joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401138
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40eb8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x30], 0x48
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x2d], 0x70
mov byte [ebp - 0x2c], 0x46
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x40], 0x4b
mov byte [ebp - 0x3f], 0x45
mov byte [ebp - 0x3e], 0x52
mov byte [ebp - 0x3d], 0x4e
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x4c
mov byte [ebp - 0x3a], 0x33
mov byte [ebp - 0x39], 0x32
mov byte [ebp - 0x38], 0x2e
mov byte [ebp - 0x37], 0x64
mov byte [ebp - 0x36], 0x6c
mov byte [ebp - 0x35], 0x6c
mov byte [ebp - 0x34], 0
push 0x45adc8
push 0x45add4
call fcn.00515e7b
test dword [eax - 0x18], edx
pop esp
inc esi
adc dword [eax], eax
outsd dx, dword [esi]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x48
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00515e7b
jne 0x401267
call fcn.00515824
mov ecx, dword [ecx - reloc.KERNEL32.dll_GetProcAddress]
nop
nop
nop
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x40124a
mov dword [ebp - 0x48], 0x63
push 0x410070
lea eax, [ebp - 0x48]
push eax
call fcn.00402e70
jmp 0x401263
mov dword [ebp - 4], reloc.KERNEL32.dll_GetProcAddress
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
invalid
Function at 0x40189d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40eba8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x48], 0x4b
mov byte [ebp - 0x47], 0x45
mov byte [ebp - 0x46], 0x52
mov byte [ebp - 0x45], 0x4e
mov byte [ebp - 0x44], 0x45
mov byte [ebp - 0x43], 0x4c
mov byte [ebp - 0x42], 0x33
mov byte [ebp - 0x41], 0x32
mov byte [ebp - 0x40], 0x2e
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], 0x6c
mov byte [ebp - 0x3d], 0x6c
mov byte [ebp - 0x3c], 0
mov byte [ebp - 0x30], 0x56
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x75
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x41
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0
push 0x45ae88
push 0x45ae98
call fcn.00515e7b
stc
push eax
call fcn.00515824
outsd dx, dword [esi]
mov dword [ebp - 0x20], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
lea ecx, [eax + ecx + 0x18]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x40198d
mov dword [ebp - 0x4c], 0x50
push 0x410070
lea eax, [ebp - 0x4c]
push eax
call fcn.00402e70
jmp 0x401aa6
mov dword [ebp - 4], reloc.KERNEL32.dll_GetProcAddress
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401abe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ebb2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x45aea8
push 0x45aeb4
call fcn.00515e7b
xor dword [eax - 0x18], edx
cmp eax, 0x89e70011
inc ebp
in al, dx
nop
nop
nop
nop
nop
mov byte [ebp - 0x30], 0x56
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x75
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x50
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0
push 0x45aec4
push 0x45aed4
call fcn.00515e7b
sub eax, 0x3cd3e850
adc dword [eax], eax
or dword [ecx + reloc.KERNEL32.dll_GetProcAddress], 8
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x18]
mov dword [ebp - 0x18], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x401b9a
mov dword [ebp - 0x4c], 0x40
push 0x410070
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00402e70
jmp 0x401cfc
mov dword [ebp - 4], reloc.KERNEL32.dll_GetProcAddress
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cdec6
Capabilities:
Packed with generic packer

Disassembly:
push bx
jmp 0x46d0e2
mov esi, ecx
push word [esp + 1]
xchg word [esp + 2], si
mov esi, dword [esp + 8]
lea esp, [esp + 0xc]
jmp 0x46d103
push 0x86fade75
call fcn.004791af
jmp 0x48712d
pop edi
pop esi
pop ebx
leave
ret 8
call fcn.0046d14d
fcom qword [ebx - 0x3d]
cmpsb byte [esi], byte es:[edi]
push ebp
nop
inc edx
aam 0x4a
sub eax, 0x80c16adc
inc ebx
cli
aad 0x57
jmp 0x4cdd85
push si
lea esp, [esp + 2]
jmp 0x4ce4d6
mov eax, dword [ebp - 0x14]
call fcn.004ce4c0
mov edi, 0xbac4bfd5
imul edi, dword [edx - reloc.KERNEL32.dll_GetProcAddress], 0x2f
push edx
jmp 0x4ce811
sub esp, 0x13
pushal
lea esp, [esp + 3]
jmp 0x4cdd8f
mov edi, ebp
lea edi, [edi + 8]
mov ecx, dword [edi]
pop edi
jmp 0x4cdd6f
lea esp, [esp + 0x30]
test ecx, ecx
je 0x4cdc18
jne 0x4cdddc
mov dword [ebx], edi
lea esi, [edi]
hlt
xor edi, edi
call fcn.004cddc6
call fcn.00485b42
mov dx, word [esp]
mov dh, al
shl edx, cl
mov edx, dword [eax + 0x7c]
jmp 0x4cddf9
lea esi, reloc.KERNEL32.dll_GetProcAddress
mov si, 0x9375
jmp 0x4cde3b
cmc
jmp 0x4cde8f
lea esi, [edx*4]
bswap esi
mov esi, dword [eax + 0x78]
add esi, ecx
jmp 0x4cde25
sub esp, 6
mov dword [esp], edi
lea esp, [esp + 2]
jmp 0x4cde73
cmp esi, ecx
jbe 0x4cdc18
bsf ax, si
mov ax, word [esp]
jmp 0x4cde4b
mov eax, dword [ebp + 0xc]
cmc
stc
lea esp, [esp + 4]
jmp 0x4cdebc
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4cdc18
jne 0x4cde61
call fcn.004cdedc
mov edx, dword [esi + 0x10]
cmp eax, edx
call 0x4cdec6
cmp dword [reloc.KERNEL32.dll_GetProcAddress], edx
or al, 0x4e
invalid
cmp eax, 0x10000
call 0x4cde9c
pushal
jmp 0x4cdef1
lea esp, [esp + 0x24]
jb 0x4cdc54
shr ebx, 0x1e
jmp 0x4cdf3c
mov ebx, dword [eax]
pop eax
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x4cdf44
push eax
mov eax, esi
add eax, 0x14
jmp 0x4cdf26
add ebx, edx
call fcn.004cdff3
sbb dword [ebx - 0x373302be], ecx
movsb byte es:[edi], byte [esi]
neg dword [edi - 0x5d]
in al, 0x71
sbb edx, dword [esi]
pop edx
pop edi
cmpsb byte [esi], byte es:[edi]
cmp edi, esi
jb 0x4cdd59
mov ax, word [esp]
not eax
jmp 0x4cdc5f
lea esp, [esp + 4]
test edi, edi
je 0x4cdc18
lea eax, [ebx*4]
jmp 0x4ce844
mov ah, bl
pushal
mov dword [esp + 0x1c], edi
call 0x4ce851
pop edx
pop word [esp]
mov byte [esp], bl
jmp 0x4ce9ad
lea esp, [esp + 2]
popal
pushfd
lea esp, [esp + 4]
call fcn.00485c24
jmp 0x46d288

Function at 0x4cdff3
Capabilities:
Packed with generic packer

Disassembly:
lea edx, [eax*4]
lea edx, [ebx + esi]
inc di
mov edx, dword [esi + 0x1c]
add edi, 0xcfcbd1a9
jmp 0x4cdfb6
jae 0x4cdc54
lea edi, [esi*4]
btr edi, edi
mov di, dx
sub eax, edx
jmp 0x4cdf62
mov edi, dword [eax + ecx]
jmp 0x4cdfd9
bsr edi, esp
cmc
lea eax, [edx + eax*4]
shl di, 0xb
jmp 0x4cdfa0
cmp eax, ebx
lea esp, [esp + 0x1c]
jmp 0x4cdf89

Function at 0x4ce0cd
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
js 0x4cdc3e
jmp 0x4cdc9a
Function at 0x4ce491
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebp + 8]
mov edi, dword [esp]
jmp 0x4ce49d
mov edi, dword [eax + ecx]
jmp 0x4ce4f2
add edi, eax
lea esp, [esp + 4]
jmp 0x4cdc54

Function at 0x4ce4b4
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
popal
lea esi, [esi - 4]
mov eax, dword [esi]
jmp 0x4ce445

Function at 0x4ce4c0
Capabilities:
Packed with generic packer

Disassembly:
push word [esp]
lea esp, [esp + 2]
jmp 0x4ce4fd
add esi, eax
cmp edi, esi
push esi
mov dword [esp], eax
jmp 0x4ce623
lea esp, [esp + 8]
jae 0x4cdd59
mov eax, edi
call fcn.004ce543

Function at 0x515a5d
Capabilities:
Enumerate pe sections

Disassembly:
mov si, word [esp]
bswap edi
mov ebp, ecx
mov edi, dword [esp + 6]
call fcn.00515a47
Function at 0x51bd0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
setne al
bsr ax, di
mov di, word [esp + 1]
rol ax, 0xc
jmp 0x51bd2d

Function at 0x51bec9
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
xchg word [esp + 1], dx
rdtsc
pop ax
xchg al, ah
clc
jmp 0x51bc8c
xchg word [esp + 1], ax
mov di, word [esp + 1]
mov edx, ebx
mov di, word [esp + 1]
jmp 0x51bdc8
mov di, cx
mov dx, di
mov al, 0x85
pop dword [esp + 6]
add esp, 4
mov byte [esp + 3], bh
jmp 0x51bc79
clc
inc edx
lea edx, [edi*4]
mov byte [esp + 7], ah
lea eax, [ebx + ebp]
jmp 0x51bd55
setl dl
push dword [esp + 5]
shr dl, 5
setle ah
clc
lea edi, [esp + ebp]
jmp 0x51bcba
lea eax, reloc.KERNEL32.dll_GetProcAddress
mov dl, 0x8c
cmc
xchg dword [esp], eax
jmp 0x51bd23
lea esp, [esp + 1]
mov dword [esp], edx
sub esp, 5
lea edi, [ebx + esi]
pop edx
mov ah, byte [esp + 2]
jmp 0x51bce3
mov word [esp + 1], bx
call fcn.0051bd0d
std
mov ax, 0x1f40
mov word [esp + 5], cx
lea esp, [esp + 5]
pop word [esp]
mov eax, ecx
jmp 0x51bd91
rdtsc
mov dl, cl
lea esp, [esp + 7]
lea edx, [esi + edi]
mov dh, byte [esp + 2]
stc
jmp 0x51bcf9
lea eax, [esp + edx]
sub esp, 3
mov dword [esp], eax
mov ah, bl
sub esp, 0x15
pop word [esp + 5]
jmp 0x51bda3
mov ah, bl
neg eax
add esp, 2
btr ax, ax
xchg edx, eax
not di
jmp 0x51bd67
mov eax, esp
neg di
mov word [esp + 7], bx
mov al, byte [esp + 0xe]
mov ah, bh
mov byte [esp + 0xf], bh
jmp 0x51be5d
setae dl
lea edx, [edi + edi]
push dword [esp + 3]
not edx
mov dh, dl
setge dh
jmp 0x51bcd0
mov dx, word [esp + 6]
push word [esp + 0xc]
lea eax, [esi - 0x1d]
mov byte [esp + 0x13], bh
bt eax, esi
lea esp, [esp + 0xc]
jmp 0x51be2c
pop edx
xchg di, ax
mov byte [esp + 8], ah
cmc
mov word [esp + 0xe], ax
mov eax, 0x513f3ce9
jmp 0x51bdde
lea edx, reloc.KERNEL32.dll_GetProcAddress
mov dx, word [esp + 3]
btr edx, ebx
jmp 0x51be44
rdtsc
bswap edi
lea edx, reloc.KERNEL32.dll_GetProcAddress
xchg edi, edx
push word [esp + 5]
push word [esp + 5]
jmp 0x51be16
lea esp, [esp + 3]
pop edx
bt edx, ebx
pushal
pop dword [esp + 4]
mov dword [esp + 0x12], ebx
jmp 0x51be82
mov dx, sp
push dword [esp + 0x13]
not dl
std
pop edi
bswap edi
jmp 0x51be02
xchg dx, ax
xchg di, ax
lea edi, [ebp*4]
push bp
jmp 0x51beac
mov edi, 0x785065ab
sub esp, 0x1c
xchg byte [esp + 0x2b], dh
push edx
lea esp, [esp + 0x42]
cld
jmp 0x51be6c
add esp, 0
mov di, word [esp + 1]
xchg ah, dl
mov dh, cl
push ax
jmp 0x51bf49
mov ax, word [esp + 1]
mov di, bx
mov ax, word [esp]
mov eax, edi
xchg edx, edi
mov dl, bh
jmp 0x51be96
xchg byte [esp + 5], dl
mov dx, cx
jmp 0x51bca5
xchg dword [esp + 2], eax
mov ax, word [esp + 8]
mov eax, dword [esp + 9]
bswap edi
jmp 0x51bf29
lea eax, [edi*4]
mov di, 0xc53a
xchg dh, dl
bswap edi
bswap edx
add esp, 1
jmp 0x51bed5
lea eax, [esp + ebx]
add esp, 0
mov byte [esp + 2], ah
lea esp, [esp + 2]
sub esp, 0xa
mov edx, ecx
jmp 0x51beeb
rdtsc
mov edi, dword [esp + 0xa]
lea edx, [ecx*4]
xchg dword [esp + 2], eax
call fcn.0051bf7a
out 0x6a, al
clc
lahf
push 0xffffffffffffff81
or esp, dword [edx + reloc.KERNEL32.dll_GetProcAddress]
and al, 3
mov ah, byte [esp + 3]
rdtsc
rdtsc
push word [esp + 1]
mov edx, esi
pop di
jmp 0x51bf14
Function at 0x51bf85
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [esp + 0xa9]
pop dword [esp + 2]
bsr edx, edi
jmp 0x51bfcb
lea eax, [eax + ecx]
mov word [esp + 0xb], bp
not di
mov dword [esp + 1], ebx
add esp, 2
rdtsc
jmp 0x51bfa8

Function at 0x51c04f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x51c082
mov edx, 0xf00c3022
xchg di, ax
mov di, word [esp + 0xd]
mov edi, 0x5972dc4
adc eax, 0xc9992e60
btc dx, sp
jmp 0x51c0d6
mov eax, dword [esp + 6]
mov edx, dword [esp + 3]
mov dword [esp + 3], ecx
mov byte [esp + 3], bh
push edi
jmp 0x51c101
not dx
xchg dx, ax
xchg dword [esp + 7], edi
mov dh, byte [esp + 5]
add esp, 6
bswap edx
jmp 0x51c0bf
mov edx, 0x17e63be4
neg eax
lea eax, reloc.KERNEL32.dll_GetProcAddress
xchg byte [esp], dh
jmp 0x51c116
setb dl
pop ax
adc edx, 0x9d080e45
pop dword [esp]
adc dh, 0x30
pop ax
jmp 0x51c0eb
push word [esp + 2]
lea esp, [esp + 3]
rdtsc
lea edi, [ebx + ebp]
ror edx, 0xe
sub esp, 0x15
jmp 0x51c2d2
mov dl, 0x4f
xchg edi, eax
bsf edi, edi
pop word [esp]
add esp, 1
cmc
jmp 0x51c1ad
push word [esp + 0x10]
or dx, 0x8a0
not dx
call fcn.0051c168
xchg word [esp + 0xc], dx
pop edx
neg dl
call fcn.0051c28a
push esp
insb byte es:[edi], dx
jae 0x51c1ff
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
mov dx, bx
mov byte [esp + 0x11], al
mov ax, si
pop edi
not dh
pop ax
jmp 0x51c185
mov eax, dword [esp + 0xb]
lea eax, reloc.KERNEL32.dll_GetProcAddress
mov edi, 0x5ef81c66
rol edx, cl
mov dh, al
push dword [esp + 0x12]
jmp 0x51c19b
wait
inc edx
mov di, word [esp + 4]
xchg byte [esp + 0x12], ah
rdtsc
mov word [esp + 0xa], ax
jmp 0x51c251
sub esp, 0x10
mov dx, 0xf1aa
dec dl
xchg edi, eax
lea eax, [esi*4]
jmp 0x51c2aa
add esp, 0xc
mov al, ch
lea edx, [edx + esi]
xchg di, ax
call fcn.0051c22e
mov edx, 0x6ebb2fe1
xchg dh, ah
mov edx, 0xd3a14e2
mov ax, sp
mov edi, dword [esp + 2]
push dword [esp + 1]
jmp 0x51c238
xchg ah, dh
bsr dx, di
bt edx, ebx
sub esp, 0x1c
jmp 0x51c3a2
mov word [esp + 0x17], ax
dec ah
mov dh, byte [esp + 0xc]
xchg al, dl
pushal
lea esp, [esp + 0x46]
jmp 0x51c294
xchg byte [esp + 8], dh
stc
pop edx
xchg ah, dh
rdtsc
mov edi, dword [esp + 2]
jmp 0x51c1e7
mov ax, word [esp + 3]
mov dx, bp
bsr ax, ax
sets dl
call fcn.0051c2fc
mov word [esp + 8], di
push word [esp + 0x10]
cmc
lea esp, [esp + 0xf]
jmp 0x51c40c
mov dl, byte [esp + 0x10]
pop edi
btc eax, ebp
push dword [esp + 4]
lea edx, reloc.KERNEL32.dll_GetProcAddress
mov edi, dword [esp + 3]
jmp 0x51c432
mov dl, ah
bswap eax
dec dx
pop dx
bswap eax
xchg byte [esp + 2], dl
jmp 0x51c3e1
not ax
add esp, 6
lea esp, [esp + 9]
bts dx, bx
jmp 0x51c445
bsr edi, edi
mov edi, 0xb045e9dc
push word [esp + 1]
rdtsc
clc
cmc
jmp 0x51c41c
mov byte [esp + 1], dl
sub esp, 0x1d
mov eax, dword [esp + 0xf]
push dword [esp + 0xc]
sub esp, 0xd
pop word [esp + 0x2c]
jmp 0x51c49d
mov al, byte [esp + 0x20]
pop edi
lea eax, [edi + ebp]
mov word [esp + 0x24], di
jmp 0x51c7c4
dec al
cmc
bswap edx
sub esp, 3
xchg word [esp + 8], ax
mov ax, cx
jmp 0x51c487
neg di
call fcn.0051c553
pop dword [esp + 9]
mov edi, dword [esp + 8]
push dword [esp + 0x22]
mov di, bp
lea edx, [eax + ebp]
mov di, ax
jmp 0x51c6ca
Function at 0x51c28a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, 0x881d
lea edi, [ebx*4]
xchg edx, edi
push eax
mov dword [esp + 5], esp
sub esp, 7
jmp 0x51c200
rdtsc
rdtsc
pop dword [esp + 4]
jmp 0x51c217

Function at 0x51c2fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov edx, 0x3a75d96c
rol eax, 0x15
not al
xchg al, dh
xchg dx, di
jmp 0x51c31b
lea esp, [esp + 0x1f]
mov dh, byte [esp]
jmp 0x51c2e5
mov eax, esi
lea edi, [edx + ebp]
mov edi, dword [esp]
lea edx, [ecx + 0x90]
clc
jmp 0x51c349
mov al, 0x9f
btc eax, esp
add esp, 0
xchg byte [esp], dh
mov dx, 0xedc8
lea eax, [ebx*4]
jmp 0x51c305
push dword [esp + 3]
pop dword [esp]
mov di, 0xc36
rdtsc
pushal
jmp 0x51c374
sub esp, 0xc
setg dh
mov eax, ebx
xchg byte [esp + 1], al
pop dword [esp + 4]
pop dword [esp]
jmp 0x51c333
mov di, word [esp + 0x1c]
lea esp, [esp + 6]
lea edi, [eax + eax]
clc
jmp 0x51c38c
xchg byte [esp + 7], ah
xchg byte [esp + 0xc], dl
not dh
stc
lea edx, [edx*4]
rol di, 0xd
jmp 0x51c35e
lea eax, [ecx*4]
rdtsc
bsr edx, esp
jmp 0x51c3cc
xchg word [esp + 2], dx
mov byte [esp + 0x1c], ch
pop dx
mov eax, 0xa4911050
pushfd
neg dl
jmp 0x51c3b6
Function at 0x51d6cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl dl, cl
mov word [esp + 0x26], cx
pushal
lea esp, [esp + 0x4b]
inc ah
mov ah, 0xba
jmp 0x51d6a6
pop edi
push word [esp + 0x10]
not eax
sub esp, 0xc
mov dh, 0x42
mov edx, eax
jmp 0x51d67e
dec edi
not al
neg edi
cld
adc edi, 0x13b2d465
btc eax, eax
jmp 0x51d6de
lea edi, reloc.KERNEL32.dll_GetProcAddress
bswap eax
bsr edx, edi
mov dl, byte [esp]
mov ah, 0x8b
jmp 0x51daa4
xchg dword [esp + 0x1c], edi
pop word [esp + 8]
neg edi
pop dx
jmp 0x51d695
mov eax, 0x5433cdc6
lea eax, [edx*4]
mov edx, dword [esp]
xchg dx, di
std
mov dh, byte [esp]
jmp 0x51d6b7
mov edx, esi
lea eax, [eax*4]
pop dword [esp + 2]
jmp 0x51d995
not dx
sub esp, 0x1a
mov dx, ax
add esp, 4
xchg dx, ax
xchg dx, ax
jmp 0x51d96d
mov word [esp + 0xd], ax
xchg byte [esp + 3], dl
mov dh, byte [esp + 5]
bsr ax, cx
mov ax, word [esp + 5]
jmp 0x51da5b
mov dx, cx
bswap eax
xchg word [esp], di
stc
xchg word [esp], di
bswap eax
jmp 0x51d983
bsr dx, sp
mov dl, byte [esp + 5]
mov dx, bp
mov eax, 0x3fdda3d7
mov byte [esp + 5], ch
lea eax, [edx + esi]
call fcn.0051d9c5
xchg word [esp + 0x1b], di
mov dx, cx
stc
mov dx, 0xbc6d
mov dx, di
pop edi
jmp 0x51da3b
lea esp, [esp + 0x11]
rdtsc
call fcn.0051da87
pop ebx
xlatb
inc edi
and dl, cl
cmp eax, 0xb9de48c3
dec eax
out dx, eax
outsd dx, dword [esi]
in eax, 0x75
sbb al, 0xef
cmp dword [edi + eax + reloc.KERNEL32.dll_GetProcAddress], edx
pop es
mov dword [esp + 7], esi
neg dh
rdtsc
rdtsc
push ax
mov dx, word [esp + 0x11]
jmp 0x51d9e3
mov dh, byte [esp]
setge dl
push edx
pop word [esp]
mov dx, word [esp]
xchg word [esp], ax
jmp 0x51d9b3

Function at 0x51dcef
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dl
mov dword [esp + 2], esp
rdtsc
not edi
rcr ah, 3
jmp 0x51dcca
add dl, al
clc
not edi
stc
mov ax, bp
pop word [esp + 0xf]
jmp 0x51dc8d
xchg edx, eax
mov dl, 0xf
mov dx, cx
setb al
neg dl
mov edi, esi
jmp 0x51dd0d
lea eax, reloc.KERNEL32.dll_GetProcAddress
pop dword [esp + 0xa]
rdtsc
mov ax, word [esp]
mov edi, esp
bswap eax
jmp 0x51dcb4
lea eax, [edi + ebp]
lea eax, [edx + edx]
jmp 0x51dca4
xchg word [esp + 2], dx
mov word [esp + 0x10], di
sets dh
jmp 0x51dd64
bswap edx
push word [esp + 0xe]
mov dl, al
xchg word [esp + 7], dx
jmp 0x51dcf7
mov al, 0xf8
mov eax, ebp
not ax
rcl di, cl
bsr di, si
ror dx, cl
jmp 0x51dd36
push dword [esp + 4]
pop eax
bts di, ax
mov byte [esp + 8], ah
bsr dx, cx
pop dword [esp + 4]
jmp 0x51dd4c

Function at 0x51e0ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x51e117
mov ax, 0xea35
lea eax, reloc.KERNEL32.dll_GetProcAddress
mov word [esp], sp
not dh
jmp 0x51e140
not edi
neg dl
mov edi, ebx
mov eax, 0x9402a19d
lea esp, [esp + 2]
rdtsc
jmp 0x51e101
sub esp, 0xa
lea eax, [ecx*4]
rdtsc
mov dl, byte [esp + 0x15]
jmp 0x51e14f
pop edi
mov ah, cl
pushal
pop dword [esp + 2]
rol al, cl
xor dx, si
jmp 0x51e12a
bt dx, sp
add esp, 3
push word [esp + 5]
pop dword [esp + 5]
jmp 0x51e194
lea edi, [ebx*4]
call fcn.0051e1bc
mov dword [reloc.KERNEL32.dll_GetProcAddress], eax
ret
sub dx, 0x9e5e
xchg word [esp], di
mov ax, bx
cmc
pop edi
xchg edi, edx
jmp 0x51e17d
Function at 0x51e267
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x51e28c
mov al, dl
mov ah, 0x72
btr edx, ecx
setne dl
mov di, 0x98af
mov edx, ebp
jmp 0x51e2c1
Function at 0x402ec0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404508
test esi, esi
jne 0x402ef7
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004045f8
jmp 0x402f18
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d5c
mov dword [esp], eax
test esi, esi
je 0x402f18
cmp dword [ebx], 0
je 0x402f18
dec esi
jmp 0x402eff
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4035e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48f020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403680
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403660
xor eax, eax
push ebp
push 0x403659
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40369c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403660
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48f020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48f020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404384
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49404c], 0
je 0x4043e5
cmp word [0x494220], 0xd7b2
jne 0x4043ad
cmp dword [0x494228], 0
jbe 0x4043ad
mov eax, 0x49421c
call dword [0x494238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48f06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40440c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48f030], 0
jne 0x404401
push 0
push 0x48f064
push 0x48f06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret