esp + 8]
jmp loc.0041a353

Function at 0x4114d1
Capabilities:
Print debug messages

Disassembly:
push 0xb515db4e
mov dword [esp + 0x44], 0
jmp fcn.00421d55

Function at 0x41a00b
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 8]
jle 0x421e33
pushal
lea esp, [esp + 0x20]
call fcn.0040d45c
jmp loc.00426a40

Function at 0x41a07d
Capabilities:
Print debug messages

Disassembly:
pushal
pushal
mov dword [esp + 0x40], 0x411684
mov word [esp + 4], 0x12db
push esi
lea esp, [esp + 0x44]
call sub.ntdll.dll_DbgPrint
movzx cx, dl
sub ch, al
cmp bh, bl
adc cl, 0x95
pop ecx
test ah, 9
pushfd
stc
and dword [ebp - 4], 0xffff7fff
bt bx, 6
mov byte [esp], bh
test ebx, 0x548d3273
or dword [ebp - 4], 0x10000
call fcn.0042419f
Function at 0x41a369
Capabilities:
Check http status code
Execute anti-debugging instructions
Print debug messages

Disassembly:
mov byte [esp + 0x10], dl
lea esp, [esp + 0x20]
call sub.ntdll.dll_wcslen
sal ch, cl
sal cx, cl
stc
shrd cx, ax, 6
pop ecx
stc
cmc
pushfd
pushal
add eax, eax
pushfd
pushfd
xchg dword [esp + 0x28], eax
pushfd
mov eax, dword [esp + 0x30]
lea esp, [esp + 0x2c]
jg 0x424307
push eax
pushfd
movzx ax, al
cwde
lea eax, [ebx + 0x14]
call fcn.004270e8

Function at 0x41a77f
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 4]
call sub.ntdll.dll_DbgPrint
bt bp, ax
cmc
add esp, 0xc
xchg ch, al
setns ch
not cx
movzx ecx, cl
mov dword [ebp - 8], 1
pushfd
call fcn.0041d243

Function at 0x41a812
Capabilities:
Print debug messages

Disassembly:
mov byte [esp], bl
lea esp, [esp + 0x28]
call fcn.0040a3f4
sbb dh, al
xor eax, eax
push 0xef081162
mov cl, dh
movsx cx, dl
xchg ecx, edx
mov edx, dword [esp + 4]
pushfd
call fcn.004247f4

Function at 0x41a94a
Capabilities:
Print debug messages

Disassembly:
pushal
mov dword [esp + 0x24], edi
pushfd
pushfd
jmp loc.0041da8d

Function at 0x41abff
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 0x28], esi
mov word [esp], 0x9b8b
push 0xdca92d94
mov al, bh
setbe al
mov dword [esp + 0x28], ebx
setp al
push dword [esp + 4]
lea eax, [esi*8 + 0x45bd7c53]
jmp loc.0041fe23

Function at 0x41af7e
Capabilities:
Print debug messages

Disassembly:
push 0xd9f67f7a
mov dword [esp], ecx
lea esp, [esp + 0x48]
call sub.ntdll.dll_DbgPrint
adc al, bh
bswap eax
add esp, 0x10
lahf
call fcn.004204b8

Function at 0x41d243
Capabilities:
Execute anti-debugging instructions
Print debug messages

Disassembly:
push eax
rdtsc
lea ecx, [ebp - 8]
bswap dx
mov edx, 0x4117c4
cwde
bswap eax
lahf
push 0xa0c8b7ab
mov eax, 0x411570
pushal
jmp 0x426b53

Function at 0x41d26f
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x14]
jne 0x421f39
stc
jmp loc.0041107c

Function at 0x41d2c8
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 0x14], eax
pop eax
jmp 0x4224fa
pushal
mov byte [esp + 0xc], cl
mov eax, dword [ebx + 0xc]
setp ch
lea edx, [esi + 0x40]
mov dword [esp], esp
pushal
lea ecx, [edi - 0x78b24ff0]
mov ecx, dword [esp + 0x50]
push dword [esp + 0xc]
call fcn.0040d278

Function at 0x41d2ed
Capabilities:
Print debug messages

Disassembly:
mov dword [ebp - 0x1d], 0xffffffff
cdq
movsx ax, al
pushfd
mov dword [ebp - 0x19], 0xffffffff
jmp 0x425264
mov byte [ebp - 0x14], 0
pushfd
mov byte [esp + 4], 0x3b
mov byte [ebp - 0x13], 0
not al
mov byte [ebp - 0x12], 0
cwde
movzx edx, cl
push dword [esp]
lea eax, [ebx - 0x616d1236]
mov byte [ebp - 0x15], 0
pushfd
cwde
pushal
mov byte [ebp - 0x11], 0
pushfd
cdq
bswap dx
jmp 0x427065
lea edx, [eax + 0x512ae911]
not dx
mov edx, dword [ebp - 4]
push 0xa42ba5e
jmp loc.0040c980
mov byte [ebp - 0x10], 0
cwde
lea eax, [ebp - 0x36]
jmp 0x425f40

Function at 0x41d463
Capabilities:
Execute anti-debugging instructions
Print debug messages

Disassembly:
lea edx, [edx*4 + 0x5aecff02]
jmp loc.0041144f
Function at 0x41d479
Capabilities:
Check for software breakpoints
Print debug messages

Disassembly:
cwde
push 0x3b85c843
call fcn.0041a201
push esi
mov byte [esp + 8], bh
lea esp, [esp + 0x28]
jne 0x4227e1
lahf
cwde
bswap ax
push 0
jg 0x41aaa6
pushfd
cwde
mov dword [esp], 0
setb al
mov eax, dword [esp + 0x20]
jmp loc.00411371

Function at 0x41d9b7
Capabilities:
Print debug messages

Disassembly:
jmp 0x41f74e
cmp ch, dl
test byte [ebp - 1], 1
mov byte [esp], bh
pushfd
jmp 0x424b12
lea esp, [esp + 8]
je 0x41f805
jge 0x41de83
pushfd
mov dword [esp], 0x41184c
call fcn.0040d32a

Function at 0x41da9b
Capabilities:
Print debug messages
Read file on windows

Disassembly:
mov eax, dword [ebp - 4]
lea esp, [esp + 8]
jns 0x423d3d
pushfd
pushfd
mov byte [esp + 4], dl
lea esp, [esp + 8]
call fcn.00409b84
push esp
call fcn.00421a4e

Function at 0x41db29
Capabilities:
Read file on windows

Disassembly:
lea esp, [esp + 0x34]
call sub.ntdll.dll_NtReadFile
jmp 0x424d1d

Function at 0x41dc6c
Capabilities:
Print debug messages

Disassembly:
push ebx
jmp 0x41e129
lea esp, [esp + 0x28]
jo 0x41d12f
push 0xa5933ad2
lea esp, [esp + 4]
jne 0x421f39
push edx
test byte [ebp - 3], 0x80
pushal
pushfd
call fcn.00426b8c
jmp 0x423121
mov word [esp], cx
pushfd
lea esp, [esp + 8]
jne 0x421f39
stc
stc
test bx, 0x4c02
test byte [ebp - 3], 0x80
jmp 0x41ee9b
pushal
jmp loc.00408110
je 0x421f39
pushal
pushfd
mov dword [esp + 0x20], 0x411684
pushfd
mov byte [esp + 4], 0x58
push ebp
push ebp
lea esp, [esp + 0x2c]
call sub.ntdll.dll_DbgPrint
test ah, bl
pushfd
mov ecx, dword [esp + 4]
mov byte [esp], 0x6b
call fcn.004266e4
lea esp, [esp + 0x28]
jb fcn.0041a55f
pushfd
cwde
mov dword [ebp - 0xc], 0x20000
pop eax
mov eax, ebx
pushal
jmp 0x41ebe7
bt ecx, 8
cmc
push 0xeebde5c9
cmp byte [ebp - 0xd], 0
mov byte [esp], bh
lea esp, [esp + 4]
je 0x42353b
push esp
lea esp, [esp + 4]
jne 0x422bb3
push 0x4116c8
pushal
pushal
lea esp, [esp + 0x40]
call sub.ntdll.dll_DbgPrint
pushal
mov ecx, dword [esp + 0x20]
setne al
mov al, byte [ebp - 0xf]
not dx
jmp loc.0040d444
pushal
mov dword [esp + 0x1c], 0x4116c8
push ebp
call fcn.0041e264
mov byte [esp + 4], 0xc5
lea esp, [esp + 0x2c]
call fcn.004088ac
clc
cmp dword [ebp - 0xc], 0
push 0xfe389539
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0x4231ba
pushal
cmp edx, ebx
pushfd
jmp 0x4233d1
push dword [esp]
lea esp, [esp + 0x28]
jne 0x421f39
pushfd
test bx, cx
cmc
mov byte [esp], 0xfa
test byte [ebp - 3], 0x80
jmp loc.004113a6
mov dword [ebp - 0xc], 0x800
mov byte [esp + 0x10], cl
cmp ch, ch
pushfd
bt sp, cx
cmp dword [ebp - 0xc], 0x20000
mov byte [esp + 4], 0x8d
mov byte [esp], 0xdb
mov word [esp], bx
jmp 0x420364

Function at 0x41dca7
Capabilities:
Print debug messages

Disassembly:
not ah
bswap eax
cwde
mov eax, dword [esp + 0xc]
pushfd
mov dword [esp], eax
pushal
pushal
mov byte [esp + 8], 0x56
lea esp, [esp + 0x40]
call sub.ntdll.dll_NtClose
call fcn.0041d581
pushal
call fcn.004246be
pushal
mov byte [esp], 0xf9
mov dword [esp + 0x24], 0x40d030
jmp 0x41f5db
lea esp, [esp + 0x24]
call sub.ntdll.dll_DbgPrint
movsx ax, cl
aam 0x91
or al, 0x1d
add esp, 8
setbe al
mov eax, esi
jmp 0x426623
call fcn.00408b30
jmp 0x41d306