joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a95c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
jmp 0x4a9714
jmp 0x4a96e8
mov si, word [esp]
jmp 0x4a96c2
js 0x4a960a
lea esp, [esp + 4]
jne 0x4a94a1
je 0x4a948b
jnp 0x4a95b6
dec edi
sub bl, cl
pushal
mov dl, 0xad
mov esp, 0xe0e8c72b
invalid
invalid
mov edi, 0x851e926a
jmp 0x4a96b2
mov cl, byte [esi + 1]
mov di, 0x2d23
mov al, ah
mov al, byte [esp]
jmp 0x4a960b
lea eax, [esi - 0x15]
lea eax, reloc.USER32.dll_MessageBoxA
jmp 0x4a9623
pop word [esp + 0x13]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
je 0x4a94a1
lea edi, [esi*4]
jmp 0x4a963a
shl edi, 0x1d
neg edi
shr edi, 0x15
jmp 0x4a9694
inc esi
lea edi, [edx + edx]
not di
bswap edi
inc edx
jmp 0x4a966e
movzx edi, cl
sub eax, edi
je 0x4a948b
jne 0x4a94a1
sahf
push ss
test bl, ah
push ds
fisttp qword [ebx + ecx*4]
sbb edi, dword [esi - 0x73]
xor al, 0xae
movzx eax, byte [edx + 1]
mov edi, dword [esp]
mov di, word [esp]
mov edi, dword [esp]
jmp 0x4a9688
pop esi
push edx
pushal
cmc
jmp 0x4a96f8
push edx
lea esp, [esp + 4]
pop edi
bswap esi
shr si, cl
jmp 0x4a94a6
lea esp, [esp + 0x24]
test eax, eax
push edx
lea esp, [esp + 1]
call fcn.004a96c8
idiv byte [edi - 0x11]
mov bh, byte [ecx + 0x33]
ror byte [ebp - 0x24], cl
das
and dword ss:[esi - 1], esp
je 0x4a973c
push word [esp + 3]
lea esp, [esp + 2]
lea esp, [esp + 0xc]
add ecx, dword [ebp - reloc.USER32.dll_MessageBoxA]
and al, 0xc
test cl, cl
pushal
jmp 0x4a9652
jmp [esi - 0x1e]

Function at 0x54e4ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ebx, 0xaaa14fac
rdtsc
pop dword [esp]
xchg byte [esp], al
push word [esp + 4]
jmp 0x54e5f3
jmp 0x54e4cd
pop word [esp + 5]
push word [esp + 1]
xchg word [esp + 3], ax
lea eax, [ebx + edi]
lea esp, [esp + 0x2b]
mov ch, byte [esp + 4]
mov al, 0xf6
lea esp, [esp + 1]
jmp 0x54e550
lea ecx, [eax*4]
pop edx
mov dword [esp + 3], esi
not dx
mov byte [esp + 0xc], bh
sub esp, 8
jmp 0x54e56a
xchg word [esp + 0x1b], bp
bswap esi
lea ebx, [esi + 0xb5]
neg ax
mov si, word [esp + 0x14]
pop word [esp + 5]
jmp 0x54e594
not dh
cld
pushal
push esp
lea esp, [esp + 0x15]
pushal
jmp 0x54e5b3
Function at 0x54e6eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
pop si
bsf ax, si
mov edi, dword [esp]
mov esi, ecx
mov esi, 0x884c5704
jmp 0x54e715
mov word [esp], di
xchg dword [esp], ebx
mov bl, bh
xchg word [esp + 1], di
mov esi, 0x28fad9a2
mov word [esp], sp
jmp 0x54e6ad
rdtsc
cld
cld
jmp 0x54e6cc
lea ebx, [ebx + edi]
mov al, 0x46
rdtsc
and esi, ecx
sub esp, 0x16
xchg ah, bl
jmp 0x54e7cc
mov ax, di
not si
lea esi, [eax*4]
setle dh
add esp, 1
jmp 0x54e6f1
shr ebx, 0x1d
mov bp, sp
xchg edi, ebx
mov dx, 0x1eb5
mov esi, 0xa733a3e
bswap edi
jmp 0x54e793
pop word [esp + 0xe]
sub esp, 0x16
not ax
pushal
lea esp, [esp + 0x47]
mov ax, word [esp]
jmp 0x54e747
lea edi, [ebx*4]
and ebp, ecx
mov ax, word [esp]
lea edi, [esp + eax]
mov dx, di
setg dh
jmp 0x54e86b
mov eax, dword [esp]
rdtsc
mov bx, 0xfa4f
mov di, word [esp]
lea esi, reloc.USER32.dll_MessageBoxA
jmp 0x54e777
not ch
xchg byte [esp + 8], cl
pop eax
mov eax, dword [esp + 1]
inc ebx
mov cx, word [esp + 0x10]
jmp 0x54e761
cpuid
lea ebp, [ebx + ebx]
xchg word [esp + 7], di
mov byte [esp + 0x11], ch
mov word [esp + 8], bx
rdtsc
jmp 0x54e7b1
stc
mov dword [esp + 7], esi
not dh
xchg ah, bl
not si
setnp dh
jmp 0x54e837
xchg byte [esp + 4], dl
lea esp, [esp + 3]
btr esi, esp
mov word [esp + 1], dx
jmp 0x54e81f
mov eax, dword [esp]
cpuid
shl si, cl
btc edx, edi
xchg ah, bl
sub esp, 0xc
jmp 0x54e7e3
push dword [esp + 3]
bswap edi
mov bh, byte [esp + 2]
mov dl, 0xcc
mov ecx, eax
jmp 0x54e84d
pop word [esp + 3]
lea ebp, [edx + ebp]
mov esi, eax
xchg bh, cl
not edi
lea ecx, reloc.USER32.dll_MessageBoxA
jmp 0x54e7f4
xchg word [esp + 5], bx
pop word [esp]
xchg byte [esp + 6], dl
inc bl
sub esp, 4
sub esp, 0x1e
jmp 0x54e8f8
mov edi, dword [esp]
add ecx, ebp
mov ax, dx
xchg ch, dl
sub dx, 0x1208
clc
jmp 0x54e80d
mov bl, 0x20
cld
btr edi, esp
bsr bx, cx
mov dh, byte [esp + 7]
inc bl
jmp 0x54e8d5
bswap ecx
lea edx, [edx*4]
setp ah
add esp, 0x1f
add edi, ebp
mov byte [esp + 6], bh
jmp 0x54e8a7
btr edx, esp
push word [esp + 7]
mov dl, dh
ror bh, 3
xchg byte [esp + 5], dl
pop dword [esp]
jmp 0x54ec1c
stc
pop dword [esp + 0x22]
mov ebx, 0xde791734
mov ah, byte [esp + 0x16]
lea ebx, [esi + 0x6d]
sub ebp, eax
jmp 0x54e8be
mov cx, word [esp + 6]
mov word [esp], sp
mov byte [esp], bh
lea ebp, [ebx*4]
jmp 0x54e9c4
inc cl
pop dword [esp]
lea esi, reloc.USER32.dll_MessageBoxA
mov byte [esp + 6], dh
pop edx
mov esi, dword [esp + 5]
jmp 0x54e922
pop dword [esp]
cpuid
rdtsc
call fcn.0054e977
mov esp, 0x35c6a333
ret 0x34a2
bswap ebp
mov ebx, 0x58c7bb1a
rdtsc
setae bh
lea edx, [edi*4]
sub esp, 0x10
jmp 0x54e93c
xchg word [esp + 1], ax
mov bl, bh
shr bh, 3
cmc
xchg word [esp + 1], bx
pop edx
jmp 0x54e9e1
push word [esp + 1]
mov word [esp], di
mov dword [esp], eax
pop ax
lea ebp, [ebp - 0xcf]
mov esi, dword [esp + 3]
jmp 0x54eae6
pop word [esp + 1]
mov dl, dh
mov dword [esp], esi
xchg edx, eax
xchg bx, si
clc
jmp 0x54eb5a
Function at 0x54e977
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
rcr edi, 3
rdtsc
lea esp, [esp + 0x1f]
pop ecx
mov esi, ecx
jmp 0x54e9a1
rdtsc
inc ebp
push word [esp + 0x19]
neg bh
xchg ch, dl
neg dx
jmp 0x54e985
xchg edx, ebx
lea eax, [ecx*4]
sub esp, 0x18
jmp 0x54e952
inc bp
sub esp, 0xa
sub esp, 0x12
mov word [esp + 0x17], bx
xchg word [esp + 0xf], di
mov ebp, dword [esp + 0x21]
jmp 0x54ea85
inc dl
mov edi, dword [esp + 2]
mov dh, byte [esp + 7]
setae ah
bsf dx, si
mov cx, 0x16b1
jmp 0x54e961
mov al, ah
not eax
cld
mov bx, 0xc545
rcl cx, cl
lea edi, [ecx*4]
jmp 0x54ea58
mov dl, 0xfc
mov dl, 0x44
bsf si, ax
bswap ecx
mov bp, word [esp]
btr ebp, edx
jmp 0x54e9fc
lea eax, [eax + edi]
mov si, word [esp + 0x12]
mov bl, 0xa8
push word [esp + 9]
pop word [esp + 1]
mov bx, 0x6471
jmp 0x54ea6b
clc
lea ecx, [ebp*4]
mov edx, esi
sub edx, eax
sub esp, 0x14
inc di
jmp 0x54ea31
push dword [esp + 2]
bsr ax, cx
pop dword [esp]
mov esi, 0x3792d27a
xchg byte [esp + 0x10], dl
jmp 0x54eacd
inc bl
pushal
lea esp, [esp + 0x5b]
cpuid
xchg ebx, eax
sub bl, ah
jmp 0x54ea1e
lea ebx, [eax - 0x81]
add esp, 0xb
add esp, 6
add esp, 1
neg ecx
xchg ebp, ebx
jmp 0x54eb31
mov ax, word [esp + 0xe]
mov dword [esp + 1], ebp
push word [esp + 5]
not dh
mov dword [esp + 7], eax
mov edi, esi
jmp 0x54ea93
inc edi
mov cx, 0xab13
neg bh
mov ebx, 0xd53dbb9c
sub esp, 0
xchg ebp, esi
jmp 0x54eaad
cld
mov cl, ch
btc ebx, edi
mov edi, eax
mov edi, 0xddd85d1a
mov al, 0xfe
jmp 0x54ebd7
mov esi, dword [esp + 3]
neg esi
add esp, 3
lea eax, [ebx*4]
mov byte [esp], bh
jmp 0x54eafc
mov ax, 0x9f07
lea edi, reloc.USER32.dll_MessageBoxA
bsr cx, bp
and cl, bh
mov edx, 0x674b9146
bsr cx, cx
jmp 0x54eb18
neg si
mov dl, 0xec
setns ch
call fcn.0054ebc0
ja 0x54eb81
add byte [eax], al
add byte [edi - 5], dh
imul ecx, dword [esi], reloc.USER32.dll_MessageBoxA
das
pop esi
test eax, 0xbef56bc8
dec edx
xchg esi, eax
adc eax, 0x8aa20fdd
int 0x60
cmc
mov esi, 0xdd15964a
cpuid
mov cl, ch
pushal
lea ebp, reloc.USER32.dll_MessageBoxA
jmp 0x54eb77
bsr bp, bp
cpuid
cpuid
inc ax
btc ebx, edi
lea esp, [esp]
jmp 0x54eb8e

Function at 0x54ed34
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x54ed64
mov word [esp + 6], bx
mov ebp, eax
lea edi, [eax - 0x61]
push word [esp]
lea ebp, [ebx + esi]
jmp 0x54edc1
mov cx, di
mov bh, byte [esp + 1]
pop bp
lea edi, [ebp*4]
xchg word [esp + 0x14], cx
lea esp, [esp + 4]
jmp 0x54eec7
shr edx, 0xb
mov cx, di
pushal
xchg word [esp + 6], bx
mov ah, byte [esp + 8]
jmp 0x54ed88
lea ecx, [edi + ebp]
mov cl, ch
mov dword [esp + 0xa], esi
not ah
mov dx, di
add esp, 0x12
jmp 0x54eda9
pop edi
mov ebx, eax
pop edx
pop ebp
pop ebp
lea edx, [ecx*4]
jmp 0x54ede8
mov ecx, dword [esp + 0xc]
lea esi, [ebp*4]
cpuid
rdtsc
mov eax, ebp
xchg word [esp + 0x18], si
jmp 0x54ee0a
mov dl, dh
not ecx
add esi, ebp
setp bh
xchg byte [esp + 4], dl
push edx
jmp 0x54ee8e
Function at 0x54f052
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
mov cx, 0xb753
jmp 0x54f05e
mov dword [esp], esi
xchg ch, dl
lea esp, [esp + 0xb]
push word [esp + 1]
not bh
rdtsc
jmp 0x54f182
xchg byte [esp + 1], bl
mov byte [esp], ah
lea esp, [esp + 1]
add esp, 1
mov cl, ch
jmp 0x54f118
bswap eax
xchg di, ax
mov cx, bx
bsr bp, cx
bsr cx, bp
jmp 0x54f0b9
add cx, 0x1cfe
rdtsc
lea esp, [esp + 5]
xchg dword [esp], ecx
mov word [esp], bx
inc cl
jmp 0x54f0d0
btr esi, esp
mov cx, bx
btc ebp, ebx
cpuid
inc ax
sub esp, 8
jmp 0x54f14c
xchg dh, al
xchg esi, ebx
xchg esi, eax
lea esp, [esp + 1]
bsr si, bp
neg ebx
jmp 0x54f0fd
xchg word [esp + 3], ax
neg bp
push word [esp + 6]
neg si
lea ebx, [ebp - 7]
lea eax, [ebx + edi]
jmp 0x54f200
xchg ebp, edx
xchg word [esp + 1], bx
pop word [esp + 4]
xchg byte [esp + 4], cl
lea ebx, [edx + ebx]
jmp 0x54f12a
pop cx
not bh
lea esp, [esp + 3]
push word [esp + 4]
mov al, ah
mov byte [esp + 5], bh
jmp 0x54f0e7
push dword [esp]
inc dx
mov al, 0x56
mov ebp, dword [esp + 3]
push esp
mov al, ah
jmp 0x54f166
mov al, 0x36
call fcn.0054f1ab
mov ebx, 0x88170e7e
cpuid
sub esp, 0xa
sub esp, 0x14
rdtsc
cpuid
jmp 0x54f29e
lea edi, [ebp*4]
bswap edi
inc ecx
mov bx, dx
jmp 0x54f516
lea ebx, [edx + ebp]
pushal
lea esp, [esp + 0x5b]
lea eax, [edx + ebx]
sub esp, 0xc
mov dword [esp + 1], ebp
jmp 0x54f287
mov word [esp + 2], di
xchg ah, bl
mov ah, byte [esp + 5]
rdtsc
pop ebx
call fcn.0054f46d

Function at 0x54f1ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
setae ch
mov cl, ch
mov ax, word [esp + 4]
mov word [esp], bx
pushal
sub esp, 0x14
jmp 0x54f1e1
lea edi, [esi - 0x1d]
xchg word [esp + 2], cx
add esp, 7
push word [esp + 3]
push dword [esp + 2]
jmp 0x54f192
mov word [esp + 6], dx
lea esp, [esp + 0x1b]
xchg byte [esp + 2], dl
lea ebx, [eax + edx]
lea edx, reloc.USER32.dll_MessageBoxA
jmp 0x54f2bf
xchg dh, al
setnp dh
popal
xchg ebx, eax
mov word [esp + 0x16], di
mov al, 0x86
jmp 0x54f1c1
mov byte [esp + 9], bh
lea eax, [esi + 0x25]
not ch
mov esi, 0x3f768ff6
pop word [esp + 0x17]
xchg dx, bp
jmp 0x54f207
and cl, bh
pop ecx
pop ax
sub esp, 0x1a
xchg word [esp + 0x13], dx
mov al, ah
jmp 0x54f21e
lea eax, [ecx*4]
not ebx
mov bp, bx
push word [esp + 2]
xchg byte [esp + 2], cl
xchg edi, edx
jmp 0x54f248
lea ebp, [esi*4]
inc edx
cpuid
push dword [esp + 1]
rdtsc
jmp 0x54f26e

Function at 0x54f46d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
mov ah, byte [esp + 8]
push word [esp + 1]
not di
rdtsc
call fcn.0054f2dc
cpuid
add esp, 5
mov eax, dword [esp + 3]
pop cx
rdtsc
xchg byte [esp + 2], dl
jmp 0x54f305
cpuid
mov word [esp + 0xc], bx
pop bx
mov ebp, 0x848a5c10
mov ch, byte [esp + 9]
mov edi, 0xeba0feee
jmp 0x54f33d
push dword [esp + 8]
jmp 0x54f438
Function at 0x550054
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 1]
mov byte [esp + 4], ah
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
pushal
jmp 0x550013
mov byte [esp + 0x1c], ch
clc
mov byte [esp + 0x11], dh
mov word [esp + 0x1a], dx
clc
mov dword [esp + 0x19], ebp
jmp 0x54ffca
mov dx, sp
mov word [esp + 0xc], di
popal
pushal
mov si, sp
add esp, 0x1d
jmp 0x550095
mov al, byte [esp]
not ah
pushal
sub esp, 4
cmc
lea ebx, [ecx + edx]
jmp 0x54fff9
call 0x550054
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor dword cs:[esi], ebp
cmp dword [esi], ebp
xor byte [eax], al
pushfd
pushal
mov dword [esp + 0x13], eax
clc
jmp 0x54ffe4
neg bx
xchg dh, al
inc edi
sub esp, 0xc
mov di, word [esp + 0xa]
push word [esp + 0xb]
jmp 0x5500d0
mov eax, ecx
bsr ax, cx
setns bh
lea esp, [esp + 7]
mov bp, 0xe573
mov si, word [esp]
jmp 0x55005d
push word [esp + 3]
cld
lea esi, [esp + eax]
xchg word [esp + 1], cx
xchg dword [esp + 1], esi
xchg dh, al
jmp 0x550078
bswap ecx
mov bl, pe_nt_image_headers32
pop ebp
mov cl, ch
mov ebx, 0xdfe4a16
lea esi, [eax*4]
jmp 0x5500e4
neg edx
mov ax, 0x1c0d
bswap edx
pop dword [esp + 4]
rdtsc
xchg byte [esp + 9], al
jmp 0x5500ab
sub esp, 4
lea ecx, reloc.USER32.dll_MessageBoxA
lea edi, [edi*4]
pop dword [esp]
shl cx, cl
mov dx, di
jmp 0x55019d
neg ch
bsf bx, si
mov bp, sp
mov bp, word [esp]
xchg di, bx
jmp 0x550169
add esp, 3
mov cx, dx
rol dx, cl
rdtsc
mov ebp, dword [esp]
mov esi, eax
jmp 0x550113
btr esi, esp
btc eax, ebx
rdtsc
mov word [esp], dx
stc
cmc
jmp 0x550129
cmc
xchg ebx, edi
pop dword [esp + 5]
mov dword [esp + 0x12], ebp
mov ebx, ecx
xchg ch, dl
jmp 0x55017d
lea edx, [eax + 0x69]
mov bl, 0x50
lea ebp, [ecx*4]
sub esp, 0x16
push edx
xor dl, ch
jmp 0x550151
pop dword [esp + 1]
mov al, 0x5e
xchg di, si
mov byte [esp + 5], bh
lea ecx, [edx*4]
xchg ah, bl
jmp 0x5501cb
not edx
pop dword [esp]
not bh
mov dword [esp], esi
mov byte [esp + 2], dh
mov word [esp], dx
jmp 0x550141
xchg edx, edi
add esp, 0x14
rdtsc
mov si, 0xc77d
cpuid
xchg ah, bl
jmp 0x550234
pop eax
btc eax, edi
btc esi, ebx
push word [esp + 0xc]
xchg dword [esp + 0xc], ebx
push dword [esp + 0xa]
jmp 0x5501b1
lea ebp, reloc.USER32.dll_MessageBoxA
push edx
bsf bx, ax
mov bx, 0x52d
jmp 0x550247
ror ch, 5
lea edi, [esp + ebx]
lea esp, [esp]
mov edx, eax
inc dx
jmp 0x5501e1
neg cx
xchg edi, edx
lea edi, [edx*4]
bswap ecx
mov ecx, 0xb1ea85de
cpuid
jmp 0x5501f7
xchg byte [esp], cl
lea esp, [esp]
mov esi, 0x441fc4da
cld
xchg ah, bl
lea esp, [esp]
jmp 0x55020f
setns dh
btc esi, ebx
mov bl, 0x50
call fcn.005503f6
mov dl, byte [edx + ecx*4]
in eax, dx
sbb al, 0x9b
add dword [ecx + reloc.USER32.dll_MessageBoxA], eax
rol dword [edx - 0x30], 0xb7
inc edx
movsb byte es:[edi], byte [esi]
cmp dword [edx], reloc.USER32.dll_MessageBoxA
xchg edx, eax
rdtsc
Function at 0x5505ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov bh, byte [esp]
rdtsc
neg esi
jmp 0x55063f
lea esp, [esp]
not dh
mov al, 0x46
neg di
xchg ch, dl
mov al, ah
jmp 0x550621
mov cl, 0xf2
push word [esp]
mov esi, 0xaf911748
cpuid
mov dword [esp + 3], esi
bsf bx, ax
jmp 0x55068b
mov bl, 0x40
xchg ah, bl
rdtsc
bsf di, si
sub ecx, eax
push esp
jmp 0x5505db
pop bx
setnp bh
mov bp, 0x23e5
rdtsc
mov eax, dword [esp + 5]
ror ch, 5
jmp 0x550e1e
bsr di, bp
xchg word [esp + 3], si
cld
add esp, 2
xchg dword [esp + 1], ecx
jmp 0x55064e
xchg byte [esp + 4], cl
cpuid
push word [esp + 6]
bsf bp, si
mov al, ah
xchg edi, edx
jmp 0x550673
rol bp, cl
pushal
pop word [esp + 0x1f]
call fcn.005507cb
js 0x5506f4
add byte [eax - 3], bh
insd dword es:[edi], dx
hlt
lea edi, [eax*4]
pop eax
pop dword [esp + 0xc]
setbe bh
mov di, 0x12bf
push dword [esp + 6]
jmp 0x5506e7
inc al
mov al, ah
mov ch, byte [esp + 0x15]
lea ebx, reloc.USER32.dll_MessageBoxA
jmp 0x550704
mov cx, word [esp]
inc si
lea esp, [esp]
mov si, 0xd5f3
sub esi, eax
sub esp, 0x1c
jmp 0x55072a
rcl dx, cl
bsf bx, si
lea esp, [esp + 1]
not edi
rdtsc
mov dh, byte [esp]
jmp 0x550742
pop word [esp + 2]
xchg dword [esp], esi
mov si, sp
add esp, 3
cpuid
cmc
jmp 0x5507f6
mov bl, 0x90
btr edi, edx
pop word [esp]
lea ecx, [ebp + 0x17]
bsf bx, si
push edx
jmp 0x5509c5
mov edi, eax
mov byte [esp + 3], ch
xchg byte [esp + 2], dl
cmc
xchg bh, cl
mov word [esp], sp
jmp 0x550bf5
cld
xor dl, ch
bsf cx, si
pop word [esp]
mov bl, bh
setge ch
jmp 0x550c52

Function at 0x550942
Capabilities:
Execute anti-debugging instructions

Disassembly:
not di
lea eax, [ecx*4]
mov bp, sp
lea esp, [esp + 4]
clc
jmp 0x5507e0

Function at 0x551478
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 2]
pop word [esp + 7]
push dword [esp + 8]
jmp 0x551461

Function at 0x551b81
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bx
sub esp, 4
pop ebx
bsr bp, bp
xchg byte [esp + 2], bl
pop dword [esp]
jmp 0x550ff8
mov edi, dword [esp + 7]
mov dx, 0xc97f
mov dword [esp + 5], ecx
xchg dx, bx
lea ebx, [ecx + 0x9b]
pop ecx
jmp 0x551015
bswap ebp
mov byte [esp + 9], bh
bswap edx
setae ch
mov ecx, eax
xchg word [esp + 7], bx
jmp 0x55148f
jmp 0x5514b6
Function at 0x402c81
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4141c4], 0
jne 0x402c8f
call fcn.00402c57
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402cbc
test cl, 7
je 0x402cbc
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec esi
inc ecx
jmp 0x402c9d
cmp esi, 8
jb 0x402d40
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4141c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec edi
jne 0x402cc6
xor edx, edx
test esi, esi
jbe 0x402d60
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4141c0]
inc edx
cmp edx, esi
jb 0x402d47
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x40997b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040a28f
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x409a89
cmp ebx, edx
jge 0x4099d0
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x4099d2
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x4099b5
cmp ecx, edx
jne 0x4099da
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x4099a1
cmp eax, 0xa
jg 0x409a89
mov dword [ebp - 4], 0x418ca8
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x418dc8]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x409a35
add eax, edx
dec edi
jne 0x409a33
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x409a89
cmp ebx, edx
jge 0x409a72
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x409a74
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x409a56
cmp ecx, edx
jne 0x409a7b
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x409a48
cmp dword [ebp + 8], 0xa
jle 0x4099ee
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x409a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x415ca8]
xor dl, byte [eax + ebx*4 + 0x4164a8]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4168a8]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4160a8]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x409ab8
inc eax
cmp eax, edi
jl 0x409aab
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040a28f
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x409aa9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40778d
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x4077fd
cmp ebx, 0x20
je 0x4077fd
cmp ebx, 0xffffffe0
je 0x4077fd
jne 0x407806
add eax, 1
cmp esi, eax
je 0x407813
jne 0x4077e2
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x407817
jne 0x4077de
pop edx
mov eax, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
cmp ebx, 0
je 0x40785c
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x407862
add eax, 4
pop esi
dec esi
push esi
jne 0x407844
xor eax, eax
mov dword [ebp - 8], eax
nop
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
mov dword [ebp - 8], eax
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
mov esi, dword [esi]
mov esi, dword [esi + 4]
lea ecx, [esi - 1]
test ecx, ecx
jl 0x4078a3
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
lea eax, [eax + ecx*4 + 8]
inc ecx
push dword [eax]
sub eax, 4
dec ecx
jne 0x40789b
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4078b9
lea eax, [esi*4]
add esp, eax
mov eax, dword [ebp - 0xc]
jmp 0x4078c1
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40cb70
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040cd20
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40cc6e
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40cc11
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40cc54
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40cc28
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40cc43
test al, 0x40
je 0x40cc3a
mov ecx, dword [edi + 0x20]
jmp 0x40cc41
test al, 0x80
je 0x40cc54
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40cc54
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40cbe0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret