joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401331
Capabilities:
Accept command line arguments
Create directory
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4163e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push str.MCAFEE_FRAMEWORK_LOG_MUTEX
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0xc]
push 0
push 0
mov dword [0x416008], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, 0xffffffff
mov dword [section..data], eax
je 0x40147d
push esi
push edi
mov esi, str._LOGDIR
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0
je 0x4013e2
push 8
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.004039d4
add esp, 0xc
test eax, eax
je 0x4013a5
inc esi
cmp byte [esi], 0
jne 0x40138c
cmp byte [esi], 0
je 0x4013e2
add esi, 8
cmp byte [esi], 0x22
push ebx
mov bl, 0x20
jne 0x4013b9
add bl, 2
inc esi
mov edi, 0x104
push edi
push esi
mov esi, 0x417540
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movsx eax, bl
push eax
push esi
call fcn.00403510
test eax, eax
pop ecx
pop ecx
pop ebx
je 0x401415
mov byte [eax], 0
jmp 0x401415
lea eax, [ebp - 0x228]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.McAfeeLogs
lea eax, [ebp - 0x228]
push eax
push 0x4122ac
push edi
mov esi, 0x417540
push esi
call fcn.00403b47
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x230], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x20]
push eax
push esi
push str._sFrmInst__s.log
lea eax, [ebp - 0x124]
push edi
push eax
call fcn.00403b47
add esp, 0x14
push 0
push 0x80
push 4
push dword [ebp - 0x22c]
lea eax, [ebp - 0x124]
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop edi
mov dword [0x416004], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403bf4
leave
ret

Function at 0x401489
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4163e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x412200
push esi
call fcn.00401233
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00401956
lea eax, [ebp - 0x404]
push eax
push str.START___s_
push esi
call fcn.00401233
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.00403bf4
leave
ret
Function at 0x4015a3
Capabilities:
Create directory

Disassembly:
push esi
push edi
xor esi, esi
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4015cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4015cf
cmp esi, 0xb7
je 0x4015fd
cmp esi, 5
je 0x4015fd
push dword [esp + 0xc]
mov edi, str.Common
push str.CreateDirectory___s_
push edi
call fcn.00401233
add esp, 0xc
test esi, esi
je 0x4015fd
push 0x412200
push esi
push edi
call fcn.00401249
add esp, 0xc
xor eax, eax
jmp 0x401600
xor eax, eax
inc eax
pop edi
pop esi
ret

Function at 0x401681
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov eax, dword [0x4163e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
push ebx
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.00401956
lea eax, [ebp - 0x804]
push eax
push dword [esi + 0x10]
push str.CreateProcess___s___s_
push str.Common
call fcn.00401233
push 0x44
xor edi, edi
lea eax, [ebp - 0x848]
push edi
push eax
call fcn.00403c10
add esp, 0x28
push esi
lea eax, [ebp - 0x848]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
push dword [esi + 0x10]
mov dword [ebp - 0x848], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
pop esi
pop ebx
jne 0x401727
push 0x412200
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Common
call fcn.00401249
add esp, 0xc
xor eax, eax
jmp 0x40172a
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403bf4
leave
ret 8

Function at 0x401783
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push edi
push 0x80
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4017e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
je 0x4017e3
cmp edi, 5
jne 0x4017ba
cmp byte [esp + 0xc], 0
jne 0x4017df
push esi
push dword [esp + 0xc]
mov esi, str.Common
push str.Delete___s_
push esi
call fcn.00401233
push 0x412200
push edi
push esi
call fcn.00401249
add esp, 0x18
pop esi
xor eax, eax
pop edi
ret
xor eax, eax
inc eax
pop edi
ret
Function at 0x4017e8
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4163e0]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
mov ebx, dword [ebp + 0x94]
push esi
mov esi, dword [ebp + 0x98]
push edi
lea eax, [ebp - 0x7c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x401858
push str.GetTempPath
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Common
call fcn.00401249
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403bf4
add ebp, 0x8c
leave
ret
lea eax, [ebp - 0x7c]
push eax
call fcn.00401603
test eax, eax
pop ecx
je 0x40183e
xor edi, edi
mov dword [ebp - 0x80], edi
test edi, edi
jne 0x4018ae
push esi
push edi
push ebx
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x401881
inc edi
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 0x19
jl 0x40186b
test edi, edi
jne 0x4018ae
push ebx
lea eax, [ebp - 0x7c]
push eax
push str.getNewTempDirectory___GetTempFileName___s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Common
call fcn.00401249
add esp, 0x14
jmp 0x40183e
push 0
push esi
call fcn.00401783
push esi
call fcn.004015a3
add esp, 0xc
jmp 0x401840

Function at 0x4019ec
Capabilities:
Access the windows event log

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4163e0]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x98]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, str.NAIMServInst
push esi
xor ebx, ebx
push ebx
mov dword [0x418978], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push dword [0x418978]
mov dword [ebp - 0x78], eax
push esi
push str._s_error:__d
lea eax, [ebp - 0x74]
push 0x100
push eax
call fcn.00403eeb
add esp, 0x14
cmp dword [ebp - 0x78], ebx
lea eax, [ebp - 0x74]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edi
je 0x401a77
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403bf4
add ebp, 0x90
leave
ret
Function at 0x4026ce
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push 0x17c
mov eax, 0x41167b
call fcn.00404e66
push ebx
call fcn.004039f0
cmp eax, 4
pop ecx
jb 0x40283d
push ebx
lea ecx, [ebp - 0x48]
call fcn.004026a7
and dword [ebp - 4], 0
push 0x4125f4
lea ecx, [ebp - 0x48]
call fcn.0040266d
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x402713
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x188]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40274b
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x402734
lea eax, [ebp - 0x44]
push eax
push str.FindFirstFile___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Stub
jmp 0x402829
mov esi, str.Stub
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004026a7
push 0x4125dc
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0040266d
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040266d
test byte [ebp - 0x188], 0x14
je 0x4027cd
lea eax, [ebp - 0x15c]
push 0x4125d8
push eax
call fcn.00404f90
test eax, eax
pop ecx
pop ecx
je 0x4027e3
lea eax, [ebp - 0x15c]
push 0x4125d4
push eax
call fcn.00404f90
test eax, eax
pop ecx
pop ecx
je 0x4027e3
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4027bc
lea eax, [ebp - 0x28]
push eax
push str.Unexpected_directory_in_error_cleanup___s_
push esi
call fcn.0040121d
add esp, 0xc
jmp 0x4027e3
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4027d9
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.00401783
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402222
lea eax, [ebp - 0x188]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402750
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x402831
push ebx
push str.RemoveDirectory___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.00401249
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00402222
call fcn.00404eb0
ret

Function at 0x403bf4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4163e0]
jne 0x403bfe
repz ret
jmp fcn.00408c91
Function at 0x40477a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4047b7
cmp dword [ebp + 0x14], edi
je 0x4047b7
cmp ecx, edi
jne 0x4047be
call fcn.00405c68
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00407f94
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4047d2
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4047f3
cmp ebx, 0xffffffff
je 0x4047e2
push ebx
push edi
push ecx
call fcn.00403c10
add esp, 0xc
cmp esi, edi
je 0x40479f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x40479f
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x40480f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x404816
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x404907
test word [esi + 0xc], 0x10c
je 0x40486a
mov eax, dword [esi + 4]
test eax, eax
je 0x40486a
jl 0x404968
cmp ebx, eax
mov edi, ebx
jb 0x40483b
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x40490f
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00403e15
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4048ff
cmp ebx, dword [ebp - 0xc]
jb 0x4048d7
cmp dword [ebp - 0xc], 0
je 0x404894
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x404889
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x404890
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x40489f
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x40489f
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x40493b
push eax
push dword [ebp - 8]
push esi
call fcn.00406e13
pop ecx
push eax
call fcn.0040626d
add esp, 0xc
test eax, eax
je 0x40497a
cmp eax, 0xffffffff
je 0x404968
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4048ff
push esi
call fcn.0040b57b
cmp eax, 0xffffffff
pop ecx
je 0x40496c
cmp dword [ebp - 4], 0
je 0x40493b
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x40481e
mov eax, dword [ebp + 0x14]
jmp 0x4047b9
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x404926
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00403c10
add esp, 0xc
call fcn.00405c68
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4047af
cmp dword [ebp + 0xc], 0xffffffff
je 0x404951
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00403c10
add esp, 0xc
call fcn.00405c68
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4047af
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4047b9
or dword [esi + 0xc], 0x10
jmp 0x40496c
Function at 0x40a992
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x417080]
je 0x40a9ad
inc edi
cmp edi, 0x17
jb 0x40a99e
cmp edi, 0x17
jae 0x40ab2d
push ebp
push 3
call fcn.00410676
cmp eax, 1
pop ecx
je 0x40aaf9
push 3
call fcn.00410676
test eax, eax
pop ecx
jne 0x40a9e1
cmp dword [0x416420], 1
je 0x40aaf9
cmp ebx, 0xfc
je 0x40ab2c
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4196f8
push ebp
call fcn.00405018
add esp, 0xc
test eax, eax
je 0x40aa17
push esi
push esi
push esi
push esi
push esi
call fcn.00407e98
add esp, 0x14
push 0x104
mov esi, 0x419711
push esi
push 0
mov byte [0x419815], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40aa5b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00405018
add esp, 0xc
test eax, eax
je 0x40aa5b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00407e98
add esp, 0x14
push esi
call fcn.004039f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40aaa0
push esi
call fcn.004039f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x419a0c
push 0x413284
sub ecx, eax
push ecx
push eax
call fcn.0040edc6
add esp, 0x14
test eax, eax
je 0x40aaa0
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00407e98
add esp, 0x14
jmp 0x40aaa2
xor esi, esi
push 0x413280
push ebx
push ebp
call fcn.0040dada
add esp, 0xc
test eax, eax
je 0x40aac2
push esi
push esi
push esi
push esi
push esi
call fcn.00407e98
add esp, 0x14
push dword [edi*8 + 0x417084]
push ebx
push ebp
call fcn.0040dada
add esp, 0xc
test eax, eax
je 0x40aae4
push esi
push esi
push esi
push esi
push esi
call fcn.00407e98
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004104b9
add esp, 0xc
jmp 0x40ab2c
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40ab2c
cmp ebp, 0xffffffff
je 0x40ab2c
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x417084]
push dword [esi]
call fcn.004039f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4104b9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004078dd
xor ebx, ebx
cmp dword [0x419c60], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41058f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41066f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x41066f
push eax
call fcn.0040786f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419c60], eax
call esi
push eax
call fcn.0040786f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419c64], eax
call esi
push eax
call fcn.0040786f
mov dword [0x419c68], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040a71f
test eax, eax
pop ecx
pop ecx
je 0x41055d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407e98
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41058f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040786f
cmp eax, ebx
pop ecx
mov dword [0x419c70], eax
je 0x41058f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040786f
pop ecx
mov dword [0x419c6c], eax
mov eax, dword [0x419c6c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x410614
cmp dword [0x419c70], ecx
je 0x410614
push eax
call fcn.004078e6
push dword [0x419c70]
mov esi, eax
call fcn.004078e6
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x410614
cmp edi, ebx
je 0x410614
call esi
cmp eax, ebx
je 0x4105e1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4105e1
test byte [ebp - 0x18], 1
jne 0x410614
lea eax, [ebp - 0x10]
push eax
call fcn.0040a756
test eax, eax
pop ecx
je 0x4105fc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407e98
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x41060b
or dword [ebp + 0x10], 0x200000
jmp 0x41064f
or dword [ebp + 0x10], 0x40000
jmp 0x41064f
mov eax, dword [0x419c64]
cmp eax, dword [ebp - 8]
je 0x41064f
push eax
call fcn.004078e6
cmp eax, ebx
pop ecx
je 0x41064f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41064f
mov eax, dword [0x419c68]
cmp eax, dword [ebp - 8]
je 0x41064f
push eax
call fcn.004078e6
cmp eax, ebx
pop ecx
je 0x41064f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419c60]
call fcn.004078e6
cmp eax, ebx
pop ecx
je 0x41066f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410671
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xcf3508
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dh
mov word [esp + 1], ax
jmp 0xcf354a
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x1c], esp
call fcn.00cf3534

Function at 0xcf3526
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov byte [esp + 0xe], al
mov dword [esp + 0x20], ebx
call fcn.00cf3508

Function at 0xcf3534
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ce0a20
jmp 0xcf3594
mov byte [esp + 1], dh
pop word [esp]
push edx
jmp 0xcf355b
mov dword [esp], eax
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
call fcn.00cf364d
sti
ror byte [ebp - 0x24], cl
das
pop word ss:[esp]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp + 2]
push eax
push ecx
call fcn.00cf3506
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
pushfd
jmp 0xcef85a
call fcn.00cf35b7
pop di
btc bx, sp
jb 0xcf35b9
lea esp, [esp + 2]
jmp 0xcf35bd
lea esp, [esp + 2]
jmp 0xcf361b
call 0xcf3629
mov ebp, dword [esp + 0x2c]
mov esi, esp
mov edx, ecx
rol bl, cl
jae 0xcf35bf
jb 0xcf35bf
mov ecx, 0x336093a
call 0xcf3635
jg 0xcf367b
pop eax
xchg dword [esp], ebp
rdtsc
invalid

Function at 0xcf3629
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ce0a20
jmp 0xcf3594
mov byte [esp + 1], dh
pop word [esp]
push edx
jmp 0xcf355b
mov dword [esp], eax
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
call fcn.00cf364d
sti
ror byte [ebp - 0x24], cl
das
pop word ss:[esp]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp + 2]
push eax
push ecx
call fcn.00cf3506
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
pushfd
jmp 0xcef85a
call fcn.00cf35b7
pop di
btc bx, sp
jb 0xcf35b9
lea esp, [esp + 2]
jmp 0xcf35bd
lea esp, [esp + 2]
jmp 0xcf361b
call 0xcf3629
mov ebp, dword [esp + 0x2c]
mov esi, esp
mov edx, ecx
rol bl, cl
jae 0xcf35bf
jb 0xcf35bf
mov ecx, 0x336093a
call 0xcf3635
jg 0xcf367b
pop eax
xchg dword [esp], ebp
rdtsc
invalid

Function at 0xcf364d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x40], esi
pushfd
jmp 0xcf3586
push dword [esp + 0xf]
jae 0xcf35b0
mov dword [esp + 0x40], esi
pushfd
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0xcf358e
pushal
mov word [esp + 9], sp
mov dword [esp + 7], edi
jmp 0xcf35df
Function at 0xcf7f8d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xcf9114
call 0xcf7ffd
jmp 0xcf90fe
mov dword [esp + 0x28], eax
jmp 0xcf911f
lea ecx, [edi - 0x28]
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp 0xcf9135
push eax
call fcn.00ce4b04
jmp 0xcf7ff8
popal
jmp 0xcf9147
sub ecx, 0x100175dd
mov dword [ecx + reloc.MSVFW32.dll_DrawDibDraw], eax
jmp 0xcf9258
popfd
lea esp, [esp + 4]
ret
cmp ebx, 0xf0ea64d3
je 0xcf9203
jne 0xcf8027
xchg edx, eax
push edi
mov dh, byte [esp]
mov ax, 0x2763
bswap edx
rdtsc
jmp 0xcf91da
lea edx, [edi*4]
lea eax, [esi + edi]
mov ah, 0x1b
mov dh, byte [esp]
pop edi
jmp 0xcf9214
popal
movzx ebx, byte [edx]
pop edx
add ebx, 0xf0ea6407
jmp 0xcf919f
pop edx
call fcn.00cf923f
dec esp
xlatb
inc edi
add byte [edi + edx*8 + 0x47], cl
and dl, cl
popal
ljmp 0x65cf
mov dx, 0x164c
lea eax, [ecx - 0x6b]
rdtsc
mov ah, 0x99
mov dx, word [esp]
mov dx, 0x25f8
jmp 0xcf91fe
push edx
pushal
lea edx, [ebp*4]
mov dword [esp + 0x14], eax
jmp 0xcf91f1

Function at 0xe18593
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc dl, bh
cld
xchg word [esp + 0xb], ax
xchg dword [esp + 0xa], ecx
sub esp, 0x1c
jmp 0xe185b7
bts eax, ecx
mov cx, si
pop dword [esp + 0x10]
lea edx, [ebp*4]
neg cl
jmp 0xe18564
lea ecx, [edi + 0xd7]
xchg dword [esp + 6], eax
mov eax, esi
jmp 0xe1857a
rdtsc
xchg dx, ax
xchg word [esp + 0x2b], cx
mov dl, ah
mov ah, byte [esp + 0x12]
jmp 0xe187d5
sub edx, ebp
inc eax
xchg byte [esp + 0x2d], cl
push dword [esp + 0xc]
push dword [esp + 0x2d]
xchg edx, eax
jmp 0xe185a1
mov ecx, edx
sete cl
std
lea eax, [ecx*4]
jmp 0xe18619
mov dl, byte [esp]
mov dl, 0xc1
neg cx
mov ax, word [esp]
bswap ecx
neg ch
jmp 0xe185f1
lea edx, [edx*4]
mov edx, 0x5bcfcbf4
mov dh, byte [esp]
jmp 0xe186b5
pop edx
mov dx, 0xab11
btr ecx, eax
sete ch
mov dl, dh
bsr ax, ax
jmp 0xe18607
xchg byte [esp], ah
lea edx, [ecx*4]
xor al, 0x31
call fcn.00e18658
neg ecx
dec ax
push ax
push word [esp]
xchg al, ah
add esp, 1
jmp 0xe18681
cld
mov dx, word [esp]
mov cx, 0xafbd
mov ecx, 0x1fa86223
lea eax, [esp + ecx]
rdtsc
jmp 0xe1862f
push dword [esp + 0x2b]
lea esp, [esp + 0x44]
mov ax, di
bswap edx
push edi
mov dx, word [esp + 3]
jmp 0xe186eb
Function at 0xe18692
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 5], ecx
add esp, 8
sub esp, 0x15
neg ecx
jmp 0xe186c6
dec ah
mov cx, si
xchg word [esp + 9], dx
lea esp, [esp + 9]
pop word [esp + 4]
std
jmp 0xe18728
sub esp, 0x1e
bt ax, si
mov eax, dword [esp + 0x1c]
mov al, ch
push dword [esp + 0x1f]
pop eax
jmp 0xe18796
xchg dword [esp + 8], eax
xchg word [esp], cx
mov word [esp], bp
ror eax, 8
mov eax, 0x62e5c46
not cx
jmp 0xe18703
setle dh
mov dword [esp + 0x1c], esi
sub esp, 0
pop word [esp + 0x1f]
jmp 0xe18772
mov edx, 0xb912ba18
mov edx, 0xb7ba5ef7
mov word [esp + 6], dx
mov ah, byte [esp + 0x10]
mov edx, dword [esp + 0x20]
xchg ch, dl
jmp 0xe18741
lea ecx, [esp + ebp]
rdtsc
rdtsc
mov eax, 0xf9b03db8
mov cl, 0x8c
pop word [esp + 0x18]
jmp 0xe187bd
mov dx, 0xc2ec
mov al, ch
std
inc dh
mov dword [esp + 0x1c], ebp
mov edx, ebp
jmp 0xe18757
mov cx, 0x61db
mov ax, word [esp + 0x21]
lea edx, [edi*4]
jmp 0xe18851
mov dh, ch
clc
push dword [esp + 5]
xchg al, ah
lea ecx, [eax + ebx]
dec ax
jmp 0xe187a7
pop eax
push word [esp + 5]
rdtsc
push dword [esp + 0x18]
cld
mov ax, word [esp]
jmp 0xe18837
mov word [esp + 0x19], cx
bsf eax, esi
mov cl, 0xdb
pop dword [esp + 0x1c]
pop word [esp + 0x22]
pop cx
jmp 0xe187ed
lea eax, [edx*4]
add esp, 0x1e
sub esp, 1
jmp 0xe1887e
mov eax, edi
mov byte [esp + 0x1d], dl
mov ax, 0xbd40
pop dword [esp + 0xa]
xchg dword [esp + 7], ecx
jmp 0xe18821
and dx, di
pop ax
mov al, byte [esp + 0x15]
push dword [esp + 5]
xchg dword [esp + 0xb], eax
xchg byte [esp + 0x2a], cl
jmp 0xe1880a
push dword [esp + 4]
mov ax, di
mov dh, 0xd9
cld
xchg dword [esp + 2], ecx
jmp 0xe18894
xchg word [esp], cx
add esp, 1
mov ah, 0x71
push word [esp + 4]
shr dx, cl
add esp, 1
jmp 0xe18868
lea eax, [ecx + ecx]
mov eax, 0x3b32410b
bswap eax
bsf cx, dx
push dword [esp + 5]
jmp 0xe18991
xchg word [esp + 3], ax
call fcn.00e188c4
mov word [esp + 2], ax
lea ecx, [edi - 0x39]
add esp, 0
call fcn.00e1890b
pop ds
xchg cx, ax
adc byte [ebx + 0x66d1d00a], dl
pop eax
seto cl
neg ecx
pop word [esp + 2]
dec ecx
jmp 0xe188e4
pop dword [esp + 1]
lea ecx, [eax + esi]
pop cx
mov eax, dword [esp + 3]
pop word [esp + 3]
ror ecx, cl
jmp 0xe188da