joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a7b0
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xc], edx
push dword [ebx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [ebp - 8], 0xef6ac05e
mov dword [ebp - 0x10], ecx
xor esi, esi
sub dword [ebp - 8], 0x46b458cc
add dword [ebp - 8], 0x57499872
xor edi, edi
cmp dword [ebx], esi
jbe 0x41a864
jmp 0x41a7f0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dl, byte [eax + edi + 3]
mov cl, byte [eax + edi]
mov bl, byte [eax + edi + 1]
mov ch, byte [eax + edi + 2]
mov byte [ebp - 1], dl
shl byte [ebp - 1], 2
mov al, byte [ebp - 1]
and al, 0xc0
or cl, al
mov al, dl
shl al, 6
and dl, 0xfc
mov byte [ebp - 1], al
or ch, al
mov eax, dword [ebp - 0x10]
shl dl, 4
or dl, bl
mov byte [esi + eax], cl
mov byte [esi + eax + 1], dl
add esi, 2
mov byte [esi + eax], ch
cmp esi, 0xc556
ja 0x41a846
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [ebp + 8]
inc esi
add edi, dword [ebp - 8]
cmp edi, dword [eax]
jb 0x41a7f0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword [edx], ecx
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
pop edi
mov dword [eax], ecx
mov dword [ebx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409d10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44ab48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401160
mov dword [esp + 0x18], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
add edi, 0x30
mov dword [esi + 0x2c], ecx
push edi
lea ecx, [esi + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x40ada0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040ab40
mov esi, 0x8d4d4296
inc ebp
test al, 0x50
call fcn.0040ab50
dec dword [ebx + 0x56500c75]
push dword [ebp + 8]
call fcn.0040ab05
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
invalid
invalid
push esp
Function at 0x40b280
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40b217
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40b235
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40b293
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40b27a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40b283
or byte [eax + ecx], 2
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 0x10], ebx
je 0x40b28d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40b26f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40b1f9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40b2e0
dec eax
je 0x40b2d7
sub eax, 3
je 0x40b2ce
mov dword [ebp - 4], 0x40
jmp 0x40b2fd
mov dword [ebp - 4], 4
jmp 0x40b2e3
mov dword [ebp - 4], 0x20
jmp 0x40b2e3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40b32f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40b2af
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040ab40
inc ebp
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax

Function at 0x40b3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, 0x56fffffc
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040ab50
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
adc al, 0xf7
invalid
Function at 0x419bc0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
mov dword [esi], eax
xor ecx, esp
mov eax, esi
call fcn.00449014
mov esp, ebp
pop ebp
ret

Function at 0x419c00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi + 0x12dd], 0
mov al, 1
push ebx
mov byte [esi + 0x12dc], al
jne 0x419c8d
mov byte [esi + 0x12dd], al
movzx edx, byte [0x475454]
push edx
movzx edx, byte [0x47544a]
push edx
movzx edx, byte [0x475452]
push edx
xor ecx, ecx
push esi
mov eax, 0x41a4c0
push ecx
push eax
lea eax, [esp + 0x20]
call fcn.0041bcf0
mov edx, dword [eax]
add esp, 8
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
lea ebx, [esi + 0xf8]
mov dword [ecx + 0xc], eax
call fcn.0041bd10
cmp byte [esi + 0x50], 0
lea eax, [esi + 8]
jne 0x419c8d
cmp byte [eax + 0x49], 0
mov byte [eax + 0x48], 1
jne 0x419c8d
cmp dword [eax], 0xffffffff
je 0x419c8d
pop ebx
add esp, 0x18
jmp 0x42cff0
pop ebx
add esp, 0x18
ret
sub esp, 8
cmp dword [eax], 0xffffffff
mov byte [eax + 0x20], 1
je 0x42d055
cmp dword [eax + 0x1c], 0x10
jb 0x42d007
mov eax, dword [eax + 8]
jmp 0x42d00a
add eax, 8
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42d054
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea ecx, [esp + 0x13]
push ecx
push esi
mov dword [esp + 0x1c], 0
mov byte [esp + 0x1b], 0xff
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 8
ret

Function at 0x41bad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44b308
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x14]
xor esi, esi
mov dword [eax + 8], ecx
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], esi
mov dword [eax + 0xc], edx
call fcn.0041f4c0
mov dword [esp + 0x38], esi
mov edi, ebx
lea esi, [esp + 0xc]
call fcn.004271e0
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41bb5a
mov eax, dword [eax]
test eax, eax
je 0x41bb5a
lea ecx, [esp + 0x14]
push 1
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x449014
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46e02c]
jne 0x44901e
repz ret
jmp fcn.0044957d
Function at 0x46a944
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0456f90
jmp 0x46a952
mov dword [esp + 8], esi
jmp 0x46a93e
lea esp, [esp + 2]
mov dword [esp + 8], esi
call 0x46a944
stosb byte es:[edi], al
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0x469b44
add ebx, 0x51ec9c1f
jmp 0x46a97b
push word [esp + 2]
jb 0x46a936
lea esp, [esp + 2]
jmp 0x46a91d
ja 0x46a991
bswap edx
cmc
jmp 0x46a994
bswap edx
cmc
jmp 0x46a9d9
mov esi, dword [esp + 0x2c]
call fcn.0046a996
lea edi, [esp + 4]
lea ecx, reloc.KERNEL32.dll_GetProcAddress
sub esp, 6
je 0x46aa3e
jne 0x46aa26
jecxz 0x46aa5e
stc
cwde
imul ebp, dword [ebp + reloc.KERNEL32.dll_GetProcAddress], 0xffffff8a
cmp ebp, dword [ebx - reloc.KERNEL32.dll_GetProcAddress]
and eax, 0x8dc38798
or al, 0x30
cpuid
lea esp, [esp + 2]
jmp 0x46aa44
cpuid
lea esp, [esp + 2]
sub esp, 0xb8
jmp 0x46ab19
bsf cx, ax
mov eax, ecx
mov ebx, esi
xchg cl, dh
call int.0046aa9b
imul esp, ebp, 0x75
sbb al, 0xef
push ebx
wait
push ss
test bl, ah
push ds
fadd qword [edi]
scasb al, byte es:[edi]
mov ecx, 0x9c8dc88a
and al, 7
lodsd eax, dword [esi]
add byte [eax], al
mov eax, ecx
jmp 0x46aa55
mov ebp, esp
dec ax
jb 0x46aa4f
bsf cx, ax
jmp 0x46aac9

Function at 0x46a96e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0456f90
jmp 0x46a952
mov dword [esp + 8], esi
jmp 0x46a93e
lea esp, [esp + 2]
mov dword [esp + 8], esi
call 0x46a944
stosb byte es:[edi], al
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0x469b44
add ebx, 0x51ec9c1f
jmp 0x46a97b
push word [esp + 2]
jb 0x46a936
lea esp, [esp + 2]
jmp 0x46a91d
ja 0x46a991
bswap edx
cmc
jmp 0x46a994
bswap edx
cmc
jmp 0x46a9d9
mov esi, dword [esp + 0x2c]
call fcn.0046a996
lea edi, [esp + 4]
lea ecx, reloc.KERNEL32.dll_GetProcAddress
sub esp, 6
je 0x46aa3e
jne 0x46aa26
jecxz 0x46aa5e
stc
cwde
imul ebp, dword [ebp + reloc.KERNEL32.dll_GetProcAddress], 0xffffff8a
cmp ebp, dword [ebx - reloc.KERNEL32.dll_GetProcAddress]
and eax, 0x8dc38798
or al, 0x30
cpuid
lea esp, [esp + 2]
jmp 0x46aa44
cpuid
lea esp, [esp + 2]
sub esp, 0xb8
jmp 0x46ab19
bsf cx, ax
mov eax, ecx
mov ebx, esi
xchg cl, dh
call int.0046aa9b
imul esp, ebp, 0x75
sbb al, 0xef
push ebx
wait
push ss
test bl, ah
push ds
fadd qword [edi]
scasb al, byte es:[edi]
mov ecx, 0x9c8dc88a
and al, 7
lodsd eax, dword [esi]
add byte [eax], al
mov eax, ecx
jmp 0x46aa55
mov ebp, esp
dec ax
jb 0x46aa4f
bsf cx, ax
jmp 0x46aac9

Function at 0x46a996
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], ax
btr di, sp
jb 0x46a9c3
xchg byte [esp + 2], bl
jmp 0x46a9e2
xchg byte [esp + 2], bl
jmp 0x46a9e2
Function at 0x46aa9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
jbe 0x46aa85
ja 0x46aaa9
ret 0xc650
inc ch
mov dh, byte [esp]
sub esp, 0x12
call fcn.0046aacd
mov bl, 0x23
inc esi
mov ch, 0
and al, 0xb4
sub cl, byte [ebp - 0x44]
jns 0x46aaf5
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
pushal
sal byte [ebp + 0x28898144], cl
dec ebx
loop 0x46ab64
invalid
mov ecx, 0xd9d23696
xchg dword [esp + 8], edx
mov al, byte [esp]
jmp 0x46aba8
shr dx, cl
push dword [esp + 8]
ret 0xc
lea eax, [esi + ebp]
xchg dword [esp + 8], edx
mov edx, dword [esp]
mov ax, sp
xchg ah, ch
mov cx, word [esp]
jmp 0x46ab29
add byte [eax], al
add byte [ebx - 0x27], al
dec ecx
sub bl, bl
sbb esp, dword [ebx + 0x3acfa83a]
cld
wait
in eax, dx
cld
iretd
lea eax, [ebx*4]
lea eax, reloc.KERNEL32.dll_GetProcAddress
lea edx, [edx + 0x31]
xchg cx, ax
mov ecx, 0x930ae0db
bswap eax
jmp 0x46ab3f

Function at 0x46aacd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
call fcn.0046aafd
mov bh, 0x27
mov bh, 0xd2
and dword [edx - reloc.KERNEL32.dll_GetProcAddress], ebx
pop eax
wait
and esi, dword [ebp + reloc.KERNEL32.dll_GetProcAddress]
and al, 0x57
xchg ah, cl
pop word [esp + 0xb]
jmp 0x46ab78

Function at 0x46ab8f
Capabilities:
Execute anti-debugging instructions

Disassembly:
setl cl
jmp 0x46abc7
not ch
rdtsc
rdtsc
neg cl
xchg dword [esp], esi
push dx
jmp 0x46ac21
dec eax
mov ch, 0x19
xchg dword [esp], esi
neg ah
add esp, 1
mov ch, byte [esp]
not cl
lea esp, [esp + 1]
lea esi, [esi + 0x81]
lea edx, reloc.KERNEL32.dll_GetProcAddress
jmp 0x46abfe

Function at 0x46b063
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], ah
neg eax
jne 0x46b065
mov dl, 0x13
jmp 0x46b088
jmp 0x46b04d
mov dl, 0x13
bts cx, cx
jmp 0x46b153
bts cx, cx
jmp 0x46b153
mov ah, byte [esp]
push ecx
lea edx, [edx*4]
bt dx, sp
lea esp, [esp + 3]
jmp 0x46b107
lea esp, [esp + 3]
jmp 0x46b107
jmp 0x46b0f1
rcr dl, cl
rol esi, 0
jb 0x46b127
jae 0x46b12f
lea ecx, [esp + esi]
bsr ax, ax
jmp 0x46b18a
push ecx
lea edx, [edx*4]
bt dx, sp
jmp 0x46b0bb
mov eax, dword [esp]
mov eax, dword [esp]
mov dl, 0xc7
jmp 0x46b0c3
lea esp, [esp + 1]
lea esp, [esp + 0xc]
sub esi, 0x7101f2b
rol cx, 6
jbe 0x46b0c1
mov eax, dword [esp]
mov eax, dword [esp]
mov dl, 0xc7
rcr dl, cl
jmp 0x46b0c5
mov edx, edi
jmp 0x46b0cc
mov edx, edi
lea ecx, [esp + esi]
bsr ax, ax
jmp 0x46b18a
rdtsc
jmp fcn.0046b1c0
ror esi, 0
ja 0x46b091
mov ah, byte [esp]
jmp 0x46b0e3
rdtsc
jmp fcn.0046b1c0
add esi, dword [edi]
setle dh
btc dx, bp
jns 0x46b13a
js 0x46b161
Function at 0x46ce21
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0456f90
jmp 0x46d043
lea esp, [esp + 3]
push ebp
mov dword [esp], ebp
jmp 0x46d083
jg 0x46cf23
rdtsc
neg ebp
call fcn.0046ce44
push ss
mov di, word [esp]
xchg dword [esp + 4], eax
stc
rdtsc
cmc
mov dx, cx
jmp 0x46cef9
push dword [esp + 4]
ret 8
pushal
lea ebp, [esp + 0x38]
setl cl
btc si, ax
jns 0x46cfa6
btr ebx, edi
jmp 0x46cf6e
rdtsc
neg ebp
xor ebp, ecx
lea esp, [esp + 1]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp]
jmp 0x46cf00
btr ebx, edi
sub esp, 0x88
mov esi, esp
call fcn.0046cf36
pop es
bsr dx, si
call fcn.0046cfbe
push eax
call fcn.0046cfa8
push dword [esp + 0xc]
ret 0x10
jmp 0x46cf6b
sub esp, 0x19
jmp 0x46ceb6
lea esp, [esp + 1]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp 0x46bb3b

Function at 0x5097c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
neg ax
jmp 0x50980c
push word [esp + 0x11]
lea esp, [esp]
xor al, al
push word [esp + 9]
rdtsc
mov eax, ebp
jmp 0x5097f6

Function at 0x509bf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edi
mov dword [esp + 0x10], ecx
mov ah, byte [esp + 0x16]
bsr edi, eax
mov edx, ebx
jmp 0x509b74
lea edx, [edx*4]
add esp, 0x10
xchg dl, ah
bsr dx, sp
lea edi, [ecx*4]
mov dword [esp + 0x16], ebp
jmp 0x509b08
mov byte [esp + 0x23], cl
setne dl
bsf di, bp
call fcn.00509bb3
dec esp
fbld tbyte [esi]
push ecx
rcl byte [ebx + 0xf]
xor dword [edx*8 - reloc.KERNEL32.dll_GetProcAddress], ebp
je 0x509b7f
rdtsc
sub al, 0xd5
sub esp, 0x10
mov dh, byte [esp + 0x2a]
pop dx
sub ah, byte [esi + 0x5a]
lea edi, [edx*4]
jmp 0x509b3b
lea esp, [esp + 0x14]
rdtsc
xchg dword [esp + 6], eax
mov ah, dh
sub esp, 0x16
out 0x83, al
in al, dx
push ss
setb ah
jmp 0x509b51
rdtsc
mov di, word [esp + 0x31]
xchg byte [esp + 0x30], dh
bsf eax, esp
bswap edx
jmp 0x509b1e
Function at 0x509d0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr dx, bp
mov ax, word [esp + 0x1c]
or eax, edx
mov dword [esp + 0x2c], edx
jmp 0x509d2b
mov ax, 0x76c
pushal
jmp 0x509cf8
mov al, dh
mov edi, 0x74e31050
mov dl, 0xe2
cld
ror eax, cl
neg dx
jmp 0x509dd7
sub esp, 0x16
lea esp, [esp + 0x52]
cld
mov dl, ah
cld
bsf edi, esi
jmp 0x509d15
setne ah
rdtsc
push word [esp + 4]
std
lea edi, [esi + edi]
jmp 0x509da9
sub esp, 0x10
mov edi, 0xc906ac96
push word [esp + 8]
mov byte [esp + 0xe], dh
mov eax, ebx
xchg word [esp + 9], dx
jmp 0x509d5d
push dword [esp + 0xd]
neg al
mov dword [esp + 5], esp
lea edx, reloc.KERNEL32.dll_GetProcAddress
pop di
std
jmp 0x509dbe
pop dword [esp + 3]
std
mov ax, 0x8552
mov eax, 0x2a5ac913
mov edi, ebx
lea edi, [eax + edi]
jmp 0x509d8d
mov ah, dh
mov byte [esp + 0xc], dh
bt edi, edx
xchg edi, eax
neg ax
xchg dx, ax
jmp 0x509ee8
shr ah, 3
mov edi, 0xe5778f76
mov eax, edi
cmc
mov al, byte [esp]
mov dh, byte [esp]
jmp 0x509d73
bswap edi
not eax
lea esp, [esp]
setno al
xchg byte [esp], dl
mov ah, byte [esp]
jmp 0x509e17
bts dx, sp
and dx, bx
mov ax, cx
mov edx, 0x96d3d709
bswap eax
mov ax, 0x56d2
jmp 0x509dea
mov dx, 0xd743
lea edx, reloc.KERNEL32.dll_GetProcAddress
lea eax, [ebx*4]
xchg edx, eax
neg di
push ax
jmp 0x509eba
pop dx
mov word [esp], dx
rdtsc
mov byte [esp + 1], dl
pop ax
neg dh
jmp 0x509e00
mov ax, word [esp + 1]
mov edx, dword [esp + 8]
neg edi
cld
mov dword [esp + 4], ecx
lea edi, [eax*4]
call fcn.00509e66
pop esp
fisttp qword [ebp + 0x14]
out 3, eax
scasb al, byte es:[edi]
mov esp, 0xbcd736db
inc ebx
sal dword [esi - reloc.KERNEL32.dll_GetProcAddress], cl
shl byte [esi - 0x77], cl
xor al, 0x24
not edx
mov word [esp], si
push word [esp]
push dword [esp + 4]
push sp
mov ah, 0x97
jmp 0x509e8b
mov edi, esp
lea edi, [ebx*4]
xchg dx, ax
lea edx, [eax + edx]
lea esp, [esp + 0xd]
mov dh, 0x56
jmp 0x509e3e
Function at 0x50a5a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 6]
mov edi, esp
call 0x50a5a3
adc edx, dword [edi + reloc.KERNEL32.dll_GetProcAddress]
mov ah, byte [0xe8ebc754]
jmp 0x50a58b
pop dx
pop edx
mov di, word [esp]
pop dx
jmp 0x50a658
jmp 0x50a58b
xchg dword [esp], edi
lea esp, [esp]
bsf eax, esi
xchg al, dl
mov ah, byte [esp + 2]
jmp 0x50a60e
clc
mov edx, 0xcd9de6e1
mov word [esp + 1], cx
lea edi, [edi*4]
mov ax, 0xf5ca
mov edi, dword [esp + 1]
jmp 0x50a5dc
inc dx
bts eax, eax
bsr edi, ebp
mov dx, cx
mov dx, word [esp]
mov ax, 0xb4ad
jmp 0x50a63b
cld
and di, di
sete al
mov ah, 0x58
mov byte [esp + 3], bh
lea esp, [esp + 2]
jmp 0x50a5f2
mov eax, 0xcc673329
rdtsc
mov word [esp + 1], cx
pushfd
push word [esp + 6]
jmp 0x50a6b2
lea esp, [esp + 9]
mov di, 0x80fd
xchg dx, ax
mov dl, 0x57
mov word [esp + 2], di
xchg dword [esp], edi
jmp 0x50a628
add esp, 3
rdtsc
add esp, 0
mov ax, 0x8687
mov edx, esi
call fcn.0050a66f
bswap edx
pop word [esp]
mov byte [esp + 5], ah
mov dword [esp + 3], eax
and dh, 0x48
jmp 0x50a6ca
lea eax, reloc.KERNEL32.dll_GetProcAddress
mov edx, 0xf3640447
mov edx, dword [esp + 4]
not al
mov dh, 0x55
lea esp, [esp]
jmp 0x50a685
mov word [esp + 3], ax
bsf dx, ax
add esp, 5
jmp 0x50a6e8
lea edx, reloc.KERNEL32.dll_GetProcAddress
xchg dword [esp], edi
mov word [esp + 1], si
inc di
sub esp, 8
sub edx, 0x63309096
jmp 0x50a722

Function at 0x50a7a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
inc ah
mov ax, word [esp + 5]
add esp, 6
mov al, byte [esp + 5]
call fcn.0050a3fc
out 0x83, eax
adc esi, dword [esi - 0x7b]
xor eax, esi
jno 0x50a4a0
lea eax, [eax + edx]
bswap eax
not ax
add esp, 0xa
not ax
mov al, byte [esp]
jmp 0x50a412
pop edx
xchg dword [esp + 7], edi
mov al, byte [esp]
push ecx
push dword [esp + 8]
mov eax, ecx
jmp 0x50a430
xchg word [esp + 9], di
lea edx, reloc.KERNEL32.dll_GetProcAddress
add esp, 8
jmp 0x50a74a
xchg ecx, eax
mov edx, 0x78230e8c
xchg word [esp + 6], di
xchg dh, ah
bsr edx, edi
jmp 0x50a482
sete ah
dec edx
bsf di, ax
pop dword [esp + 1]
push dword [esp + 0x1c]
call fcn.0050a6e0
lea esp, [esp + 6]
xchg byte [esp + 3], dl
neg dh
mov ah, 0x3e
dec dx
inc ah
call int.0050a77a
mov ch, 0x3e
lodsb al, byte [esi]
retf
mov dword [esp], ecx
push word [esp + 3]
mov dh, byte [esp + 2]
lea edx, [esi*4]
pop word [esp]
pushal
jmp 0x50a70d
rcr edi, 7
rdtsc
jmp 0x50a471

Function at 0x50a88c
Capabilities:
Parse pe header

Disassembly:
call fcn.0050a009
lea esp, [esp + 2]
mov dword [esp + 4], ebp
call 0x50a867
mov eax, dword [eax]
jmp 0x50a912
mov eax, dword [eax + 8]
push eax
jmp 0x50a004
Function at 0x4011c6
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0040114f
call section..text
movzx eax, al
cmp eax, 1
jne 0x4011e9
push 5
pop eax
jmp 0x4013b8
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401234
cmp esi, dword [ebp - 0x2c]
je 0x401249
mov eax, dword [eax]
cmp eax, ebx
jne 0x40122a
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x430314
push dword [0x430300]
push 0x430304
push dword [0x430314]
push 0x430318
call fcn.0040102b
add esp, 0x14
push 0x430318
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x430334
push dword [0x430300]
push 0x430304
push dword [0x430334]
push 0x430338
call fcn.0040102b
add esp, 0x14
push 0x430338
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x430354
push dword [0x430300]
push 0x430304
push dword [0x430354]
push 0x430358
call fcn.0040102b
add esp, 0x14
push 0x430358
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x40402c]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x404030
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x404004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x40402c]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x4046fc
push dword [0x4046d0]
push 0x4046d4
push dword [0x4046fc]
push 0x404700
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x4303ac], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x4303ac]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret