joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b14
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059d5
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x40a8c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a8fd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f00
jmp 0x40a906
mov eax, ebx
mov edx, esi
call fcn.00403e64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a910
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a931
mov al, byte [esp]
jmp 0x40a933
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40afb8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ae30
mov eax, dword [0x44e014]
cmp byte [eax], 0
je 0x40b034
mov eax, dword [0x44de3c]
call fcn.00402980
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408138
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b07c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b06a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x44ddec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x44f664]
call fcn.00404e7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x426c10
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x426b5c
call sub.user32.dll_EnumWindows
ret

Function at 0x426d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x426dad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00426790
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x426d55
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00426390
cmp dword [ebp - 4], 0
je 0x426d97
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004042d0
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426db4
lea eax, [ebp - 4]
call fcn.00403e10
ret

Function at 0x429a50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x44fb54], 0
je 0x429b9f
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x44dfb8]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x429b9f
mov eax, dword [0x44fb58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x44fb54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x429b6e
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x44fb54]
call fcn.00413534
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x429b66
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x429b66
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x429b66
mov eax, dword [ebp - 0x14]
call fcn.004325b4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x429b66
push ebp
call fcn.00429a0c
pop ecx
test al, al
jne 0x429b66
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x429b22
mov eax, dword [ebp - 0x14]
call fcn.004310e4
dec eax
jle 0x429b66
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004032d4
cmp byte [ebp - 1], 0
je 0x429b66
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x429b66
mov edx, dword [ebp - 0x14]
mov eax, dword [0x44fb58]
call fcn.004291d8
inc edi
dec ebx
jne 0x429ab5
mov eax, dword [0x44fb58]
cmp dword [eax + 8], 0
jle 0x429b86
mov eax, dword [0x44fb58]
call fcn.00429268
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x429b9f
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00429874
pop ecx
test al, al
jne 0x429b9f
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d138
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x42d184
mov eax, esi
call fcn.00442554
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42d184
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x42d184
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x42d2c3
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x42d1c4
cmp eax, 0x108
ja 0x42d1c4
mov eax, esi
call fcn.00442554
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42d2ba
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x42d2c3
jmp 0x42d2ba
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x42d2a3
cmp eax, 0x20a
ja 0x42d2a3
test byte [esi + 0x50], 0x80
jne 0x42d1f6
sub eax, 0x203
je 0x42d1f3
sub eax, 3
je 0x42d1f3
sub eax, 3
jne 0x42d1f6
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x42d20a
dec eax
je 0x42d21f
dec eax
je 0x42d23c
dec eax
je 0x42d21f
jmp 0x42d243
mov ecx, ebx
mov eax, dword [0x44dfb8]
mov eax, dword [eax]
mov edx, esi
call fcn.0044bd90
jmp 0x42d2ba
cmp byte [esi + 0x5d], 1
jne 0x42d235
mov eax, esi
mov si, 0xffed
call fcn.004032d4
jmp 0x42d2c3
or word [esi + 0x54], 1
jmp 0x42d2ba
and word [esi + 0x54], 0xfffe
jmp 0x42d2ba
mov eax, dword [0x44fb10]
cmp byte [eax + 0x20], 0
je 0x42d2ba
mov eax, dword [0x44fb10]
cmp dword [eax + 0x1c], 0
je 0x42d2ba
mov eax, dword [ebx]
mov edx, dword [0x44fb10]
cmp eax, dword [edx + 0x1c]
jne 0x42d2ba
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00442498
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004032d4
jmp 0x42d2c3
cmp eax, 0xb00b
jne 0x42d2ba
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042baa0
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44245c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x442494]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x442475
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x442484
or bl, 4
test esi, 0x20000000
je 0x44248f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x448b3c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x448b4e
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418ed4
mov eax, dword [0x44ddf4]
mov dword [eax + 4], ebx
mov dword [eax], 0x448ee0
mov eax, dword [0x44de00]
mov dword [eax + 4], ebx
mov dword [eax], 0x448eec
mov eax, ebx
call fcn.00448ef8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x445314
push eax
push 0
push 0
mov eax, dword [0x44df40]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41a8f8]
call fcn.0041bd3c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41a8f8]
call fcn.0041bd3c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41a8f8]
call fcn.0041bd3c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00449318
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4491f4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4491f4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4491f4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x448c8b
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x449c20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x449c37
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418ed4
mov eax, dword [0x44df2c]
cmp word [eax + 2], 0
jne 0x449c5f
mov eax, dword [0x44df2c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044b388
mov eax, dword [0x44dfd4]
cmp word [eax + 2], 0
jne 0x449c79
mov eax, dword [0x44dfd4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044b580
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b0a8]
call fcn.00420cf0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x449e00
mov eax, dword [0x44de54]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004210c0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44bb20
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44de54]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bdbc
test eax, eax
je 0x449d6e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408174
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bde4
test eax, eax
je 0x449d82
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, dword [0x44dd58]
cmp byte [eax], 0
jne 0x449db6
mov eax, ebx
call fcn.00449f28
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044bcfc
mov eax, ebx
call fcn.0044c6c0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x449df6
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a1a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44fbb0]
cmp dword [eax + 0x30], 0
je 0x44a252
cmp dword [ebx + 0x94], 0
jne 0x44a24c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44a138
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44a24c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44a212
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44a24c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413534
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44a221
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44adb4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44ade9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f00
jmp 0x44adf6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403e64
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44bed8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44bf19
mov eax, esi
call fcn.00432814
test al, al
je 0x44bf19
mov eax, dword [ebx + 0x84]
call fcn.004325b4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44bf19
push 0
mov eax, dword [ebx + 0x84]
call fcn.004325b4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
push esi
push edi
cmp ebx, eax
mov dword [esp + 0xc], eax
mov edi, 0xf003f
mov dword [esp + 0x10], eax
je 0x4010ac
cmp dword [esp + 0x20], eax
je 0x4010ac
cmp dword [esp + 0x28], eax
je 0x401036
mov edi, 0xf013f
lea ecx, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x1c]
push ecx
push edi
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x401076
cmp esi, 2
jne 0x401072
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push edi
push 0
push 0
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x401093
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x28]
push 4
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
pop ebp
test eax, eax
je 0x4010a3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
pop edi
pop esi
mov eax, 0x57
pop ebx
add esp, 8
ret
Function at 0x461d1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0450c68
jmp 0x461cef
call 0x461ccd
push word [esp + 8]
jae 0x461ca6
lea esp, [esp + 3]
mov dword [esp + 0x4c], esi
jmp 0x461ce5
lea esp, [esp + 3]
mov dword [esp + 0x4c], esi
jmp 0x461cb4
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0x461ccf
pushfd
jmp 0x46174a
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0x461ccf
setge ah
mov si, word [esp]
bswap ebx
bswap ebx
jmp 0x461d0e
mov edi, dword [esp + 0x2c]
mov bx, 0xaf66
call 0x461d1d
into
pop ecx
mov byte [esp + 2], ah
push word [esp]
jns 0x461d47
lea esp, [esp + 2]
jmp 0x461e54

Function at 0x466350
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov byte [esp], dh
push word [esp]
jmp 0x466397
jge 0x4663ad
mov byte [esp + 2], ch
mov word [esp], bp
jmp 0x4663b5
mov byte [esp + 2], ch
mov word [esp], bp
call fcn.004663de
lea esp, [esp + 2]
mov dword [esp], ebx
call 0x4663c7
xchg esp, eax
mov byte [esp + 1], bh
push esp
jmp 0x466457
mov dword [esp + 4], esp
push eax
mov dword [esp + 4], ebp
call fcn.00466441
jmp 0x4664ab
pop word [esp]
mov byte [esp + 5], bh
lea esp, [esp + 2]
mov dword [esp + 8], esi
call fcn.00466495
lea ebx, [edi]
invalid

Function at 0x4663c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov byte [esp], dh
push word [esp]
jmp 0x466397
jge 0x4663ad
mov byte [esp + 2], ch
mov word [esp], bp
jmp 0x4663b5
mov byte [esp + 2], ch
mov word [esp], bp
call fcn.004663de
lea esp, [esp + 2]
mov dword [esp], ebx
call 0x4663c7
xchg esp, eax
mov byte [esp + 1], bh
push esp
jmp 0x466457
mov dword [esp + 4], esp
push eax
mov dword [esp + 4], ebp
call fcn.00466441
jmp 0x4664ab
pop word [esp]
mov byte [esp + 5], bh
lea esp, [esp + 2]
mov dword [esp + 8], esi
call fcn.00466495
lea ebx, [edi]
invalid

Function at 0x4663de
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], sp
jmp 0x466385
push di
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp], ecx
call 0x46632e
pop ebx
mov dl, 0xad
mov esp, 0x48b668f
and al, 0x8b
inc ebp
add byte [edx - 0x7a14dbd4], cl
mov word [esp], dx
jmp 0x466366
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp], ecx
jmp 0x466318
pop word [esp]
lea esp, [esp + 2]
push edx
call fcn.00466350
add ecx, dword [edx + reloc.USER32.dll_CreateWindowExW]
cmpsd dword [esi], dword es:[edi]
das
mov edi, 0xc28729da
jge 0x4663cf
fbld tbyte [esi]
mov word [esp], cx
push dword [esp + 2]
jno 0x46630c
push di
jmp 0x466344
add byte [eax], al
or dword [ebx + reloc.USER32.dll_CreateWindowExW], ecx
mov eax, dword [reloc.USER32.dll_CreateWindowExW]
cmp byte [ecx + 0x24448f66], 3
pop word [esp + 3]
call fcn.004663ff
cwde
Function at 0x4663e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0450c68
jmp 0x4664dd
mov word [esp], bp
lea esp, [esp]
xchg dword [esp + 4], edi
push ecx
lea esp, [esp + 2]
jmp 0x4664cb
lea esp, [esp]
lea esp, [esp + 2]
lea edi, [edi - 0x2e]
call fcn.00466484
lea ecx, [ebx*4]
bswap ecx
stc
js 0x466516
jns 0x466500
salc
inc ecx
sal dword [eax + reloc.USER32.dll_CreateWindowExW], 1
nop
test dword [edx], reloc.USER32.dll_CreateWindowExW
pushfd
jmp 0x465830
mov edi, dword [esp + 0x2c]
mov edx, ecx
xchg dl, ch
jmp 0x466588
jmp 0x466500
mov ebx, edi
sbb ax, dx
jae 0x466570
mov dx, word [esp]
jmp 0x46655a
sub esp, 0xc0
mov esi, esp
lea edx, [eax + ebx]
mov ch, 0xdb
rdtsc
jmp 0x466533
mov eax, ebp
btc edx, esi
stc
jmp 0x466594
mov dx, word [esp]
mov eax, ebp
btc edx, esi
stc
bt ecx, esi
neg cx
bswap ecx
jmp 0x466599
lea ebp, [esp]
mov dh, 0xb2
mov cl, dl
setnp cl
jmp 0x466549
bt ecx, esi
jmp 0x46657d
setg ah
xor edi, 0xf6ccfe0
mov dx, 0xac5a
mov ch, 0x43
xchg dl, dh
jmp 0x466b43
das
in eax, 0xf9
sub al, bl
jecxz 0x4669a8
test eax, 0x69f9e52d
mov byte [ebx], ch
inc edx
mov ax, 0x4e86
call fcn.00466ae1
mov al, byte [0x22d7b022]
jecxz 0x4669a9
not dword [bp + si - reloc.USER32.dll_CreateWindowExW]
sbb al, byte [ecx + 0x113b26c7]
dec ebp
add edi, 0x4d113b26
rdtsc
shl dh, 6
jbe 0x4669b7
mov ax, 0x4e86
jmp 0x4669ff
bswap ecx
jmp 0x4669cd
mov ch, dh
cmc
neg cx
jmp 0x466a55
add edi, 0x5e76315a
mov eax, dword [esp]
lea ecx, [edx*4]
call 0x466a5a
xor cl, byte [ebx - 0x1a14dbf4]
sub esp, 0x15
jmp 0x466aa9
mov ecx, dword [esp]
jmp 0x466a3f
xchg dl, cl
xchg dword [esp + 0x10], eax
sub esp, 0x12
stc
lea esp, [esp + 3]
jmp 0x466ac9
sub esp, 0x12
stc
lea esp, [esp + 3]
jmp 0x466ac9
jl 0x466a63
xchg dl, cl
xchg dword [esp + 0x10], eax
jmp 0x466a93
lea esp, [esp + 0x28]
add edi, 0x7f56d033
mov dh, al
push ecx
jmp 0x466aec
rol edi, 0
xchg ah, cl
rdtsc
mov ax, bp
btc ax, sp
jmp 0x466b02
add edi, dword [ebp]
mov eax, dword [esp]
mov ecx, 0x21e186e6
sub esp, 0x18
jmp 0x466b06
js 0x466ab3
jns 0x466ab3
jb 0x466b1c
xchg byte [esp + 0x12], cl
jmp 0x466b26
xchg byte [esp + 0x12], cl
jmp 0x466b26
xchg ecx, eax
bsf eax, edx
jg 0x4669fb
bswap ecx
jmp 0x4669fd

Function at 0x466441
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
push dword [esp]
jns 0x466465
pop word [esp]
mov byte [esp + 5], bh
jmp 0x466467
lea esp, [esp + 2]
mov dword [esp + 8], esi
jmp 0x4664bb

Function at 0x466484
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
xchg dword [esp + 4], edi
call fcn.0046643f

Function at 0x466495
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x4664fa
Function at 0x466a5a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0450c68
jmp 0x4664dd
mov word [esp], bp
lea esp, [esp]
xchg dword [esp + 4], edi
push ecx
lea esp, [esp + 2]
jmp 0x4664cb
lea esp, [esp]
lea esp, [esp + 2]
lea edi, [edi - 0x2e]
call fcn.00466484
lea ecx, [ebx*4]
bswap ecx
stc
js 0x466516
jns 0x466500
salc
inc ecx
sal dword [eax + reloc.USER32.dll_CreateWindowExW], 1
nop
test dword [edx], reloc.USER32.dll_CreateWindowExW
pushfd
jmp 0x465830
mov edi, dword [esp + 0x2c]
mov edx, ecx
xchg dl, ch
jmp 0x466588
jmp 0x466500
mov ebx, edi
sbb ax, dx
jae 0x466570
mov dx, word [esp]
jmp 0x46655a
sub esp, 0xc0
mov esi, esp
lea edx, [eax + ebx]
mov ch, 0xdb
rdtsc
jmp 0x466533
mov eax, ebp
btc edx, esi
stc
jmp 0x466594
mov dx, word [esp]
mov eax, ebp
btc edx, esi
stc
bt ecx, esi
neg cx
bswap ecx
jmp 0x466599
lea ebp, [esp]
mov dh, 0xb2
mov cl, dl
setnp cl
jmp 0x466549
bt ecx, esi
jmp 0x46657d
setg ah
xor edi, 0xf6ccfe0
mov dx, 0xac5a
mov ch, 0x43
xchg dl, dh
jmp 0x466b43
das
in eax, 0xf9
sub al, bl
jecxz 0x4669a8
test eax, 0x69f9e52d
mov byte [ebx], ch
inc edx
mov ax, 0x4e86
call fcn.00466ae1
mov al, byte [0x22d7b022]
jecxz 0x4669a9
not dword [bp + si - reloc.USER32.dll_CreateWindowExW]
sbb al, byte [ecx + 0x113b26c7]
dec ebp
add edi, 0x4d113b26
rdtsc
shl dh, 6
jbe 0x4669b7
mov ax, 0x4e86
jmp 0x4669ff
bswap ecx
jmp 0x4669cd
mov ch, dh
cmc
neg cx
jmp 0x466a55
add edi, 0x5e76315a
mov eax, dword [esp]
lea ecx, [edx*4]
call 0x466a5a
xor cl, byte [ebx - 0x1a14dbf4]
sub esp, 0x15
jmp 0x466aa9
mov ecx, dword [esp]
jmp 0x466a3f
xchg dl, cl
xchg dword [esp + 0x10], eax
sub esp, 0x12
stc
lea esp, [esp + 3]
jmp 0x466ac9
sub esp, 0x12
stc
lea esp, [esp + 3]
jmp 0x466ac9
jl 0x466a63
xchg dl, cl
xchg dword [esp + 0x10], eax
jmp 0x466a93
lea esp, [esp + 0x28]
add edi, 0x7f56d033
mov dh, al
push ecx
jmp 0x466aec
rol edi, 0
xchg ah, cl
rdtsc
mov ax, bp
btc ax, sp
jmp 0x466b02
add edi, dword [ebp]
mov eax, dword [esp]
mov ecx, 0x21e186e6
sub esp, 0x18
jmp 0x466b06
js 0x466ab3
jns 0x466ab3
jb 0x466b1c
xchg byte [esp + 0x12], cl
jmp 0x466b26
xchg byte [esp + 0x12], cl
jmp 0x466b26
xchg ecx, eax
bsf eax, edx
jg 0x4669fb
bswap ecx
jmp 0x4669fd

Function at 0x4743b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 9]
lea esp, [esp + 1]
lea ebx, [ebx - 0x21]
clc
jmp 0x47439d

Function at 0x474869
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x474232
mov al, 0xc0
xchg byte [esp + 1], bh
ror ebx, cl
jae 0x474257
jb 0x474257
jmp 0x47454a
lea edx, [ecx*4]
jmp 0x47450f
mov cx, si
mov edx, 0x7b8acb5e
add esp, 4
jae 0x4744c6
jb 0x4744c6
jmp 0x474522
pop edx
xchg bx, ax
add esp, 0x20
jns 0x4744f1
js 0x474522
jecxz 0x474580
cli
popfd
insb byte es:[edi], dx
fist word [ecx]
nop
pop edi
jmp 0x4644e4
pop esi
mov bx, word [esp]
clc
jno 0x4744cb
lea edx, [ecx*4]
jmp 0x47450f
lea edx, [eax + edi]
jmp 0x4744e2
jmp 0x4744b2