joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483084
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4e5478]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0xb4]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5c
push 0
push eax
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xc0], ebx
call fcn.004c2a80
xor eax, eax
mov edi, ebx
push 0x40
pop ebx
push ebx
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
call fcn.004c2a80
add esp, 0x18
lea edi, [ebp - 0x58]
xor eax, eax
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
xor byte [ebp + eax - 0x58], 0x36
inc eax
cmp eax, ebx
jb 0x4830e9
lea ecx, [ebp - 0xb4]
call fcn.004b5890
push ebx
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0xb4]
call fcn.004b5950
push dword [ebp - 0xb8]
mov edx, dword [ebp - 0xbc]
lea ecx, [ebp - 0xb4]
call fcn.004b5950
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0xb4]
call fcn.004b5a50
push 0x5c
pop esi
mov ecx, esi
lea eax, [ebp - 0xb4]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x48313d
xor eax, eax
xor byte [ebp + eax - 0x58], 0x6a
inc eax
cmp eax, ebx
jb 0x483148
lea ecx, [ebp - 0xb4]
call fcn.004b5890
push ebx
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0xb4]
call fcn.004b5950
push 0x14
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0xb4]
call fcn.004b5950
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0xb4]
call fcn.004b5a50
lea eax, [ebp - 0xb4]
xor edx, edx
mov byte [eax], dl
inc eax
sub esi, 1
jne 0x483192
mov edi, dword [ebp - 0xc0]
lea esi, [ebp - 0x18]
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x14
lea eax, [ebp - 0x18]
pop ecx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4831ae
lea eax, [ebp - 0x58]
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0x4831b9
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 0x10

Function at 0x4838aa
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4e5478]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
mov ecx, dword [ecx + 4]
push ebx
push esi
push edi
push eax
push 4
push 0x4de994
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 3
push eax
call fcn.00485d3a
test eax, eax
jle 0x4838e8
mov eax, dword [ebp - 0x1c]
test eax, eax
js 0x483918
mov ebx, dword [ebp - 0x14]
xor edi, edi
mov esi, edi
cmp ebx, dword [esi + 0x4de4b0]
jne 0x48390c
push ebx
push dword [esi + 0x4de4b4]
push dword [ebp - 0x10]
call fcn.004c6760
cmp eax, ebx
je 0x483929
add esi, 0xc
inc edi
cmp esi, 0xcc
jb 0x4838f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret
imul eax, edi, 0xc
mov eax, dword [eax + 0x4de4b8]
jmp 0x48391a
Function at 0x48ff90
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
shr esi, 7
test esi, esi
je 0x490092
push edi
push 8
pop edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
xor dword [ecx + 4], eax
add edx, edi
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
add edx, edi
xor dword [ecx + 4], eax
add ecx, edi
sub esi, 1
jne 0x48ffa8
pop edi
pop esi
pop ebp
ret 4

Function at 0x49038a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ecx
cmp dword [ecx + 8], ebx
jbe 0x4903cc
push esi
push edi
mov eax, dword [ecx + 8]
mov esi, eax
imul eax, dword [ebp + 0xc]
mov edi, dword [ecx + 0xc]
imul esi, dword [ebp + 8]
push dword [ebp + 0x10]
mov ecx, dword [ecx]
add eax, ebx
add esi, ebx
push dword [edi + eax*4]
call fcn.00490252
mov ecx, dword [ebp - 4]
xor dword [edi + esi*4], eax
inc ebx
cmp ebx, dword [ecx + 8]
jb 0x49039d
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x491b7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov dword [esp + 4], ecx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
and dword [esp + 0x10], esi
mov eax, dword [ecx + 0x48]
mov ebx, dword [ecx + 0x50]
mov edx, dword [ecx + 0x4c]
push edi
xor edi, edi
add ebx, eax
mov dword [esp + 0x20], ebx
mov ebx, dword [ecx + 0x78]
adc edi, edx
mov dword [esp + 0x1c], edi
add ebx, eax
mov edi, dword [ecx + 0x7c]
adc edi, edx
mov dword [esp + 0x10], edi
cmp edi, dword [esp + 0x1c]
ja 0x491d3f
jb 0x491bd4
cmp ebx, dword [esp + 0x20]
jae 0x491d3f
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 0x54]
mov ecx, dword [eax + 0x50]
push esi
push ecx
push edi
push ebx
mov dword [esp + 0x28], ecx
call fcn.004c60a0
sub dword [esp + 0x18], eax
mov ecx, dword [esp + 0x20]
sbb esi, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov edx, ecx
sub edx, ebx
sbb eax, edi
cmp eax, esi
ja 0x491c19
jb 0x491c0f
cmp edx, dword [esp + 0x18]
jae 0x491c19
mov edi, ecx
mov ecx, dword [esp + 0xc]
sub edi, ebx
jmp 0x491c24
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x50]
sub edi, dword [esp + 0x24]
mov esi, dword [ebp + 8]
mov eax, ebx
push dword [esp + 0x10]
push ebx
sub eax, dword [esi + 0x48]
mov dword [esp + 0x20], eax
call fcn.00491f40
mov dword [esp + 0x24], eax
test eax, eax
jne 0x491c6d
cmp byte [esi + 0x68], 4
je 0x491d5e
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x491d1a
push edi
push eax
mov eax, dword [esp + 0x20]
add eax, ecx
push eax
call fcn.004c2a80
add esp, 0xc
jmp 0x491d1a
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x491cb7
mov ecx, 0x98
call fcn.0042061c
test eax, eax
je 0x491c8d
mov ecx, eax
call fcn.0041f276
mov esi, eax
jmp 0x491c8f
xor esi, esi
test esi, esi
je 0x491d68
mov eax, dword [esp + 0x18]
mov ecx, esi
push 0
push edi
push eax
push dword [ebp + 8]
call fcn.0041f410
mov dword [esp + 0x14], eax
test eax, eax
js 0x491d45
jmp 0x491cd2
mov esi, dword [eax]
mov eax, dword [eax + 0x14]
cmp edi, eax
jb 0x491cc2
mov edi, eax
mov eax, dword [esp + 0x18]
mov ecx, esi
push edi
push eax
push dword [ebp + 8]
call fcn.0041f456
mov eax, dword [esp + 0xc]
push dword [eax + 0x54]
push dword [eax + 0x50]
push dword [esp + 0x18]
push ebx
call fcn.004c60a0
mov ecx, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edi
mov eax, dword [ecx + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [ecx + 0x58]
mov dword [esi + 0x58], eax
mov al, byte [ecx + 0x68]
mov byte [esi + 0x68], al
mov eax, dword [esp + 0x24]
push esi
mov dword [esi + 0x94], eax
call fcn.0041f376
cmp dword [ebp + 0xc], 0
jne 0x491d51
add ebx, edi
mov edi, dword [esp + 0x10]
adc edi, 0
mov dword [esp + 0x10], edi
cmp edi, dword [esp + 0x1c]
ja 0x491d3d
jb 0x491bd4
cmp ebx, dword [esp + 0x20]
jb 0x491bd4
xor esi, esi
cmp dword [ebp + 0xc], 0
jne 0x491d51
test esi, esi
je 0x491d51
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x14], 0xc0e70014
jmp 0x491d3d
mov dword [esp + 0x14], 0xc000009a
jmp 0x491d3f
Function at 0x4966b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x4e5478]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov dword [esp + 0x18], ecx
mov edx, dword [ecx + 0x78]
mov eax, dword [edx + 0xc]
lea edi, [esp + 0x3c]
mov dword [esp + 0x1c], eax
lea ebx, [esp + 0x3c]
mov eax, dword [edx + 0x10]
xor esi, esi
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x28], eax
lea eax, [ecx + 0x14]
mov dword [esp + 0x2c], eax
lea eax, [ecx + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [ecx + 0x24]
mov dword [esp + 0x34], eax
lea eax, [ecx + 0x2c]
push 8
mov dword [esp + 0x3c], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 4]
mov edi, esi
dec ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov eax, dword [esp + edi*4 + 0x1c]
cmp eax, 0x24
jb 0x496758
cmp eax, ecx
ja 0x496758
mov ecx, dword [esp + 0x18]
mov edx, ebx
mov ecx, dword [ecx + 0x78]
add ecx, eax
call fcn.0041fb7c
mov dword [esp + 0x14], eax
test eax, eax
js 0x496793
mov ecx, dword [esp + 0x10]
inc edi
add ebx, 8
cmp edi, 4
jb 0x49672f
lea edx, [esp + 0x3c]
mov eax, dword [esp + esi + 0x1c]
cmp eax, 0x24
jb 0x496780
cmp eax, ecx
ja 0x496780
mov ecx, dword [esp + esi + 0x2c]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x10]
add esi, 4
add edx, 8
cmp esi, 0x10
jb 0x496765
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040548e
mov esp, ebp
pop ebp
ret

Function at 0x4a5002
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov edi, ecx
movzx eax, word [esi]
test ax, ax
je 0x4a502d
rol edx, 0x10
lea esi, [esi + 2]
movzx ecx, word [esi]
movzx eax, ax
xor edx, eax
mov eax, ecx
test cx, cx
jne 0x4a5018
mov eax, edx
xor edx, edx
div dword [edi + 0xc]
pop edi
mov eax, edx
pop esi
pop ebp
ret 4
Function at 0x4a9a84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebp - 0x18]
mov edx, dword [ebx + 0x24]
lea esi, [edx + 0xb0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x14]
jne 0x4a9b1f
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
jne 0x4a9b1f
and dword [ebp - 0x10], eax
movzx ecx, byte [ebx + 0x42c]
movzx eax, byte [ebx + 0x42d]
shl cx, 8
or cx, ax
mov dword [ebp - 0xc], 0xfe800000
movzx eax, byte [ebx + 0x42b]
mov word [ebp - 0x18], cx
mov ecx, 0xfe00
or ax, cx
mov ecx, 0xff
mov word [ebp - 0x16], ax
movzx eax, byte [ebx + 0x42a]
shl ax, 8
or ax, cx
movzx ecx, byte [ebx + 0x428]
mov word [ebp - 0x14], ax
movzx eax, byte [ebx + 0x429]
shl cx, 8
or cx, ax
mov eax, 0x200
xor cx, ax
mov word [ebp - 0x12], cx
lea edi, [ebx + 0x430]
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
lea ecx, [edx + 0xe0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ecx]
or eax, dword [ecx + 4]
jne 0x4a9b4b
mov eax, dword [edx + 0xe8]
or eax, dword [edx + 0xec]
je 0x4a9bf3
push ecx
lea eax, [edx + 0xf0]
push eax
push ecx
lea edx, [ebx + 0x430]
mov ecx, ebx
call fcn.004a8d9a
test eax, eax
jns 0x4a9b74
mov dword [0x50acfc], 0x4c79f0
jmp 0x4a9bf5
and dword [0x50b0ac], 0
mov edi, 0x1e848
and dword [0x50b0d4], 0
test byte [ebx + 0x1c], 1
push 2
pop esi
je 0x4a9ba1
cmp dword [0x50b254], 0
je 0x4a9ba1
push 0x18
pop esi
mov edi, 0xf4240
mov edx, 0x2dc6c0
mov ecx, ebx
call fcn.004a840a
mov edx, dword [ebx + 0x24]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
movzx eax, word [edx + 0xac]
push eax
lea eax, [edx + 0xe0]
add edx, 0xf0
push eax
call fcn.004a7ff2
mov ecx, edi
sub ecx, dword [ebp - 4]
add dword [0x50b0ac], ecx
mov ecx, dword [0x50b0d4]
inc ecx
mov dword [0x50b0d4], ecx
test eax, eax
jns 0x4a9bf3
cmp ecx, esi
jb 0x4a9ba1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ac2de
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push esi
push edi
rdtsc
mov edi, 0x4e20
mov esi, eax
push edi
call dword [0x50afa0]
rdtsc
sub eax, esi
xor edx, edx
add eax, 0x2710
div edi
xor edi, edi
inc edi
mov esi, eax
cmp dword [0x50ae48], 0
mov dword [0x50b000], esi
mov dword [0x50aff8], edi
je 0x4ac349
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
cmp esi, edi
jbe 0x4ac333
xor edx, edx
div esi
push esi
push 0x3c
push 0x4c7d8e
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
pop edi
pop esi
ret

Function at 0x4ad2c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0xc0000001
xor edi, edi
jmp 0x4ad2ec
cmp eax, 0xffffffff
je 0x4ad3a4
inc edi
cmp edi, 0x2710
jae 0x4ad302
push 0x64
call dword [0x50afa0]
mov eax, dword [ebx + 0xc]
add eax, 4
push eax
call dword [0x50afe4]
test eax, 0x800
jne 0x4ad2d2
xor esi, esi
cmp dword [0x50aff8], 0
je 0x4ad39e
cmp dword [0x50ae48], 0
je 0x4ad352
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, 1
jbe 0x4ad339
xor edx, edx
div ecx
push edi
push 0x1c5
push 0x4c7da2
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
cmp dword [0x50aff8], 0
je 0x4ad39e
cmp dword [0x50ae48], 0
je 0x4ad39e
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, 1
jbe 0x4ad385
xor edx, edx
div ecx
push esi
push 0x1c8
push 0x4c7da2
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, 0xc0000037
jmp 0x4ad352
Function at 0x4adf6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
inc dword [0x50af18]
push esi
mov esi, dword [0x50af40]
push edi
mov edi, edx
test esi, esi
je 0x4ae07c
test edi, edi
js 0x4ae07c
cmp edi, 0x1f
jae 0x4ae07c
test edi, edi
jne 0x4adfc1
mov ecx, dword [esi + 0x48600]
mov eax, dword [esi + 0x43fc]
xor eax, ecx
and eax, 1
xor dword [esi + 0x43fc], eax
xor eax, eax
test ecx, ecx
sete al
mov dword [esi + 0x48600], eax
add edi, edi
xor ecx, ecx
mov eax, dword [esi + edi*8 + 0x420c]
and eax, 0xffff0425
mov dword [esi + edi*8 + 0x4208], 0xfb0
or eax, 0x424
mov dword [esi + edi*8 + 0x420c], eax
xor eax, eax
mov word [esi + edi*8 + 0x420e], ax
lea eax, [ebp - 4]
lock or dword [eax], ecx
push 1
call dword [0x50afa0]
mov eax, dword [esi + 0x48600]
xor eax, dword [esi + edi*8 + 0x420c]
and eax, 1
xor dword [esi + edi*8 + 0x420c], eax
mov eax, dword [esi + 0x484dc]
push 0x100
add eax, 4
push eax
call dword [0x50aff0]
mov esi, dword [0x50af80]
inc esi
cmp dword [0x50aff8], 0
mov dword [0x50af80], esi
je 0x4ae0d5
cmp dword [0x50ae48], 0
je 0x4ae0d5
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, 1
jbe 0x4ae074
xor edx, edx
div ecx
push esi
push 0x6fb
jmp 0x4ae0c2
mov esi, dword [0x50af58]
inc esi
cmp dword [0x50aff8], 0
mov dword [0x50af58], esi
je 0x4ae0d5
cmp dword [0x50ae48], 0
je 0x4ae0d5
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, 1
jbe 0x4ae0bc
xor edx, edx
div ecx
push esi
push 0x6c0
push 0x4c84e6
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x4ae81a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor ebx, ebx
mov eax, dword [edi + 0x484dc]
add eax, 0x28
push eax
call dword [0x50afe4]
mov ecx, eax
test cl, 1
jne 0x4ae874
mov eax, dword [esi]
test eax, eax
je 0x4ae942
push 0xa
call dword [0x50afa0]
mov eax, dword [edi + 0x484dc]
add eax, 0x28
push eax
call dword [0x50afe4]
mov ecx, eax
mov eax, dword [esi]
cmp eax, 0xa
jae 0x4ae86a
push 0xa
pop eax
add eax, 0xfffffff6
mov dword [esi], eax
test cl, 1
je 0x4ae83e
mov eax, dword [edi + 0x484dc]
add eax, 0x20
push eax
call dword [0x50afe4]
mov ecx, eax
test cl, 1
jne 0x4ae8c3
mov eax, dword [esi]
test eax, eax
je 0x4ae993
push 0xa
call dword [0x50afa0]
mov eax, dword [edi + 0x484dc]
add eax, 0x20
push eax
call dword [0x50afe4]
mov ecx, eax
mov eax, dword [esi]
cmp eax, 0xa
jae 0x4ae8b9
push 0xa
pop eax
add eax, 0xfffffff6
mov dword [esi], eax
test cl, 1
je 0x4ae88d
test cl, 0x10
je 0x4ae927
cmp dword [0x50aff8], ebx
je 0x4ae912
cmp dword [0x50ae48], ebx
je 0x4ae912
mov esi, dword [0x50b000]
rdtsc
mov edx, dword [0x50aff4]
sub eax, edx
add edx, eax
mov dword [0x50aff4], edx
cmp esi, 1
jbe 0x4ae8f9
xor edx, edx
div esi
push ecx
push 0x8d4
push 0x4c8594
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
mov eax, dword [edi + 0x484dc]
push 0x80000012
add eax, 0x20
push eax
call dword [0x50aff0]
mov ecx, dword [edi + 0x484dc]
push 0x100
add ecx, 4
push ecx
call dword [0x50aff0]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
cmp dword [0x50aff8], ebx
je 0x4ae98c
cmp dword [0x50ae48], ebx
je 0x4ae98c
mov esi, dword [0x50b000]
rdtsc
mov edx, dword [0x50aff4]
sub eax, edx
add edx, eax
mov dword [0x50aff4], edx
cmp esi, 1
jbe 0x4ae973
xor edx, edx
div esi
push ecx
push 0x8a1
push 0x4c8594
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
mov ebx, 0xc0000037
jmp 0x4ae93c
cmp dword [0x50aff8], ebx
je 0x4ae98c
cmp dword [0x50ae48], ebx
je 0x4ae98c
mov esi, dword [0x50b000]
rdtsc
mov edx, dword [0x50aff4]
sub eax, edx
add edx, eax
mov dword [0x50aff4], edx
cmp esi, 1
jbe 0x4ae9c4
xor edx, edx
div esi
push ecx
push 0x8bb
jmp 0x4ae979
Function at 0x4ae9cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x50af40]
mov esi, 0xc0000001
xor ecx, ecx
mov ebx, dword [edi + 0x486f4]
lea eax, [ebx + 0x14]
cmp byte [eax + 1], 0
je 0x4ae9fd
cmp byte [eax], 3
jne 0x4ae9fd
mov edx, dword [eax + 4]
test edx, edx
jne 0x4aea0b
inc ecx
add eax, 0xc
cmp ecx, 6
jb 0x4ae9eb
jmp 0x4aea9f
imul eax, ecx, 0xc
mov ecx, edi
mov dword [edi + 0x486ec], edx
mov eax, dword [eax + ebx + 0x1c]
mov dword [edi + 0x486f0], eax
call fcn.004ae0da
mov esi, eax
test esi, esi
js 0x4aea9f
mov ecx, edi
call fcn.004ae1a6
mov esi, eax
test esi, esi
js 0x4aea9f
mov ebx, 0x16e360
lea edx, [ebp - 4]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.004ae81a
cmp dword [0x50aff8], 0
mov esi, eax
je 0x4aeaeb
cmp dword [0x50ae48], 0
je 0x4aea9f
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, 1
jbe 0x4aea83
xor edx, edx
div ecx
sub ebx, dword [ebp - 4]
push ebx
push 0x946
push 0x4c85b0
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
cmp dword [0x50aff8], 0
je 0x4aeaeb
cmp dword [0x50ae48], 0
je 0x4aeaeb
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, 1
jbe 0x4aead2
xor edx, edx
div ecx
push esi
push 0x949
push 0x4c85b0
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4aeaf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [0x50af40]
mov byte [ebp - 1], 0
lea ebx, [edi + 0x484c0]
mov eax, dword [ebx + 0x1c]
add eax, 0x20
push eax
call dword [0x50afe4]
mov ecx, eax
test ecx, ecx
js 0x4aebbd
inc dword [0x50af24]
cmp dword [0x50aff8], 0
je 0x4aeb75
cmp dword [0x50ae48], 0
je 0x4aeb75
mov esi, dword [0x50b000]
rdtsc
mov edx, dword [0x50aff4]
sub eax, edx
add edx, eax
mov dword [0x50aff4], edx
cmp esi, 1
jbe 0x4aeb5c
xor edx, edx
div esi
push ecx
push 0x9a8
push 0x4c85d0
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
lea edx, [ebp - 1]
mov ecx, ebx
call fcn.004ad3ac
mov esi, eax
test esi, esi
jns 0x4aeb8d
inc dword [0x50af48]
jmp 0x4aebcd
mov ecx, edi
call fcn.004ae1a6
test eax, eax
js 0x4aeb9e
inc dword [0x50af70]
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x16e360
mov ecx, edi
call fcn.004ae81a
mov esi, eax
test esi, esi
js 0x4aebd1
inc dword [0x50af5c]
jmp 0x4aebcd
and dword [ebp - 8], 0
lea edx, [ebp - 8]
mov ecx, edi
call fcn.004ae81a
mov esi, eax
test esi, esi
jns 0x4aec1d
cmp dword [0x50aff8], 0
je 0x4aec1d
cmp dword [0x50ae48], 0
je 0x4aec1d
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, 1
jbe 0x4aec04
xor edx, edx
div ecx
push esi
push 0x9c7
push 0x4c85d0
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4aede2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x50aff8], 0
push edi
mov edi, 0x4c7d4e
je 0x4aee3f
cmp dword [0x50ae48], 0
je 0x4aee3f
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, ebx
jbe 0x4aee2b
xor edx, edx
div ecx
push 0xa72
push 0x4c8600
push eax
push edi
call fcn.004ac34c
add esp, 0x10
call fcn.004aeaf2
mov esi, eax
test esi, esi
jns 0x4aee9d
cmp dword [0x50aff8], 0
je 0x4aefab
cmp dword [0x50ae48], 0
je 0x4aefab
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, ebx
jbe 0x4aee84
xor edx, edx
div ecx
push 0xa75
push 0x4c8600
push eax
push edi
call fcn.004ac34c
add esp, 0x10
jmp 0x4aefab
lea edx, [ebp - 8]
call fcn.004ad886
mov esi, eax
test esi, esi
jns 0x4aeefe
cmp dword [0x50aff8], 0
je 0x4aeffc
cmp dword [0x50ae48], 0
je 0x4aefb1
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, ebx
jbe 0x4aeee5
xor edx, edx
div ecx
push 0xa83
push 0x4c8600
push eax
push edi
call fcn.004ac34c
add esp, 0x10
jmp 0x4aefb1
mov ecx, dword [0x50af40]
mov edi, dword [ebp - 8]
test ecx, ecx
je 0x4aef3a
test edi, edi
js 0x4aef22
mov eax, dword [ecx + edi*4 + 0x48580]
shl eax, 0xc
add eax, 0x25400
add eax, ecx
jmp 0x4aef3c
mov eax, edi
and eax, 0x7fffffff
mov eax, dword [ecx + eax*4 + 0x48508]
shl eax, 0xc
add eax, 0x4400
jmp 0x4aef1e
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
jbe 0x4aef8c
mov ebx, dword [ebp + 8]
mov edx, 0xfb0
add ebx, 4
mov edi, eax
mov ecx, dword [ebx]
cmp ecx, edx
ja 0x4aef60
lea eax, [ecx + esi]
cmp eax, edx
jbe 0x4aef66
mov ecx, edx
sub ecx, esi
mov dword [ebx], ecx
push ecx
push dword [ebx - 4]
lea eax, [edi + esi]
push eax
call fcn.004c5a50
add esi, dword [ebx]
add esp, 0xc
add ebx, 8
mov edx, 0xfb0
sub dword [ebp + 0xc], 1
jne 0x4aef53
mov edi, dword [ebp - 8]
xor ebx, ebx
inc ebx
push esi
mov edx, edi
call fcn.004adc18
mov esi, eax
test esi, esi
js 0x4aefa3
and dword [0x511870], 0
jmp 0x4aefb1
cmp esi, 0xc00000b5
jne 0x4aefb1
mov dword [0x511870], ebx
cmp dword [0x50aff8], 0
je 0x4aeffc
cmp dword [0x50ae48], 0
je 0x4aeffc
mov ecx, dword [0x50aff4]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x50aff4], ecx
mov ecx, dword [0x50b000]
cmp ecx, ebx
jbe 0x4aefe3
xor edx, edx
div ecx
push esi
push 0xab3
push 0x4c8600
push eax
push 0x4c7d32
call fcn.004ac34c
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret 8