joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488370
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.00488980
add esp, 8
test al, al
je 0x488395
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x488395
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x488980
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x489df0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x489e1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x489e1b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4d0f50
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d0b55

Function at 0x4d0f5b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d0cd6

Function at 0x4d5f4d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d5727

Function at 0x4d5f58
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d5962

Function at 0x4d63eb
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d6172

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6ae538c
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x34081a76
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402d30
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404580
test esi, esi
jne 0x402d67
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404670
jmp 0x402d88
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402bcc
mov dword [esp], eax
test esi, esi
je 0x402d88
cmp dword [ebx], 0
je 0x402d88
dec esi
jmp 0x402d6f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4031a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x42e008], 0x8088405
inc edx
mov dword [ebx + 0x42e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403828
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x42e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038a0
xor eax, eax
push ebp
push 0x403899
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x42e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x42e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404378
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42f044], 0
je 0x4043d9
cmp word [0x42f218], 0xd7b2
jne 0x4043a1
cmp dword [0x42f220], 0
jbe 0x4043a1
mov eax, 0x42f214
call dword [0x42f230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42e074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404400
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x42e034], 0
jne 0x4043f5
push 0
push 0x42e06c
push 0x42e074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404534
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004029f4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x42f045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4044fc
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4061dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406242
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004047f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403220
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40622c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406249
lea eax, [ebp - 0x10]
call fcn.00404580
ret

Function at 0x40a964
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a99d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404670
jmp 0x40a9a6
mov eax, ebx
mov edx, esi
call fcn.004045d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a9b0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a9d1
mov al, byte [esp]
jmp 0x40a9d3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b068
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40aed0
mov eax, dword [0x42eaf4]
cmp byte [eax], 0
je 0x40b0e4
mov eax, dword [0x42ea14]
call fcn.004030f8
call fcn.00402af8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040828c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b12c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b11a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x42e9f0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42f660]
call fcn.0040566c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40be2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40be90
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004047f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407d58
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be97
lea eax, [ebp - 0xc]
call fcn.00404580
ret

Function at 0x40cb30
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00404580
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00404a1c
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x40cb75
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00404670
jmp 0x40cb8e
mov edx, ebx
dec edx
mov eax, esi
call fcn.00404afc
push ebx
mov eax, dword [esi]
call fcn.00404a1c
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x417ecd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
bswap bp
sub ebp, ebx
clc
mov ebp, esp
bswap edx
lea esp, [esp - 0x44]
movzx edx, ax
sal dh, 0x3b
movsx edx, cx
push ebx
and dl, 0xe
rcr dl, 0xda
sub eax, eax
mov dword [ebp - 0x2c], eax
ror dx, 6
sub eax, eax
push ebp
push 0x4900ed
push dword fs:[eax]
cmovno edx, eax
mov dword fs:[eax], esp
bt edx, edi
lea eax, [ebp - 0x28]
sbb dl, 0x4d
sub ecx, ecx
mov edx, 0x28
call fcn.00403184
mov eax, 0x4068a8
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
bswap ax
cdq
not edx
mov byte [ebp - 0x44], 0xdc
movzx ax, dl
mov byte [ebp - 0x43], 0x7c
movsx eax, dx
mov byte [ebp - 0x42], 0x42
bswap dx
cwd
mov byte [ebp - 0x41], 7
mov dx, sp
lahf
mov byte [ebp - 0x40], 0x2a
jmp loc.00499354

Function at 0x4255d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
movzx cx, dh
btc ecx, esp
shrd cx, di, 0x45
lea esp, [esp - 0x5c]
push ebx
shr ch, cl
mov cl, 0xcd
push esi
mov ch, dh
push edi
shr esi, 0x81
rol cl, cl
sub edx, edx
shr si, 0x6a
neg si
mov dword [ebp - 0x48], edx
clc
add ecx, 0x43116f9c
mov dword [ebp - 0x3c], edx
adc cl, 0x5c
sbb cx, cx
bts esi, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
test ebp, 0xdbf0f2e
xor ecx, esi
add esi, 0x47121fc2
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], edx
mov esi, eax
rcr dx, cl
sub dh, bl
add ecx, esp
xor eax, eax
mov cl, dh
cwd
push ebp
movzx ecx, ax
movsx cx, bh
mov cl, 0x24
push 0x4a5d26
push dword fs:[eax]
movzx edx, di
mov cx, sp
jmp loc.0056b2fd
Function at 0x483127
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
cwde
push esi
movzx eax, di
mov eax, dword [edi + 0x164]
jmp 0x49331d
pop ebx
jmp loc.0042a9a5
add eax, 2
jmp 0x457bde
call fcn.00570dde
test eax, eax
jmp 0x493ba1
push ebx
push esi
push edi
sar esi, 0x53
push ebp
sub si, 0x5bcf
xor edi, esp
lea esp, [esp - 0x40]
adc edi, 0x74fe1e8a
mov di, dx
mov esi, edx
mov edi, eax
xor ebx, ebx
stc
cmp al, 0xd9
cmp esi, ecx
cmp dword [edi + 0x164], 0
jmp 0x4eb0a8
cmp dword [edi + 0x164], 0
jmp 0x4ba493
push eax
setbe al
mov eax, dword [edi + 0x1c]
jmp 0x4d3a69
jne 0x4d2057
cmp dword [edi + 8], 0x3c
jmp 0x49dc0e
jg 0x4bf7d5
mov eax, esi
call fcn.00497619
add eax, eax
cmc
cmp bx, 0x7c8f
add eax, esi
add eax, 2
push eax
mov eax, esi
cwde
movsx ax, bl
push esi
cwde
not ah
movzx ax, ch
mov eax, dword [edi + 0x164]
jmp 0x4da412
je 0x4d2057
mov eax, dword [0x42e9c8]
mov eax, dword [eax]
jmp 0x47dd32
mov eax, esi
jmp 0x4c5a8e
call fcn.00497619
add eax, eax
cmp bx, bp
lea eax, [eax + esi]
test ch, dl
jmp 0x47138c
call fcn.0056d6a0
mov eax, ebx
shld ebx, edi, 0x7c
test si, 0x24e8
jmp 0x52bbf2
push eax
push edi
jmp 0x4d2052
push eax
cwde
not ah
mov eax, dword [edi + 0x1c]
push eax
push edi
jmp 0x519762
pop ebp
pop edi
pop esi
jmp 0x470ac4
jne 0x4871ee
xor eax, eax
cmp dword [edi + 8], 0x2a8
jmp loc.0041deb2
call fcn.0042cf3c
jmp 0x4d2057
add esp, 0x40
jmp 0x4e2a73

Function at 0x48dba2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
sub bp, 0x44ac
adc ebp, edx
mov ebp, esp
cmc
cmp si, bx
add esp, 0xfffffe6c
cmp dx, 0x1f5e
push ebx
test ecx, edx
clc
push esi
cmc
stc
push edi
sub ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
test di, dx
cmp di, 0x1037
cmp dx, si
mov dword [ebp - 4], eax
xor eax, eax
test si, ax
stc
push ebp
cmp dl, 0x74
test di, dx
push 0x53d5c9
test esp, 0x359e71d5
push dword fs:[eax]
cmc
test bp, cx
mov dword fs:[eax], esp
sub eax, eax
cmc
cmp esp, eax
push ebp
push 0x41d188
push dword fs:[eax]
mov dword fs:[eax], esp
cmc
cmp dword [0x4538bc], 0
jmp loc.00424635

Function at 0x490e48
Capabilities:
Packed with generic packer

Disassembly:
je 0x537489
cmp dword [eax + 0x138], 0
jmp loc.004217da
ret 4
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
cmp dx, 0x154b
push esi
bt si, dx
xor esi, edi
sub ebx, ebx
mov esi, dword [eax + 0x140]
stc
test esi, esi
jmp 0x45e849
mov eax, ebx
pop esi
movsx bx, al
pop ebx
jmp 0x5684e0
mov esp, ebp
pop ebp
jmp 0x471e6b
Function at 0x497e3f
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x55611b
xor edx, edx
test eax, 0x4000000
jmp 0x4bf81e
je 0x506110
test eax, 0x40000000
jmp 0x4e5089
jmp 0x55611b
je 0x4bf82b
or edx, 0x200
cmc
test eax, 0x20000000
jmp 0x49c3d4
or edx, 0x20
jmp 0x4ac6f7
je 0x568994
test eax, 0x80000000
jmp 0x4ecb11
or edx, 0x10
mov eax, edx
jmp 0x55652f
je 0x4d5ed2
or edx, 0x40
jmp 0x474cb4
je 0x50ed44
test eax, 0x80000000
jmp 0x51a841
jmp 0x55611b
je 0x55610d
or edx, 8
jmp 0x530ffe
or edx, 2
jmp 0x55611b
test eax, 0x40000000
jmp 0x4fcade
test eax, 0x80000000
jmp 0x5001bc
je 0x502f00
or edx, 4
jmp 0x4ff87b
je 0x4e82d4
or edx, 0x80
jmp 0x5411e8
jmp 0x55611b
jmp 0x55611b
or edx, 1
movsx eax, cx
sete al
mov eax, 0x6cd05f81
mov eax, edx
ret
ret
test eax, 0x80000000
jmp 0x52c54a

Function at 0x49adde
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [ebp - 8], 0
jmp 0x551c54
mov dword [ebp - 0x10], ecx
cmp esi, 0x53d944b9
test esi, 0x73dc393f
sub ecx, ecx
test al, al
push ebp
clc
cmc
stc
push 0x4a5875
stc
push dword fs:[ecx]
cmp eax, 0x734d3290
mov dword fs:[ecx], esp
jmp 0x4a6507
jne 0x45ff01
sub eax, eax
movsx ecx, di
cwd
pop edx
seta cl
mov cx, sp
pop ecx
bswap cx
pop ecx
jmp 0x4f0c44
push ebp
bsr bp, ax
mov ebp, esp
add esp, 0xfffffff0
test edx, esp
push ebx
push esi
push edi
cmp dl, 0x32
xadd bx, bx
mov ebx, ecx
cmp ebx, esp
stc
sub ecx, ecx
jmp 0x471e92
mov dword [ebp - 4], edx
jmp 0x4d54b8
mov eax, dword [eax + 0x15c]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jmp 0x482a4f
pushal
mov ecx, dword [ebp - 4]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
cwde
popal
cbw
mov eax, dword [ebp - 0xc]
call fcn.00497619
mov dword [ebp - 0x10], eax
jmp 0x512c2f
jmp loc.0040d876
mov dword fs:[eax], edx
jmp loc.0040d876
mov dword fs:[eax], edx
jmp 0x4eacbb
jmp loc.0040d876
cmp dword [ebp - 0x10], 0
jmp 0x52697c
je 0x5269a2
mov ecx, dword [ebp - 0x10]
setl dh
bts dx, si
sbb edx, esp
add ecx, ecx
add ecx, 2
cdq
lahf
mov edx, ebx
movzx eax, di
mov eax, dword [ebp - 0xc]
call fcn.00402b8c
sub eax, eax
movzx ecx, bx
setg dh
movzx cx, cl
pop edx
pop ecx
movzx cx, dl
pop ecx
jmp 0x4ebe2c
jne 0x4da420
xor eax, eax
pop edx
movsx ecx, sp
bswap cx
cmovl cx, si
pop ecx
mov cx, 0x6931
pop ecx
mov dword fs:[eax], edx
jmp 0x50cbab
Function at 0x4a5a20
Capabilities:
Packed with generic packer

Disassembly:
call fcn.00490e48
mov ebx, eax
jmp 0x4d9920
push esi
cmp dx, 0x2e65
test ebp, 0x1a01c54
sub ebx, ebx
jmp 0x4a3d02
cmp dword [eax + 8], 0x258
jge 0x551849
mov ebx, dword [ebp + 8]
push ebx
jmp 0x477b06
push ebp
or ebp, esi
bsf ebp, edx
movsx ebp, bp
mov ebp, esp
cmc
add esp, 0xffffffe8
push ebx
jmp 0x4a0719
mov eax, dword [eax + 0x138]
mov dword [ebp - 0x14], eax
xchg al, ah
bswap eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
cmovg eax, edi
mov eax, dword [ebp + 8]
jmp 0x4cff90
mov dword [ebp - 8], eax
jmp 0x5644a5
jmp 0x50f9af
mov eax, ebx
pop esi
pop ebx
jmp 0x537515
je 0x50f9af
mov dword [ebp - 4], esi
jmp 0x4b3470
mov esp, ebp
movsx ebp, sp
xchg ebp, ebp
pop ebp
jmp 0x56b76d
push dword [ebp - 8]
jmp 0x54cb26
push dword [ebp - 0xc]
jmp 0x428f85
mov esi, dword [eax + 0x140]
test bh, 0xc9
test ebp, edi
cmp ax, cx
test esi, esi
je 0x50f9af
cmp dword [eax + 0x138], 0
jmp 0x52ea1a
pushal
mov ecx, esp
movsx cx, bh
movzx ecx, di
pushfd
not ch
setge cl
mov ecx, dword [ebp - 4]
push 1
jmp 0x5457d2
ret 4

Function at 0x4a5ddf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jae 0x5294f0
sub eax, eax
push ebp
not di
push 0x55dcfe
jmp 0x529b2e
push ebp
sbb bp, 0x312a
mov ebp, esp
test bh, 0x8e
lea esp, [esp - 0x38]
stc
clc
push ebx
cmp esp, ebp
push esi
cmp ebp, edi
push edi
cmc
cmp ebx, 0x2fa17ef4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
stc
mov dword [ebp - 0xc], 0x100000
jmp 0x4c03e6
cmp dword [ebp - 0xc], 0xffffffff
jmp 0x458bc5
mov esp, ebp
mov ebp, 0x2ee45142
pop ebp
jmp loc.004192b4
pop esi
pop ebx
jmp 0x50a6ff
mov al, byte [ebp - 5]
xchg edi, esi
pop edi
bswap si
jmp 0x51f419
push dword fs:[eax]
jmp loc.0042b77b

Function at 0x4b4db6
Capabilities:
Packed with generic packer

Disassembly:
call fcn.00403184
mov dword [ebp - 0xbc4], 0xffffffff
or ax, 0x3bba
mov eax, dword [ebp - 4]
mov dword [ebp - 0xbc0], eax
or al, 0xe0
btr eax, 0x5e
lea eax, [ebp - 0xbcc]
stc
mov dword [ebp - 8], eax
cbw
mov eax, dword [esi + 0x148]
test di, si
stc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jmp loc.0041cf46
push ebx
sar ebx, cl
cmovbe ebx, eax
push esi
btc si, sp
xchg ebx, esi
push edi
sbb esi, eax
shrd ebx, esi, 0xa0
rol bx, 0xd6
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
test si, ax
test dl, 0x9f
mov byte [ebp - 0xd], 0
xor eax, eax
test ecx, edi
clc
cmp esi, esp
mov dword [ebx], eax
shld ax, ax, 0xb0
mov eax, dword [ebp + 8]
sub edx, edx
cmp esp, edi
stc
mov dword [eax], edx
ror ax, cl
xor edi, edi
ror dx, cl
bt eax, ecx
sar al, 0xae
push ebp
adc al, bl
bswap eax
push 0x54fdc5
shl ah, 0x2e
push dword fs:[edi]
sbb dh, 0xf4
sbb dh, cl
mov dword fs:[edi], esp
add eax, 0x70060b9b
rcl ax, 0x6c
not ax
lea eax, [ebp - 0xbcc]
sub ecx, ecx
jmp 0x502e8e
push ebp
mov ebp, esp
add esp, 0xfffff434
jmp 0x498f79
mov edx, 0xbbc
jmp 0x468028
Function at 0x4b6360
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [ebp - 4], eax
shl eax, cl
sar al, 0x67
xadd eax, eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c], 0
jmp loc.00421946
push ebp
and bp, 0x3218
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
stc
clc
test ecx, ebp
push edi
test esp, 0x462f1b0f
jmp 0x4b32d7

Function at 0x4c7cfa
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebx
stc
push esi
push edi
test di, ax
jmp 0x53d58b
push ebp
add esp, 0xffffffe0
jmp loc.0041e47d

Function at 0x4cc616
Capabilities:
Terminate process

Disassembly:
call fcn.004053a8
call fcn.0040349c
call fcn.00402af8
push 0x1388
jmp 0x46d36f
call sub.kernel32.dll_Sleep
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
jmp 0x4e1c94
push eax
movsx eax, sp
movsx ax, bh
mov eax, dword [0x42ea14]
jmp 0x469535
push ebx
not bh
cmovno bx, sp
mov ebx, eax
jmp 0x529d23
call sub.kernel32.dll_TerminateProcess
pop ebx
jmp loc.00421273
call sub.kernel32.dll_AllocConsole
pushal
mov eax, ebx
sub edx, edx
push edx
jmp 0x4a4796
Function at 0x4d8511
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ecx, dword [ebp - 4]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
lahf
popal
setbe ah
lahf
mov eax, dword [ebp - 0xc]
call fcn.00497619
mov dword [ebp - 0x10], eax
cmp sp, bp
cmp dword [ebp - 0x10], 0
jmp fcn.0051568b
lea esp, [esp - 0x10]
stc
clc
push ebx
push esi
test bp, si
inc bx
push edi
mov ebx, ecx
xor ecx, ecx
jmp 0x5164a0
push ebp
mov ebp, esp
jmp 0x476e9c
jne 0x4e11df
sub eax, eax
cwd
mov edx, ecx
pop edx
setp cl
mov cl, 0xeb
pop ecx
cmovbe ecx, ebp
movsx ecx, ax
movzx ecx, dx
pop ecx
jmp loc.00419fe5
cmp dword [ebp - 8], 0
jmp 0x55db0d
mov dword [ebp - 0x10], ecx
cmp cl, 0x35
clc
test si, 0x6da1
xor ecx, ecx
stc
cmp bx, ax
push ebp
cmc
push 0x46c076
test di, sp
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dl, 0x8a
test ebp, 0xbd454e2
mov dword [ebp - 4], edx
mov eax, dword [eax + 0x160]
test ax, 0x6f4a
cmp ebp, 0x6393564d
mov dword [ebp - 8], eax
stc
cmp dword [ebp - 4], 0
jmp 0x4dd834
jne 0x418266
sub eax, eax
cdq
movsx dx, dh
setge dh
pop edx
pop ecx
not cx
pop ecx
jmp loc.0042634a
Function at 0x4e76fa
Capabilities:
Log keystrokes via polling

Disassembly:
jne 0x4a62c9
call fcn.004290c8
jmp fcn.004d1a65
push edx
not edx
mov edx, dword [0x451740]
jmp 0x4d1a5e
or al, byte [0x453870]
jmp 0x54566a
cmp edx, 0x98
jmp 0x53248d
je fcn.004d1a65
mov byte [0x451734], 0
cdq
cmc
mov eax, dword [ebx]
rcr dl, cl
btr dx, di
ror dh, 0xa4
mov eax, dword [eax + 0x38]
mov edx, dword [eax + 8]
jmp 0x4d20b8
mov al, 1
mov esi, eax
inc ax
sal al, cl
and esi, 0x7f
mov ax, 0x1eb3
add al, ah
ror ah, 0xd
mov eax, dword [ebx]
mov eax, dword [eax + 0x38]
cmc
cmp esi, edx
stc
mov byte [eax + 0x6a], 0
cmp byte [0x451734], 0
jmp 0x4a9b3c
push edx
mov edx, dword [0x4538a8]
jmp 0x498d69
push edx
push eax
call fcn.00549aae
cmp edx, 0x50
jge 0x5131f8
push 1
cbw
push 1
cbw
movsx eax, ax
push 1
mov eax, dword [ebx]
mov eax, dword [eax + 0x38]
jmp loc.00427731
push ebx
bts bx, ax
push esi
or bh, dh
push edi
sbb al, 0xa4
mov ebx, dword [0x42e9c8]
add al, 0x77
sbb al, 0xe3
setno al
mov al, byte [0x451734]
test sp, bx
jmp 0x49fdfb
cmp edx, 0x57
jmp 0x491603
jne 0x53d91a
call fcn.00429074
jmp fcn.004d1a65
push dword [0x4538a4]
movzx dx, bh
setg dl
not dh
push dword [0x4538a0]
cdq
cwd
cmovb dx, sp
push dword [0x45389c]
not dh
mov edx, esp
xchg edx, edx
push dword [0x453898]
push dword [0x453894]
movsx edx, di
cwd
push dword [0x453890]
setl dl
mov edx, dword [0x4538b8]
jmp 0x4b9ddc
jne 0x4b96b8
cmp byte [0x45388c], 0
jmp loc.00418b75

Function at 0x4fc52a
Capabilities:
Check for software breakpoints
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
sar bp, 0x42
mov ebp, esp
jmp 0x566ca1
mov dword [ebp - 8], edx
cmc
cmp si, dx
mov dword [ebp - 4], eax
clc
xor eax, eax
mov dword [ebp - 0xc], eax
stc
cmp dword [ebp - 4], 0
je fcn.0042c77a
xor edx, edx
bsr ax, si
push ebp
mov eax, ebp
stc
rcr ah, cl
push 0x5388d3
or ax, 0x5dc4
sal al, cl
push dword fs:[edx]
mov dword fs:[edx], esp
jmp 0x52dada
mov eax, dword [ebp - 4]
test ecx, esp
mov eax, dword [eax + 0x3c]
test ax, ax
add eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
stc
btc eax, 0x8f
bts ax, bx
mov eax, dword [ebp - 4]
cmp di, ax
cmp word [eax], 0x5a4d
jmp loc.0041b28e
lea esp, [esp - 0x24]
clc
stc
push ebx
test si, 0x7d5f
cmc
push esi
cmp bh, bl
push edi
cmp esp, 0x78120b34
jmp 0x520ba7

Function at 0x4fc66e
Capabilities:
Check http status code

Disassembly:
push 0xcd6570f8
call fcn.004c06d8