joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47238f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00471f76

Function at 0x47239a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00472105

Function at 0x4728bd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042f8d0
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0046fa63
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4728ff
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x472a5b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00484ca0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x66a128]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00473e50
mov ecx, dword [esi*4 + 0x66a128]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x472a54
cmp eax, dword [edi + ecx + 0x24]
jne 0x472a54
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x472a54
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00473e50
add esp, 0x14
test edx, edx
jl 0x472a54
jg 0x4729ca
test eax, eax
jb 0x472a54
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x472a54
jl 0x4729e4
cmp dword [ebp - 0x1008], eax
ja 0x472a54
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x472a02
test ebx, ebx
je 0x472a3b
cmp ecx, edi
jae 0x472a3b
mov al, byte [ecx]
cmp al, 0xd
jne 0x472a1c
lea eax, [edi - 1]
cmp ecx, eax
jae 0x472a28
cmp byte [ecx + 1], 0xa
jne 0x472a28
inc ecx
jmp 0x472a28
movzx eax, al
movsx eax, byte [eax + 0x49c3e0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x472a02
cmp edx, ebx
jne 0x472a02
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x472a59
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042e35c
leave
ret
Function at 0x472fd9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x66a128]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x473019
cmp byte [ebx], 0xa
jne 0x473019
or byte [eax + edi + 0x28], 4
jmp 0x47301e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x47311c
mov al, byte [edx]
cmp al, 0x1a
je 0x4730fe
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x47304d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x473072
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x47307c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x47302f
jmp 0x47311c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4730f9
cmp dword [ebp - 0xc], 0
je 0x4730f9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x66a128]
test byte [eax + edi + 0x28], 0x48
je 0x4730d3
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4730be
mov byte [esi], dl
jmp 0x4730cf
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x66a128]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x47311c
cmp byte [ebp - 1], 0xa
jne 0x4730e2
cmp esi, ebx
jne 0x4730e2
mov byte [esi], 0xa
jmp 0x47311b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00473e6e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x47311c
mov byte [esi], 0xd
jmp 0x47311b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x66a128]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x473118
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x47311c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x473125
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x66a128]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x473168
cmp word [esi], dx
jne 0x473168
or byte [edi + eax + 0x28], 4
jmp 0x47316d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4732c0
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4732a0
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4731af
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4731e5
cmp eax, edx
jae 0x4731f1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x473187
jmp 0x4732c0
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47329c
cmp dword [ebp - 0x14], 0
je 0x47329c
mov eax, dword [ebx*4 + 0x66a128]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x473274
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x47323d
mov word [esi], cx
jmp 0x473270
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x66a128]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x66a128]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x66a128]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4732c0
pop ebx
cmp word [ebp - 4], bx
jne 0x473285
cmp esi, dword [ebp + 0xc]
jne 0x473285
mov word [esi], bx
jmp 0x4732bd
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00473e6e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4732c0
push 0xd
jmp 0x4732b9
mov ecx, dword [ebx*4 + 0x66a128]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4732b7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4732c0
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x404d9c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffff9c
mov esi, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0xc
call fcn.00402ea8
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ea8
mov dword [esp + 4], 0xc
xor eax, eax
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x44
mov dword [esp + 0x3c], 1
mov word [esp + 0x40], 0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x20
cmp bl, 1
cmc
sbb eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
mov eax, esi
call fcn.00403b88
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x404e39
push 0x30
push 0x404e70
push 0x404e78
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x404e64
push 0xffffffffffffffff
mov eax, dword [esp + 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
push esp
mov eax, dword [esp + 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esp + 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp + 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
add esp, 0x64
pop esi
pop ebx
ret

Function at 0x404e94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x40a8f0
mov esi, 0x40a8f4
mov edi, 0x40a8f8
mov ebp, 0x40a908
mov eax, 0x404fb4
call fcn.00404c64
call fcn.00404bb8
mov eax, dword [0x40a8e4]
push eax
call sub.kernel32.dll_LockResource
mov dword [0x40a8e8], eax
mov eax, dword [0x40a8e0]
push eax
mov eax, dword [0x40a7e0]
push eax
call sub.kernel32.dll_SizeofResource
call fcn.00402c14
mov dword [0x40a8ec], eax
mov eax, dword [0x40a8e8]
mov dword [ebx], eax
mov eax, dword [0x40a8ec]
mov dword [esi], eax
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov eax, dword [0x40a8e0]
push eax
mov eax, dword [0x40a7e0]
push eax
call sub.kernel32.dll_SizeofResource
xor edx, edx
mov dword [0x40a910], eax
mov dword [0x40a914], edx
jmp 0x404f5c
mov edx, edi
mov eax, dword [ebx]
mov ecx, 0x10
call fcn.00402d0c
mov eax, edi
call fcn.00404ca8
mov edx, dword [esi]
mov eax, edi
mov ecx, 0x10
call fcn.00402d0c
add dword [ebp], 0x10
adc dword [ebp + 4], 0
mov eax, dword [ebx]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esi]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [0x40a910]
mov edx, dword [0x40a914]
sub eax, dword [ebp]
sbb edx, dword [ebp + 4]
cmp edx, 0
jne 0x404f7a
cmp eax, 0x10
jae 0x404f23
jmp 0x404f7c
jge 0x404f23
call fcn.00404c9c
mov eax, dword [0x40a8ec]
xor edx, edx
add eax, dword [0x40a910]
adc edx, dword [0x40a914]
sub eax, 1
sbb edx, 0
mov dword [ebx], eax
mov eax, dword [ebx]
movzx eax, byte [eax]
mov byte [0x40a91c], al
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xed58d8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xed58e2
pushal
call 0xed58e8
pop ebp
sub ebp, 0x10
sub ebp, 0xad58d8
jmp 0xed58fe
mov eax, 0xad58d8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b9
mov edx, 0xad57ae05
xor byte [eax], dl
inc eax
dec ecx
jne 0xed5915
jmp 0xed5928
mov cs, eax
mov cs, word [ecx + edi - 0x7bfafafb]
invalid
Function at 0x401720
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x4050ff], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401767
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x401fad
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405364]
test eax, eax
je 0x401fc6
call eax
test eax, eax
jne 0x401fc6
push 0xfffffffffffffffe
jmp 0x401fe0
push 1
push 0x405010
push 0x405008
call fcn.00401b91
add esp, 0xc
test eax, eax
je 0x401fe6
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00401b91
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x40200c
mov esi, 0x4049c2
mov cl, 0x20
jmp 0x402015
cmp al, 0x20
ja 0x40201f
inc esi
mov al, byte [esi]
test al, al
jne 0x402010
cmp al, 0x20
jbe 0x402036
mov al, byte [esi]
cmp al, 0x22
jne 0x402028
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x402021
jmp 0x402036
cmp al, cl
ja 0x40203c
inc esi
mov al, byte [esi]
test al, al
jne 0x402031
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x402065
movzx eax, word [ebp - 0x14]
jmp 0x402068
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040209d
pop ecx
pop esi
leave
ret

Function at 0x40209d
Capabilities:
Terminate process

Disassembly:
call fcn.004020e7
push 0
push 0x405018
push 0x405014
call fcn.00401b91
push 0
push 0x405020
push 0x40501c
call fcn.00401b91
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1002c060
Capabilities:
Check for peb beingdebugged flag

Disassembly:
pushal
call 0x1002c066
pop edx
sub edx, 0x402cfb
jmp 0x1002c071
mov ebx, edx
mov ecx, ebx
add ecx, 0x402d05
mov al, byte [ecx]
or al, al
jne 0x1002cb5f
mov byte [ecx], 1
mov ebp, esp
sub esp, 0x1000
mov eax, ebx
add eax, 0x4037fa
mov dword [ebp - 0x34], eax
mov eax, ebx
add eax, 0x4037fa
add eax, 0x194
mov dword [ebp - 0xc], eax
xor eax, eax
mov byte [ebp - 0xb5], al
jmp 0x1002c0b4
xor ecx, ecx
mov byte [ebp - 0xb6], cl
jmp 0x1002c0bf
mov byte [ebp - 0x4d], 0x80
mov eax, dword fs:[0x30]
mov cl, byte [eax + 2]
mov dl, 7
ror dl, cl
add byte [ebp - 0x4d], dl
mov eax, ebx
add eax, 0x402dc2
mov dword [ebp - 0x58], eax
mov eax, ebx
add eax, 0x4037fa
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
add edx, 0x234
mov dword [ebp - 0x54], edx
xor eax, eax
mov byte [ebp - 0xb7], al
jmp 0x1002c0fe
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x54]
jae 0x1002c12d
xor edx, edx
mov byte [ebp - 0xb8], dl
jmp 0x1002c111
movzx eax, byte [ebp - 0x4d]
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 0x58]
mov byte [eax], dl
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
jmp 0x1002c0fe
mov ah, 0x55
movhlps xmm0, xmm0
js 0x1002c1ac
js 0x1002c1a2
xchg byte [edi + 0x40], ch
ret 0x875b
inc edi
add al, 0x47
xchg edi, eax
push cs
ret 0xc47
or al, 0x96
push cs
rol byte [edi + 0xc], cl
ret 0xc4b
sahf
push ss
xor esi, dword [ebx]
xor esi, dword [ebx]
xchg dword [edi + 0x2bec9787], eax
xchg byte [edi - 0x787ab819], al
mov eax, dword [edi - 0x7a]
xchg edi, edx
mov ecx, 0xc5af8785
test dword [edi - 0x7879b9f1], eax
dec ebx
mov eax, 0xc5c58785
test dword [edi - 0x7879b879], eax
ret
Function at 0x4012b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430bd3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x445028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.c_download_dlg.0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
push 0
push dword [ebp + 8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00401bb0
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi + 0xc], 0x81
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], reloc.KERNEL32.dll_RaiseException
mov dword [esi + 0x20], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40e4f9
Capabilities:
Parse pe header

Disassembly:
push 0
call fcn.005325d2
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x40e50a
xor al, al
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40e507
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], reloc.KERNEL32.dll_RaiseException
jne 0x40e507
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40e507
cmp dword [eax + 0x74], 0xe
jbe 0x40e507
cmp dword [eax + 0xe8], 0
setne al
ret
Function at 0x486ec8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
jmp 0x486f2f
push 0xf04783e8
jmp 0x486ffe
mov byte [esp + 2], cl
pop word [esp]
lea esp, [esp + 2]
jmp 0x486f95
jae 0x486f80
mov word [esp + 3], dx
pop word [esp]
jmp 0x486f08
mov word [esp + 3], dx
pop word [esp]
mov byte [esp + 2], cl
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x18], edx
call fcn.00486ef2
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x486fb6
pushfd
jmp 0x486ece
stc
jmp 0x48703e
stc
jmp 0x48703e
mov bx, word [esp]
dec ebp
je 0x486fe0
jne 0x486fe7
xchg word [esp], dx
push dword [esp + 3]
je 0x487025
jne 0x487065
enter 0xffffffffffffc24c, 0xffffffffffffffa5
push esp
in al, 0x59
mov eax, 0x348df29b
and al, 0xe8
loop 0x487022
lea esi, [esp]
call 0x487007
invalid
invalid
pop ax
lea esp, [esp + 2]
jmp 0x48704f
mov edi, dword [esp + 0x2c]
mov ebx, ebp
xchg bp, dx
push cx
lea esp, [esp + 2]
jmp 0x48701d
sub esp, 0xbc
jmp 0x48706d
pop ax
lea esp, [esp + 2]
jmp 0x48704f
mov ebp, esp
sub esp, 0x12
jmp 0x48755b
rdtsc
neg ebx
bswap eax
lea esp, [esp + 2]
mov ecx, edi
lea eax, reloc.KERNEL32.dll_RaiseException
mov dx, cx
jmp 0x487106
mov bl, ah
cmc
bswap edx
jmp 0x4870d8
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x48709c
neg dx
ja 0x4870eb
push ax
add esp, 1
xchg al, ah
lea eax, [esi*4]
lea esp, [esp + 1]
call fcn.00487139
pop ds
push si
lea esp, [esp + 2]
sub edi, 0x4a8d658c
mov bl, bh
mov edx, dword [esp]
jmp 0x4870bb
push ax
add esp, 1
jmp 0x48725e
and bx, ax
jbe 0x4870b2
sub esp, 0x16
lea esp, [esp + 2]
mov bl, ah
cmc
bswap edx
jmp 0x4870d8
not edi
mov edx, 0xdb7946d9
rdtsc
jmp 0x48719c
xor edi, 0x3f85c71e
lea edx, reloc.KERNEL32.dll_RaiseException
neg edx
jmp 0x4871a2
cmp dl, ch
jp 0x487182
jnp 0x487182
jo 0x4871b8
pushal
lea ebx, [edx*4]
jmp 0x4871c0
pushal
lea ebx, [edx*4]
call fcn.004871d6
add edx, 0x265d9cda
jmp 0x48b351
add edx, 0x7616cec5
call 0x48b449
pop ebp
lodsb al, byte [esi]
mov edi, 0x66303186
mov word [esp + 7], si
xchg al, ah
lea eax, [esi*4]
lea esp, [esp + 1]
jmp 0x487177
bswap eax
lea esp, [esp + 2]
jmp 0x487082
jb 0x487078
rdtsc
neg ebx
jmp 0x487322
setle bh
mov bx, word [esp]
call fcn.0048b325
mov ebx, dword [esp]
jmp 0x48b366
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x4871f8
Function at 0x487007
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
jmp 0x486f2f
push 0xf04783e8
jmp 0x486ffe
mov byte [esp + 2], cl
pop word [esp]
lea esp, [esp + 2]
jmp 0x486f95
jae 0x486f80
mov word [esp + 3], dx
pop word [esp]
jmp 0x486f08
mov word [esp + 3], dx
pop word [esp]
mov byte [esp + 2], cl
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x18], edx
call fcn.00486ef2
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x486fb6
pushfd
jmp 0x486ece
stc
jmp 0x48703e
stc
jmp 0x48703e
mov bx, word [esp]
dec ebp
je 0x486fe0
jne 0x486fe7
xchg word [esp], dx
push dword [esp + 3]
je 0x487025
jne 0x487065
enter 0xffffffffffffc24c, 0xffffffffffffffa5
push esp
in al, 0x59
mov eax, 0x348df29b
and al, 0xe8
loop 0x487022
lea esi, [esp]
call 0x487007
invalid
invalid
pop ax
lea esp, [esp + 2]
jmp 0x48704f
mov edi, dword [esp + 0x2c]
mov ebx, ebp
xchg bp, dx
push cx
lea esp, [esp + 2]
jmp 0x48701d
sub esp, 0xbc
jmp 0x48706d
pop ax
lea esp, [esp + 2]
jmp 0x48704f
mov ebp, esp
sub esp, 0x12
jmp 0x48755b
rdtsc
neg ebx
bswap eax
lea esp, [esp + 2]
mov ecx, edi
lea eax, reloc.KERNEL32.dll_RaiseException
mov dx, cx
jmp 0x487106
mov bl, ah
cmc
bswap edx
jmp 0x4870d8
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x48709c
neg dx
ja 0x4870eb
push ax
add esp, 1
xchg al, ah
lea eax, [esi*4]
lea esp, [esp + 1]
call fcn.00487139
pop ds
push si
lea esp, [esp + 2]
sub edi, 0x4a8d658c
mov bl, bh
mov edx, dword [esp]
jmp 0x4870bb
push ax
add esp, 1
jmp 0x48725e
and bx, ax
jbe 0x4870b2
sub esp, 0x16
lea esp, [esp + 2]
mov bl, ah
cmc
bswap edx
jmp 0x4870d8
not edi
mov edx, 0xdb7946d9
rdtsc
jmp 0x48719c
xor edi, 0x3f85c71e
lea edx, reloc.KERNEL32.dll_RaiseException
neg edx
jmp 0x4871a2
cmp dl, ch
jp 0x487182
jnp 0x487182
jo 0x4871b8
pushal
lea ebx, [edx*4]
jmp 0x4871c0
pushal
lea ebx, [edx*4]
call fcn.004871d6
add edx, 0x265d9cda
jmp 0x48b351
add edx, 0x7616cec5
call 0x48b449
pop ebp
lodsb al, byte [esi]
mov edi, 0x66303186
mov word [esp + 7], si
xchg al, ah
lea eax, [esi*4]
lea esp, [esp + 1]
jmp 0x487177
bswap eax
lea esp, [esp + 2]
jmp 0x487082
jb 0x487078
rdtsc
neg ebx
jmp 0x487322
setle bh
mov bx, word [esp]
call fcn.0048b325
mov ebx, dword [esp]
jmp 0x48b366
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x4871f8

Function at 0x48d38b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
pop ax
mov ebx, 0xed1b23b
lea esp, [esp + 2]
jmp 0x48d3d5
mov ecx, ebp
mov ax, word [esp]
lea eax, [edx - 0xa9]
xchg bx, ax
bts edx, ebx
jp 0x48d3bf
rdtsc
adc ebx, esp
mov dl, byte [esp]
bswap edx
sub esp, 0x1d
jmp 0x48da6f

Function at 0x533c2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dh
pushal
mov ax, 0x6016
mov dword [esp + 0xc], ebp
rdtsc
jmp 0x533c0c