joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4950fa
Capabilities:
Encode data using xor

Disassembly:
push ds
sbb byte [ecx + 0x48e9930a], 0x1b
push cs
shr dword [eax + 0x43], cl
mov ebp, 0xfccc34f
out dx, eax
add al, 0xc9
pop ecx
sbb eax, 0x510f62c7
js 0x4950d7
aad 0x8f
in al, dx
fbld tbyte [esi - 6]
test al, 0xad
lodsd eax, dword [esi]
dec edx
outsd dx, dword [esi]
mov dword [esi + ecx + 0x65], esp
inc ecx
pop esp
and ch, cl
pmaxub mm6, qword [ecx + ebp*8]
sub al, 0x3d
lodsd eax, dword [esi]
pop edi
scasb al, byte es:[edi]
stosb byte es:[edi], al
inc esp
push ecx
push 0x109b7af3
or al, 0x74
and ebx, dword [esi + ecx - 0x3b]
lds eax, [edi + 0x27]
lds eax, [edi + 0x27]
push 0x4d604303
out dx, eax
xor cl, byte [ecx + ebp*2]
mov esi, 0x9fdf6c4a
in al, dx
mov esp, 0xdebf880f
loopne 0x4950ef
inc esp
adc eax, 0x19c838ce
inc ebx
mov cl, 0x1f
out dx, al
or eax, dword [0x8a9a1bf8]
cdq
push esp
out dx, eax
mov eax, dword [0x5cec941f]
dec eax
jns 0x4950b4
cmp byte [edi + 0x31], 0xa9
lodsb al, byte [esi]
iretd

Function at 0x4bac9d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43a8
cmp edx, dword [eax]
je 0x4bacbf
add eax, 8
inc ecx
cmp eax, 0x4c4438
jl 0x4bacb0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43a8]
jne 0x4baded
mov eax, dword [0x4c8d2c]
cmp eax, 1
je 0x4badc7
test eax, eax
jne 0x4bacf0
cmp dword [0x4c42d0], 1
je 0x4badc7
cmp edx, 0xfc
je 0x4baded
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bad27
lea eax, [ebp - 0x1a4]
push 0x4bfd10
push eax
call fcn.004bb680
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbb10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bad6a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbb10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfd0c
push edi
call fcn.004bd9e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfcf0
push eax
call fcn.004bb680
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb690
lea eax, [ebp - 0xa0]
push 0x4bfcec
push eax
call fcn.004bb690
push dword [esi + 0x4c43ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb690
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfcc4
push eax
call fcn.004bd954
add esp, 0x2c
pop edi
jmp 0x4baded
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43ac]
push 0
push eax
push dword [esi]
call fcn.004bbb10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x348b858b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x348926a8]
jne 0x348b8d3e
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x348dd248], eax
mov dword [0x348dd244], ecx
mov dword [0x348dd240], edx
mov dword [0x348dd23c], ebx
mov dword [0x348dd238], esi
mov dword [0x348dd234], edi
mov word [0x348dd260], ss
mov word [0x348dd254], cs
mov word [0x348dd230], ds
mov word [0x348dd22c], es
mov word [0x348dd228], fs
mov word [0x348dd224], gs
pushfd
pop dword [0x348dd258]
mov eax, dword [ebp]
mov dword [0x348dd24c], eax
mov eax, dword [ebp + 4]
mov dword [0x348dd250], eax
lea eax, [ebp + 8]
mov dword [0x348dd25c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x348dd198], 0x10001
mov eax, dword [0x348dd250]
mov dword [0x348dd14c], eax
mov dword [0x348dd140], 0xc0000409
mov dword [0x348dd144], 1
mov eax, dword [0x348926a8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x348dcb58]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x348dd190], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x348926e8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x348dd190], 0
jne 0x348b8e2e
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x348b90cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x348b90da
pop dword [ebp - 0x3c]
mov eax, 0x44bd4afb
sub eax, 0x1031ba21
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x5f9865e3
sub dword [ebp - 0x4c], 0x11462098
mov dword [ebp - 0x48], 0x68163cc5
sub dword [ebp - 0x48], 0x35e2f080
mov dword [ebp - 0x44], 0x3acf0f55
sub dword [ebp - 0x44], 0xee82cb27
mov dword [ebp - 0x40], 0xc061d946
sub dword [ebp - 0x40], 0xc061d946
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xf14fa373
add eax, 0x43396db5
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x2d3896b6
sub dword [ebp - 0x4c], 0xb8c62d60
mov dword [ebp - 0x48], 0x7bbc42d6
add dword [ebp - 0x48], 0xc5b01e9f
mov dword [ebp - 0x44], 0x4c5abf62
add dword [ebp - 0x44], 0x1714ad0a
mov dword [ebp - 0x40], 0x69c95d9a
add dword [ebp - 0x40], 0x9636a266
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x502385ed
sub eax, 0x1b9a7421
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a068
push 0
call eax
mov ecx, 0x43a8
mov edx, eax
mov edi, 0xd73586c0
add edi, 0x5d589940
add edi, dword [ebp - 0x3c]
mov esi, 0x1f38400f
add esi, 0xac83b25
sub dword [ebp - 0x18], 0x4dc1f7c0
mov ebx, dword [edi]
add dword [ebp - 0x14], 0xaac4bc8a
xor ebx, esi
mov dword [ebp - 0x2c], 0xa28aa804
mov dword [edx], ebx
add edx, 0x2d0a3093
add edx, 0xd2f5cf71
add edi, 0xb4ee7a83
sub edi, 0xb4ee7a7f
loop 0x348b91f6
add eax, 0x10173
mov ebx, eax
add eax, 0xfd8d7e45
add eax, 0x27281c0
mov ecx, 0x20067d83
sub ecx, 0xeb7d7d83
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x405f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x405f7f
pop dword [ebp - 0x34]
mov eax, 0x28a3e279
sub eax, 0x286382fa
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x9bba4045
add dword [ebp - 0x44], 0xb2980506
mov dword [ebp - 0x40], 0x7cc3bfbc
add dword [ebp - 0x40], 0xb56f8c89
mov dword [ebp - 0x3c], 0x2d28067d
add dword [ebp - 0x3c], 0x1f243db1
mov dword [ebp - 0x38], 0x88ed7524
sub dword [ebp - 0x38], 0x88ed7524
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x3786634e
add dword [ebp - 0x44], 0x3cec0608
mov dword [ebp - 0x40], 0x7d00f71c
add dword [ebp - 0x40], 0xc46b6a59
mov dword [ebp - 0x3c], 0x1e490ece
add dword [ebp - 0x3c], 0x45265d9e
mov dword [ebp - 0x38], 0x12f3ec83
sub dword [ebp - 0x38], 0x12f3ec83
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3f71f
push 0
call eax
mov ecx, 0x5a97
mov ebx, eax
mov esi, 0x41c000
add esi, dword [ebp - 0x34]
mov edi, 0x34a398ae
sub dword [ebp - 8], esi
mov edx, dword [esi]
sub dword [ebp - 8], 0x36364cf
xor edx, edi
xor dword [ebp - 4], eax
mov dword [ebx], edx
xor dword [ebp - 0x2c], 0x8246f586
add ebx, 0xdb5e1f3d
add ebx, 0x24a1e0c7
add esi, 0xd3cbc997
add esi, 0x2c34366d
loop 0x406085
add eax, 0x15d2f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4b428cd9
sub ecx, 0x4b028cd9
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x180ec022
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test edx, edx
je 0x180ec02c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.180ebd3e
or dl, byte [edi + 0x76]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.180ebd4e
push eax
push esi
push dword [ebp + 8]
call fcn.180ebd03
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.180ebd3e
out dx, al
fdivr dword [edi]
add al, 0x8d
inc ebp
call 0x68f71e34
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.180ebd4e
push eax
push esi
push dword [ebp + 8]
call fcn.180ebd03
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.180ebd4e
push eax
push esi
push dword [ebp + 8]
call fcn.180ebd03
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
inc esp
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.180ebd4e
push eax
push esi
push dword [ebp + 8]
call fcn.180ebd03
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.180ebd3e
pop edx
jnp 0x180ec172
out 0x88, al
popfd
jl 0x180ec1c3
invalid
invalid
Function at 0x180ec2ab
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.180ebcaf
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
push es
push es
jb 0x180ec27b
call fcn.180ebd3e
xchg edx, eax
shl dword [edi - 6], 1
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x180ec52d
add eax, esi
mov dword [ebp - 0x44], eax
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40645d
pop dword [ebp - 0x44]
mov eax, 0x40645d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc2f262b8
sub dword [ebp - 0x54], 0x74a01d6d
mov dword [ebp - 0x50], 0xf92f77bc
sub dword [ebp - 0x50], 0xc6fc2b77
mov dword [ebp - 0x4c], 0xc2fe0925
sub dword [ebp - 0x4c], 0x76b1c4f7
mov dword [ebp - 0x48], 0x9364b639
sub dword [ebp - 0x48], 0x9364b639
lea eax, [ebp - 0x54]
push eax
mov eax, 0x72545482
sub eax, 0x7213d40a
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x70869f26
add dword [ebp - 0x54], 0x3ebca30
mov dword [ebp - 0x50], 0xc0d5c3c1
add dword [ebp - 0x50], 0x80969db4
mov dword [ebp - 0x4c], 0x423981f8
sub dword [ebp - 0x4c], 0xdeca158c
mov dword [ebp - 0x48], 0x81476ae4
sub dword [ebp - 0x48], 0x81476ae4
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x60bebfd0
add eax, 0x9f81c0ac
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37a87
push 0
call eax
mov ecx, 0x4a6c
mov edx, eax
mov ebx, 0x459200
add ebx, dword [ebp - 0x44]
mov esi, 0xec5e6ae2
add esi, 0x5aa6dcec
mov dword [ebp - 0x24], 0xd233c234
mov edi, dword [ebx]
add dword [ebp - 4], edi
sub edi, esi
add dword [ebp - 0x24], esi
mov dword [edx], edi
xor dword [ebp - 0x1c], 0x9f859a02
add edx, 0x317a15d6
sub edx, 0x317a15d2
add ebx, 0xf017162d
sub ebx, 0xf0171629
loop 0x40656e
add eax, 0x32758573
add eax, 0xcd8b9710
mov ebx, eax
add eax, 0xd8c11323
sub eax, 0xd8c1131e
mov ecx, 0xaeae7d66
sub ecx, 0xae6e7d66
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x4811cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x4810be
lea edx, [edi*4]
lea ebx, [ecx + ecx]
rdtsc
sub esp, 0xe
jmp 0x4811f3
lea esp, [esp + 2]
jmp 0x481234
lea esp, [esp + 0xc]
sub esi, 0x7dd9883e
lea eax, [eax*4]
bsf edx, ebp
jl 0x481289
xchg al, dh
push edi
lea edx, [eax + ebp]
rdtsc
jmp 0x4812b1
xchg al, dh
push edi
lea edx, [eax + ebp]
jmp 0x48126e
rdtsc
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x48128b
jmp 0x481262
rol esi, 0
jmp 0x4812cd
clc
mov dh, 0xb7
bswap ebx
lea ebx, reloc.KERNEL32.dll_VirtualAlloc
mov dl, 0x5f
or edx, ecx
jmp 0x4824d5
lea esp, [esp + 3]
jmp 0x481274
bswap ebx
lea ebx, reloc.KERNEL32.dll_VirtualAlloc
mov dl, 0x5f
jmp 0x4812a1
jne 0x481294
clc
mov dh, 0xb7
jmp 0x4812b7
xchg edx, ebx
jmp 0x481732
xchg edx, ebx
bswap edx
rdtsc
jmp 0x4816fa
lea ebx, reloc.KERNEL32.dll_VirtualAlloc
jmp 0x4819a8
bswap edx
rdtsc
jmp 0x4816fa
jbe 0x48199b
lea eax, [ecx + ebx]
bt ax, di
jmp 0x481711
lea eax, [ecx + ebx]
bt ax, di
lea ebx, reloc.KERNEL32.dll_VirtualAlloc
add esi, dword [ebp]
sbb ebx, 0x3f107375
jns 0x4816e6
js 0x4816ee
xchg edx, eax
bswap eax
sete ah
add esi, 0x79212875
btc ax, sp
jmp 0x48182c

Function at 0x482482
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + esi]
not dx
mov edx, 0xf0167a4e
call fcn.0048246c
xchg dword [esp], edx
clc
push ebx
add esp, 3
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x4824b7
lea edx, [edx - 0x1f]
call fcn.00482cc5
les eax, [ecx - 0x2f]
mov al, 0x43
xrelease xchg byte [edx], al
nop
test dword [edx], reloc.KERNEL32.dll_VirtualAlloc
xor al, cl
or edx, edi

Function at 0x4829fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp]
mov dl, bl
pushfd
pop dx
lea esp, [esp + 2]
jmp 0x482c4c
xchg dword [esp], ebp
neg edx
push si
lea edx, [ecx + esi]
call fcn.00482a94
lea edx, [esi - 0x22]
lea eax, [esi*4]
jmp 0x482c76
inc dx
mov eax, 0xcd3dd4f5
mov eax, 0x3e887a1a
jmp 0x482d2e
clc
lea eax, [esi*4]
call fcn.00482da8
aad 0x42
sal byte [edi + 0x3a83fc42], 1
adc eax, 0xb866d8f7
neg eax
mov ax, 0x9fa1
push dword [esp + 0xc]
ret 0x10
dec bl
mov edx, 0x3235fb6f
lea edx, [esi*4]
jmp 0x483cb2
setg dl
jmp 0x482ded
lea eax, [esi + ebp]
jmp 0x482ea5
lea eax, [esi + ebp]
lea eax, [esi + 0x35]
jmp 0x482ea8
setg dl
mov edx, dword [ebp]
shr ax, cl
jno 0x482dcb
jo 0x482dd4
rcl dx, cl
js 0x482e27
jns 0x482e11
jge 0x482e42
jl 0x482e42
lea eax, [esp + ebx]
sbb eax, edx
jmp fcn.00482e60
lea eax, [esp + ebx]
sbb eax, edx
jmp fcn.00482e60
add ebp, 4
call 0x482df7
lea eax, [esi + 0x35]
mov dword [ebx + edi], edx
lea ebx, reloc.KERNEL32.dll_VirtualAlloc
cmc
jmp 0x482e0d
and ebx, 0x3c
pushal
adc edx, 0xc0636715
jg 0x482dea
jle 0x482dc6
jmp 0x482f50
dec bl
rdtsc
mov dx, sp
mov edx, dword [esp]
neg ah
jae 0x482f82
jb 0x482f50
dec edx
jmp 0x482fe8
lea eax, [esp + eax]
neg ax
jbe 0x4834a1
dec edx
jmp 0x4834a2
Function at 0x482bf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x482c24
xchg dx, ax
pop word [esp + 0x1c]
jmp 0x482c36
sub esp, 0x1e
jge 0x482c0e
xchg dx, ax
pop word [esp + 0x1c]
jmp 0x482c36
lea esp, [esp + 0x20]
dec bl
mov ax, 0x5625
mov al, byte [esp]
jmp 0x482c98
call fcn.00482d71
lea eax, [edx + 0xd0]
xchg ah, al
lea edx, [eax + eax]
ror bl, 0
jb 0x482c71
lea edx, [esi - 0x22]
lea eax, [esi*4]
inc dx
mov eax, 0xcd3dd4f5
mov eax, 0x3e887a1a
jmp 0x482d2e

Function at 0x482cf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xchg word [esp], ax
adc dx, 0x5fb3
xchg dx, ax
jmp 0x482d11
mov edx, esp
xchg dword [esp + 4], esi
pushfd
jmp 0x482cdc
lea esi, [esi - 0x1b]
stc
lea edx, [ebp*4]
setle dl
xchg dx, ax
xchg dword [esp + 8], esi
call fcn.00482cfb

Function at 0x4868a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax + ebp]
jmp 0x48686e
mov dl, cl
neg ax
jl 0x486832
lea eax, [eax + ebp]
mov ah, ch
stc
mov eax, 0x585c24ea
jmp 0x48687d
mov ah, ch
stc
mov eax, 0x585c24ea
jmp 0x48687d
neg dl
not ax
not ah
dec dl
jmp 0x48688c
lea eax, [ecx*4]
bsr ax, sp
jg 0x4868ac
mov eax, ebx
jmp 0x4868b7
mov dh, 0xb7
mov byte [esp], al
jmp 0x486848
mov eax, ebx
mov al, 0x75
jmp 0x4868fa
mov al, 0x75
jmp 0x4868fa
jmp 0x486d2f
lea esp, [esp + 2]
jmp 0x486d19
not dl
mov eax, ebp
mov al, bh
neg ax
jns 0x4868bb
js 0x486d2f
jmp [edi - 1]
sub dl, 0x72
bsr ax, bp
je 0x486d7e
jne 0x486d7e
or dword [ebx + reloc.KERNEL32.dll_VirtualAlloc], esp
xchg cx, ax
adc byte [ebx - 0x313d7ff6], dl
add dl, 0xce
mov eax, dword [esp]
push cx
mov eax, dword [esp]
xchg word [esp], ax
jmp 0x4868c0
call fcn.00486d59
clc
ror edx, cl
lea edx, reloc.KERNEL32.dll_VirtualAlloc
sub esp, 5
lea esp, [esp + 1]
jmp 0x486f0b
mov dx, 0x9096
rdtsc
call fcn.00486dc7
mov edx, 0x869b48b3
lea eax, [esp + ebx]
jmp 0x486e2d
lea edx, [eax + ebp]
not dl
mov dx, sp
lea edx, [ebp*4]
jmp 0x486e4d
xchg dh, al
setbe dl
ror cl, 0
jmp 0x486e17
mov ah, byte [esp]
jmp 0x486e5d
add cl, 0xcb
dec ah
jns 0x486e37
mov ah, byte [esp]
jmp 0x486ecd
lea eax, [edi*4]
rdtsc
xchg edx, eax
xchg ah, al
rol cl, 0
bswap edx
mov dl, byte [esp]
bsr ax, bx
jmp 0x486ea5
xchg dl, dh
jmp 0x486de4
rol cl, 0
shl dx, 4
jae 0x486ea9
jb 0x486eb6
xchg ah, al
jmp 0x486e6a
jne 0x486e8b
je 0x486e8b
lea edx, [edx*4]
jmp 0x486ef0
lea edx, [edx*4]
mov dl, 0x21
inc al
jmp 0x486ef4
lea eax, [edi*4]
rdtsc
xchg edx, eax
jmp 0x486ea1
mov dl, 0x21
inc al
pushal
call fcn.00486fd2
dec esi
sub ax, 0xf442
je 0x486e84
xchg dl, dh
mov dx, 0x9096
rdtsc
jmp 0x486dea

Function at 0x486d59
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, cl
lea esp, [esp + 1]
jmp 0x486d99
lea esp, [esp + 1]
push word [esp]
jmp 0x486d67
jge 0x486d43
mov al, cl
lea esp, [esp + 1]
jmp 0x486d99
sub bl, dl
jg 0x486d83
clc
jmp 0x486dba
lea esp, [esp + 1]
jmp 0x486f0b
ror edx, cl
lea edx, reloc.KERNEL32.dll_VirtualAlloc
sub esp, 5
jmp 0x486da0