joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44358c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4435c4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4435a5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4435b4
or bl, 4
test esi, 0x20000000
je 0x4435bf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x449c6c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x449c7e
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418ed4
mov eax, dword [0x450e0c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a010
mov eax, dword [0x450e18]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a01c
mov eax, ebx
call fcn.0044a028
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x446444
push eax
push 0
push 0
mov eax, dword [0x450f58]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41a8f8]
call fcn.0041bd3c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41a8f8]
call fcn.0041bd3c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41a8f8]
call fcn.0041bd3c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044a448
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a324
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a324
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a324
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x449dbb
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44a108
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a2b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44a294
mov dl, 1
mov eax, dword [0x4115e8]
call fcn.004030a8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e10
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44a283
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004380d8
test al, al
je 0x44a276
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44a2c4
lea eax, [ebp - 0x254]
call fcn.00408780
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44a276
xor eax, eax
push ebp
push 0x44a26f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44a2fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44a258
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44a258
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a276
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44a179
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004150c4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a2ba
lea eax, [ebp - 0x260]
call fcn.00403e10
ret

Function at 0x44abe8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x452bb0]
cmp byte [eax + 0xa5], 0
jne 0x44ac59
cmp dword [0x452bc8], 0
jne 0x44ac1a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44aba4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x452bc8], eax
cmp dword [0x452bc4], 0
jne 0x44ac35
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x452bc4], eax
cmp dword [0x452bcc], 0
jne 0x44ac59
push esp
push 0
push 0
push 0x44ab48
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x452bcc], eax
pop edx
ret
Function at 0x44ad50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44ad67
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418ed4
mov eax, dword [0x450f44]
cmp word [eax + 2], 0
jne 0x44ad8f
mov eax, dword [0x450f44]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c440
mov eax, dword [0x450fec]
cmp word [eax + 2], 0
jne 0x44ada9
mov eax, dword [0x450fec]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c638
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4111cc]
call fcn.004030a8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b0a8]
call fcn.00420cf0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44af30
mov eax, dword [0x450e6c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004210c0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44cbd8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x450e6c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bdbc
test eax, eax
je 0x44ae9e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408174
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bde4
test eax, eax
je 0x44aeb2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, dword [0x450d70]
cmp byte [eax], 0
jne 0x44aee6
mov eax, ebx
call fcn.0044b058
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044cdb4
mov eax, ebx
call fcn.0044d778
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44af26
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b2d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x452bb0]
cmp dword [eax + 0x30], 0
je 0x44b382
cmp dword [ebx + 0x94], 0
jne 0x44b37c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44b268
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44b37c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44b342
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44b37c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413534
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44b351
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44bee4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44bf19
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f00
jmp 0x44bf26
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403e64
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44cf90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44cfd1
mov eax, esi
call fcn.004338e0
test al, al
je 0x44cfd1
mov eax, dword [ebx + 0x84]
call fcn.00433608
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44cfd1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00433608
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x44e318
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x44e350]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44e32e
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44e33d
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44e34c
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x44f7e8
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x450fd0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f80e
push 0
mov eax, dword [0x450fd0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x1970f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1251000]
push edi
or ebp, 0xffffffff
jmp 0x1970f82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1970f89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1970f78
mov eax, 1
add ebx, ebx
jne 0x1970f9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1970fac
jne 0x1970fcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1970fcb
dec eax
add ebx, ebx
jne 0x1970fb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1970f90
add ebx, ebx
jne 0x1970fc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x197101d
xor ecx, ecx
sub eax, 3
jb 0x1970fe3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1971052
sar eax, 1
mov ebp, eax
jmp 0x1970fee
add ebx, ebx
jne 0x1970fee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1970fbc
inc ecx
add ebx, ebx
jne 0x1970ffc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1970fbc
add ebx, ebx
jne 0x1971009
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1970ffe
jne 0x197101a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1970ffe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x197103c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x197102e
jmp 0x1970f7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x197103c
add edi, ecx
jmp 0x1970f7e
pop esi
mov edi, esi
mov ecx, 0xe475
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x197105a
cmp byte [edi], 0x23
jne 0x197105a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x197105f
lea edi, [esi + 0x156c000]
mov eax, dword [edi]
or eax, eax
je 0x19710ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x157429c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15743dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x197108c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15743e4]
or eax, eax
je 0x19710c8
mov dword [ebx], eax
add ebx, 4
jmp 0x19710a9
call dword [esi + 0x15743e0]
mov ebp, dword [esi + 0x15743e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1971102
sub esp, 0xffffff80
jmp 0x5bd44c

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x148db67
Capabilities:
Encode data using xor

Disassembly:
dec al
clc
rol al, 3
mov byte [esp + 8], 0xd2
call fcn.014817ec
adc al, 0xe
sbb esi, ecx
and dh, cl
pushal
test byte [edi + 0x73], bh
sbb byte [esi - 0x1cea916c], bl
pop esi
test al, 0x89
xor al, 0xd6
jmp 0x148dbb1
jns 0x148dbf8
dec ecx
xlatb
add eax, 0x81671146
mov byte [0xcbc210e2], al
shl dword [edi + 0x75], cl
xchg esp, eax
add bl, al
mov esp, 0xccf42e36
push es
push 0xffffffffffffffac
sub al, 0xd2
mov dh, 0x7c
je 0x148db82
sub ah, al
dec esi
leave
push ss
in eax, dx
cmp ch, byte [esi]
out 0x18, al
clc
push word [esp + 8]
popf
call fcn.025c286f
invalid
xor dword [edi - 0x6fa5709b], esi
push ecx
stosd dword es:[edi], eax
mov esi, 0xbb7e8480
dec ecx
nop
push esi
wait
push ebp
insb byte es:[edi], dx
jle 0x148dbf8
and dword [eax - 0x22], edx
lea esi, [ebx + 0x7fbbd527]
mov ebp, 0xefc65033
push 0xf400da96
sbb cl, al
pop ss
mov dword [ecx - 0x70b6aa32], edx
add dword [esi], ebx
hlt
Function at 0x589eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test esi, esi
mov ecx, edi
jbe 0x589ed0
mov dl, byte [esp + 0x14]
mov al, byte [ecx]
add al, dl
xor al, dl
mov byte [ecx], al
inc ecx
dec esi
jne 0x589ec4
mov eax, edi
pop edi
pop esi
ret

Function at 0x596e22
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, eax
rdtsc
lea esp, [esp + 0xc]
js 0x598ce3
setg cl
cwde
mov ecx, 0x11
jbe 0x5aa7c7
lea edi, [0x7dac498d]
push edx
lea edi, [ebp - 0x54]
pop eax
cdq
mov al, bl
pushfd
rep movsd dword es:[edi], dword [esi]
xor dx, bx
rcr ch, 2
mov ecx, dword [ebp + 8]
rdtsc
dec eax
mov edx, dword [ebp - 0x44]
xor ax, bx
rol al, 2
not al
rol eax, cl
mov dword [ecx + 0x10], edx
push ecx
adc dl, dl
rcr dword [ecx - 0x3f01932b], 0x8b
inc ebp
or byte [esi - 0x2d], ah
shl dword [esi + 0xf], 1
mov esi, 0xe1d366cb
btc cx, si
mov ecx, dword [ebp - 0x40]
sal dx, cl
sbb dh, 0x27
cmp ax, 0xf29f
mov dword [eax + 0x14], ecx
jmp fcn.005afa00
movsx edi, cl
push 0x717e9193
mov ecx, 0x11
push ecx
push 0xcea21c08
jmp 0x58c4ad
lahf
rdtsc
cwde
lea edi, [ebp - 0x54]
not dx
pushfd
pushal
call fcn.005acc34
mov byte [esp + 8], ah
mov dword [ebp - 0x24], edx
pushfd
mov dword [ebp - 0x3c], 0
pushfd
mov dword [esp], 0x37eb653d
lea esp, [esp + 0x38]
jmp 0x5bfc45
shrd dx, bp, 8
sar dh, 1
rcl dx, cl
rol dx, cl
mov edx, dword [ebp - 0x34]
clc
bt bp, 0xf
test al, dh
push 0x5a070d5a
sub eax, eax
movzx ax, al
btc ax, 9
call fcn.005bc5c9

Function at 0x597a70
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
cmp dword [edx + 0x10], 0
mov byte [esp], 0x25
pushal
pushfd
push dword [esp]
lea esp, [esp + 0x30]
je 0x5bab98
rdtsc
rdtsc
mov eax, dword [ebp - 0x74]
setge ch
mov ecx, dword [eax + 0xc]
shr al, cl
pushfd
cmc
sar dh, cl
add ecx, dword [ebp + 0x10]
movzx eax, bl
aas
rcr dx, 3
xchg dx, ax
mov edx, dword [ebp - 0x74]
call fcn.005abb19
push 0x58e718
pushal
mov byte [esp + 8], bh
pushfd
lea esp, [esp + 0x24]
call fcn.005a2d4a
push 0x1366adef
mov dword [esp], eax
pushfd
push ebx
lea esp, [esp + 8]
call fcn.005b51f1
cmp bp, bp
stc
cmp cl, bl
test sp, 0x270a
mov dword [ebp - 0x18], eax
push ebx
push dword [esp]
test dl, dh
cmp dword [ebp - 0x18], 0
pushal
call fcn.005b431a
sete al
pushfd
push dword [esp]
mov edx, dword [ebp - 0x34]
call fcn.005aa17a
pushfd
mov dword [esp], str.VirtualQuery
jmp 0x5b08ef

Function at 0x59a4d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x2c]
je 0x5a6e4d
setb ah
push 0xc1165ce
mov eax, 0xc0000001
pushal
mov byte [esp], 0x5f
push ebp
push 0x544d7e42
lea esp, [esp + 0x2c]
jmp fcn.005bb844
Function at 0x59d07a
Capabilities:
Encode data using xor

Disassembly:
jle 0x59d0a4
jl 0x59d0fd
invalid
dec esi
sub eax, dword [edx]
push ebx
inc edx
sub edi, dword [ecx + 0x65]
or eax, esi
scasb al, byte es:[edi]
pop edi
mov bh, 0x4c
jne 0x59d0a1
mov byte [0xe181ee63], al
xor eax, ebp
retf
pop esp
inc esi
wait
invalid
mov ebx, 0x938fcd8b
test al, 0xda
dec ebp
adc dword [eax + 6], edi
xor al, 0x7e
xor cl, al
mov ebx, 0x1615bbe6
jno 0x59d0f8
pop edx
popal
pop edi
mov byte [0x9abc8e88], al
stosd dword es:[edi], eax
lcall 0x48ae, 0x436af91d
xchg ecx, eax
rep lodsd eax, dword es:[esi]
outsd dx, dword [esi]
hlt

Function at 0x59f25b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dh, dh
push dword [esp]
cmp dword [ebp + 0x18], 4
pushfd
lea esp, [esp + 0xc]
jne 0x5c55a1
pushfd
cmp dword [ebp + 0x14], 8
jmp 0x5ad28a
mov eax, 0xc0000001
pushfd
pushal
lea esp, [esp + 0x24]
jmp fcn.005bb844
lea esp, [esp + 4]
je 0x5a6e4d
not ax
setp ah
jmp 0x5a1824

Function at 0x5a04c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5b1d35
add esp, 0xc
cmc
clc
cmc
test eax, eax
push 0x30b740ec
lea esp, [esp + 4]
jne 0x5b0b82
rdtsc
lahf
mov eax, dword [ebp + 0x14]
movzx dx, cl
push eax
jmp 0x5a527b

Function at 0x5a0ded
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5abf50
mov word [esp], 0xd480
mov byte [esp + 4], 0xd8
lea esp, [esp + 0xc]
je 0x5ac038
xor dh, al
lea ecx, [ebp*2 + 0x3bb1ffe0]
clc
mov edx, dword [ebp + 0xc]
sbb ah, 0x42
neg cl
push 0xf48786c6
mov dword [edx], 0
xadd ah, cl
mov dword [edx + 4], 0
xor cx, 0x83a2
btc dx, cx
shr eax, 8
rcr dh, 4
mov eax, dword [ebp + 0xc]
movsx dx, dl
shld dx, dx, 0xf
mov dword [eax + 8], 0
movzx dx, bl
or dl, 0x8b
and cl, cl
pushfd
mov dword [eax + 0xc], 0
pushal
cdq
seta cl
mov ecx, dword [ebp + 0xc]
sub ah, 0x46
inc esi

Function at 0x5a1415
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x5a6e4d
bswap ax
mov eax, 0xc0000001
pushfd
lea esp, [esp + 4]
jmp fcn.005bb844

Function at 0x5a1af7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x5b3860
call fcn.005b814d
Function at 0x5a4991
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
mov dword [eax + 4], ecx
clc
cmc
call fcn.005bafff
mov dword [esp + 0x20], eax
pushal
lea esp, [esp + 0x40]
jle 0x5c676a
push 0xa5f50899
lea esp, [esp + 4]
call 0x58bdeb
rcl cx, 6
bt edi, 7
add esp, 4
shld ecx, edi, 0x1a
mov ecx, dword [ebp + 8]
shrd dx, bx, 8
mov edx, dword [ebp + 8]
sbb ah, al
pushal
adc ax, 0x1f73
sal al, cl
sub edx, dword [ecx + 8]
and cl, 0xf2
sar al, 3
pop eax
mov dword [ebp - 0x1c], edx
aaa
mov eax, dword [ebp + 0xc]
xadd ecx, edx
bswap ecx
mov dword [ebp - 0x14], eax
cdq
rcl dh, 6
shrd cx, sp, 3
shl cl, 5
mov ecx, dword [ebp - 0x14]
btr dx, bx
stc
and edx, 0x9fc9683c
shl dl, 2
mov dword [ebp - 0xc], ecx
pushfd
lea ecx, [edx - 0x557f776a]
sar cx, cl
mov edx, dword [ebp - 0xc]
btc cx, 8
cmc
mov eax, dword [ebp - 0xc]
ror cx, 0xe
add eax, dword [edx + 0x3c]
test bp, 0x53cb
sar cl, 2
rcl ecx, cl
bts cx, bp
mov dword [ebp - 8], eax
bsr cx, ax
aas
dec ah
and cl, al
mov ecx, dword [ebp - 8]
das
mov ah, byte [esp + 0xc]
btc ax, 1
xor edx, edx
call fcn.005a7245
pushfd
pushal
jmp 0x5aca43

Function at 0x5ac885
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ch
mov dword [eax], 0
cmc
cmp dl, 0xe
btr cx, 4
clc
mov ecx, dword [ebp + 0x14]
cmp cl, bl
mov dword [ecx + 4], 1
clc
call fcn.005afe6d
mov dword [ecx + 4], 0
rdtsc
add ax, 0x1935
mov edx, dword [ebp - 0xc]
pushal
mov dword [edx], 1
adc ax, 0x3b52
rdtsc
mov eax, dword [ebp - 0xc]
cmp bl, al
xor cl, ah
pop ecx
shl ch, cl
mov ecx, dword [ebp - 4]
sal dx, 0xd
mov dword [eax + 8], ecx
bsf dx, di
mov edx, dword [ebp - 0xc]
das
cwde
mov eax, dword [ebp - 8]
sal cx, 1
pop ecx
mov dword [edx + 0xc], eax
cmc
btc dx, 1
bts cx, cx
mov ecx, dword [ebp - 0xc]
sal dh, 6
or ecx, 0x80000000
ror dl, cl
push edx
mov edx, dword [ebp + 8]
mov byte [esp + 8], 0xbe
mov dword [edx], ecx
bt ax, 0xb
bt cx, bp
clc
pushfd
cmp dword [ebp + 0x14], 0
mov byte [esp + 8], cl
pushal
push esi
lea esp, [esp + 0x44]
je 0x59788a
invalid
shrd ax, dx, cl
aam 0x17
sal cx, 0xf
mov eax, dword [ebp + 0x14]
bswap cx
jmp 0x5a14d6
mov byte [esp + 4], 0x21
lea esp, [esp + 8]
je 0x5b3a43
bsr dx, ax
sub dl, al
aam 4
mov ecx, dword [ebp - 0xc]
jmp 0x5a9a3b
Function at 0x5aca02
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
dec dh
mov dword [ebp - 0x20], ecx
bsf dx, sp
sbb dx, 0xa33b
lea edx, [0xe49ec282]
inc dx
mov edx, dword [ebp - 0x20]
pushal
push 0xb68cda9e
test bl, 0x36
cmp edx, dword [ebp - 0x1c]
push dword [esp + 0xc]
mov byte [esp + 0x10], dl
call fcn.005bd5cf
jmp 0x5a7b90
btr ax, 9
das
jmp 0x5ba35b
cmc
cmc
sub ecx, ecx
bswap cx
mov cx, word [eax + 6]
cmp cl, bh
cmp dword [ebp - 0x10], ecx
jmp 0x5bcb7c
sub ecx, 0xd1b458f2
pushfd
call fcn.005bb571
lea esp, [esp + 0x10]
je 0x5aca2f
or ah, ah
lahf
mov edx, dword [ebp + 0x14]
adc eax, 0x70cfaa13
setbe ch
mov eax, dword [edx]
sal dl, cl
test dl, dl
mov dword [ebp - 0x10], eax
cmp ax, 0x174f
and dh, 0xe8
mov ecx, dword [ebp - 4]
shl dl, cl
mov edx, dword [ecx + 0xc]
call fcn.005b42d8
lea esp, [esp + 0x24]
call 0x58bdeb
pushfd
add esp, 8
push esp
aas
mov ecx, dword [ebp + 8]
ror ax, cl
sbb ah, bh
setae dl
sub ah, ah
mov edx, dword [ebp + 8]
rcr al, 6
shr al, cl
bsr eax, esp
sar al, cl
sub edx, dword [ecx + 8]
inc ch
sub ch, 0x87
cwde
mov dword [ebp - 0x1c], edx
aaa
rcr eax, 0x1f
movsx dx, al
mov eax, dword [ebp + 0xc]
mov dx, 0x4994
shld cx, si, cl
jmp 0x5b99d8
mov dword [ebp - 0x14], eax
cdq
or cl, 0x91
mov ecx, dword [ebp - 0x14]
bts dx, 9
das
rdtsc
xadd dx, ax
mov dword [ebp - 0xc], ecx
btr ax, bp
sal ax, cl
cwde
mov edx, dword [ebp - 0xc]
cmc
clc
mov eax, dword [ebp - 0xc]
shl cl, 4
add eax, dword [edx + 0x3c]
adc ecx, esi
rcl cx, 1
movsx cx, cl
mov dword [ebp - 8], eax
aad 0x3f
rcl cx, cl
dec al
cwde
mov ecx, dword [ebp - 8]
daa
daa
bswap eax
dec ah
xor edx, edx
movzx dx, cl
mov dx, word [ecx + 0x14]
lea ecx, [ecx*4 + 0x70378fd3]
mov eax, dword [ebp - 8]
bswap ecx
movzx cx, dl
push esi
pop ecx
lea ecx, [eax + edx + 0x18]
mov byte [esp], bl
pushal
pushfd
pushfd
mov dword [ebp - 4], ecx
mov byte [esp + 8], al
mov dword [ebp - 0x10], 0
pushfd
lea esp, [esp + 0x30]
jmp 0x5a02da
mov eax, dword [ebp - 8]
jo 0x59e0d8
test dh, 0xa7
xor ecx, ecx
rol ch, 2
shld cx, di, cl
mov cx, word [eax + 6]
push 0x24ff290f
cmp dword [ebp - 0x10], ecx
mov dword [esp], eax
lea esp, [esp + 4]
jge 0x5b6dd8
movzx ax, cl
mov edx, dword [ebp - 0x10]
rcr ah, 4
bswap ax
bswap cx
imul edx, edx, 0x28
rol cl, cl
bswap eax
sal al, 1
mov eax, dword [ebp - 4]
shl ch, cl
mov ecx, dword [ebp - 0xc]
cmp sp, 0xfa01
add ecx, dword [eax + edx + 0xc]
jmp 0x599ba8