joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d70
Capabilities:
Check if file exists
Create directory
Get file attributes
Write file on windows

Disassembly:
mov eax, dword [0x41371c]
sub esp, 0x408
add eax, 0x12dc
lea ecx, [esp + 0x14]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
push 0x413138
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403dac
test al, 0x10
jne 0x403db9
lea eax, [esp + 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov edx, dword [esp + 0x12]
mov eax, dword [esp + 0xe]
mov ecx, dword [esp + 0xc]
and edx, 0xffff
push edx
mov edx, dword [0x41371c]
and eax, 0xffff
and ecx, 0xffff
push eax
add edx, 0x12dc
push ecx
push edx
lea eax, [esp + 0x2c]
push 0x4130a4
push eax
call edi
add esp, 0x18
lea ecx, [esp + 0x1c]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403edd
mov eax, dword [esp + 0x414]
lea edx, [esp + 0x418]
push edx
lea ecx, [esp + 0x220]
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x22]
lea edx, [esp + 0x228]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x24]
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x38]
push 0x413124
push eax
call edi
add esp, 0x24
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
lea ecx, [esp + 8]
push 0
push ecx
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x24]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [0x413718]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push 0
push eax
push 0
push 1
add ecx, 0x240
call sub.MFC42.DLL_CListCtrl::InsertItem
pop edi
pop esi
add esp, 0x408
ret
Function at 0x408690
Capabilities:
Create process on windows

Disassembly:
mov edx, ecx
sub esp, 0x158
mov eax, dword [edx + 0x14d8]
test eax, eax
jne 0x408728
cmp dword [edx + 0x146c], 2
jb 0x408728
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x1474]
add edx, 0x156c
shl eax, 8
inc eax
lea ecx, [esp + 0x58]
push eax
push edx
push 0x4134b4
push ecx
mov dword [esp + 0x24], 0x44
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x58]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
pop edi
je 0x408728
mov edx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
add esp, 0x158
ret
Function at 0x40a650
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x248
push ebx
push ebp
push esi
mov esi, dword [esp + 0x258]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea eax, [esp + 0x18]
mov ebx, ecx
push 0x41352c
push eax
mov dword [esp + 0x1c], ebx
call edi
add esp, 0xc
lea ecx, [esp + 0x118]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40a6a6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x248
ret 4
cmp byte [esp + 0x144], 0x2e
je 0x40a6ec
lea eax, [esp + 0x144]
lea ecx, [esp + 0x14]
push eax
push esi
push 0x413524
push ecx
call edi
mov al, byte [esp + 0x128]
add esp, 0x10
test al, 0x10
je 0x40a6e1
lea edx, [esp + 0x14]
mov ecx, ebx
push edx
call fcn.0040a650
jmp 0x40a6ec
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
lea ecx, [esp + 0x118]
push ecx
push ebp
call ebx
test eax, eax
je 0x40a758
cmp byte [esp + 0x144], 0x2e
je 0x40a749
lea edx, [esp + 0x144]
lea eax, [esp + 0x14]
push edx
push esi
push 0x413524
push eax
call edi
mov al, byte [esp + 0x128]
add esp, 0x10
test al, 0x10
je 0x40a73e
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
call fcn.0040a650
jmp 0x40a749
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [esp + 0x118]
push eax
push ebp
call ebx
test eax, eax
jne 0x40a701
push ebp
call dword [sym.imp.KERNEL32.DLL_FindClose]
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret 4

Function at 0x40a9d0
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push 0x64
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
xor edi, edi
lea esi, [esp + 0x18]
mov bl, 0x43
xor ebp, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov al, byte [esi + 1]
test al, al
jne 0x40aa19
mov al, byte [esi + 2]
test al, al
je 0x40aa56
push esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
jne 0x40aa51
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, edi
mov byte [esi + 1], 0
jb 0x40aa51
ja 0x40aa4b
cmp ecx, ebp
jbe 0x40aa51
mov bl, byte [esi]
mov ebp, ecx
mov edi, eax
add esi, 4
jmp 0x40aa0b
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x40bc90
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x40b930
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
neg eax
sbb eax, eax
neg eax
pop ecx
ret

Function at 0x40bcb0
Capabilities:
Resolve dns
Send data
Send data on socket

Disassembly:
sub esp, 0x44
mov eax, dword [ecx + 4]
push ebx
test eax, eax
mov dword [esp + 4], ecx
je 0x40bdc1
mov ebx, dword [esp + 0x50]
mov edx, dword [0x41371c]
lea eax, [ebx + ebx*4]
lea ebx, [ebx + eax*8]
shl ebx, 2
mov eax, dword [ebx + edx + 0x218]
test eax, eax
jne 0x40bd11
lea ecx, [ebx + edx + 0x1e6]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40bdc1
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov edx, dword [0x41371c]
mov ecx, dword [eax]
mov dword [ebx + edx + 0x218], ecx
mov edx, dword [0x41371c]
mov eax, dword [ebx + edx + 0x21c]
push ebp
shl eax, 8
add eax, 9
push esi
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x24], eax
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
lea ebp, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx + edx + 0x220]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + edx + 0x218]
mov word [esp + 0x14], 2
mov dword [esp + 0x18], ecx
mov dx, word [ebx + edx + 0x238]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x10]
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push 0x10
push eax
mov eax, dword [edx + 0x20]
push 0
lea ecx, [esp + 0x30]
push 0x30
push ecx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8
Function at 0x40d073
Capabilities:
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
add eax, 0x36
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40d0d5
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x18]
push 0
push 2
mov edx, dword [ecx]
push 2
mov ecx, dword [edx]
mov dword [eax + 0x68], ecx
call dword [sym.imp.WS2_32.dll_socket]
lea edx, [esp + 0xc]
push 0x10
push edx
push eax
mov dword [esi + 0x40], eax
mov dword [esp + 0x1c], 0
mov word [esp + 0x18], 2
mov word [esp + 0x1a], 0
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jge 0x40d0dc
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
add esp, 0x18
ret
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x90]
test ecx, ecx
je 0x40d101
mov eax, dword [0x41371c]
mov ecx, dword [eax + 0x12cc]
mov dword [esp + 0x10], ecx
mov dx, word [eax + 0x12d0]
jmp 0x40d10c
mov ecx, dword [eax + 0x68]
mov dword [esp + 0x10], ecx
mov dx, word [eax + 0x6c]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x10]
mov word [esp + 0xe], ax
mov word [esp + 0xc], 2
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0x44]
push 4
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esi + 0x18]
lea edx, [esp + 8]
mov ecx, dword [eax + 0x7c]
mov eax, dword [esi + 0x40]
push edx
push 0x1002
shl ecx, 0xa
push 0xffff
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [esi + 0x40]
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, 1
pop esi
add esp, 0x18
ret

Function at 0x40d190
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 8]
sub esp, 0x14
test eax, eax
je 0x40d1fd
mov eax, dword [ecx + 0x68]
test eax, eax
je 0x40d1dc
mov eax, dword [ecx + 0x6c]
mov edx, dword [ecx + 0x70]
mov dword [esp + 8], eax
lea eax, [ecx + 0x44]
push 0x10
mov dword [esp + 0x10], edx
push eax
mov eax, dword [ecx + 0x40]
push 0
lea edx, [esp + 0x10]
push 0x10
push edx
push eax
mov dword [esp + 0x1c], 0x22
mov dword [esp + 0x28], 7
call dword [sym.imp.WS2_32.dll_sendto]
add esp, 0x14
ret
lea edx, [ecx + 0x44]
mov ecx, dword [ecx + 0x40]
push 0x10
push edx
push 0
lea eax, [esp + 0xc]
push 4
push eax
push ecx
mov dword [esp + 0x18], 7
call dword [sym.imp.WS2_32.dll_sendto]
add esp, 0x14
ret

Function at 0x40d210
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x40d25a
mov eax, dword [esi + 0x68]
test eax, eax
jne 0x40d25a
mov eax, dword [esp + 0x38]
push 4
lea ecx, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x10], 0x401
call dword [sym.imp.MSVCRT.dll_strncpy]
mov ecx, dword [esi + 0x40]
add esp, 0xc
lea edx, [esi + 0x44]
lea eax, [esp + 4]
push 0x10
push edx
push 0
push 9
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
pop esi
add esp, 0x30
ret 4
Function at 0x40d270
Capabilities:
Check if file exists
Create directory
Get file attributes
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40ef4b
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x40d499
mov eax, dword [esi + 8]
test eax, eax
je 0x40d499
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x28]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [ecx], eax
and eax, 0xffff
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x14]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x18]
mov dword [ecx + 0xc], edx
mov ecx, dword [esp + 0x12]
mov edx, dword [esp + 0xe]
and ecx, 0xffff
and edx, 0xffff
push ecx
push edx
push eax
mov eax, dword [0x41371c]
lea edx, [esp + 0x2c]
mov ecx, dword [eax + 0x11e4]
add ecx, 0x43
push ecx
push 0x413624
push edx
call edi
add esp, 0x18
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d337
test al, 0x10
jne 0x40d3af
mov ecx, dword [0x41371c]
push ebp
lea eax, [esp + 0x24]
mov edx, dword [ecx + 0x11e4]
add edx, 0x43
push edx
push 0x413614
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
add esp, 0xc
lea ecx, [esp + 0x24]
push 0
push ecx
call ebp
mov edx, dword [esp + 0x16]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0x10]
and edx, 0xffff
push edx
mov edx, dword [0x41371c]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [edx + 0x11e4]
add eax, 0x43
push ecx
push eax
lea ecx, [esp + 0x34]
push 0x413624
push ecx
call edi
add esp, 0x18
lea edx, [esp + 0x24]
push 0
push edx
call ebp
pop ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x16]
mov edx, dword [esp + 0x14]
and eax, 0xffff
push eax
mov eax, dword [esi + 0x14]
and ecx, 0xffff
and edx, 0xffff
push ecx
inc eax
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x138]
push 0x4135fc
push edx
call edi
add esp, 0x1c
lea eax, [esp + 0x124]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
lea edx, [esp + 0x1c]
push 0
lea ecx, [esi + 0x3c]
push edx
push 4
push ecx
push eax
mov dword [esi + 0x24], eax
mov dword [esp + 0x30], 0
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea ecx, [esp + 8]
call fcn.0040dcaa
mov eax, dword [esi + 0x14]
lea ecx, [esp + 8]
inc eax
mov dword [esp + 0x230], 0
push eax
push 0x804a
push ecx
mov dword [esi + 0x38], 1
call sub.MFC42.DLL_CString::Format_1
mov edx, dword [esp + 0x14]
push edx
call fcn.00403d70
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x20]
shl eax, 5
add esp, 0x10
lea edx, [eax + ecx + 0x322c]
push 1
push edx
call fcn.0040a000
lea ecx, [esp + 8]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov ecx, dword [esp + 0x224]
pop esi
mov dword fs:[0], ecx
add esp, 0x22c
ret
Function at 0x40d4b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40ef68
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x40d548
push edi
push edi
push edi
push eax
mov dword [esi + 0x38], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 0x24]
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esi + 0x3c]
push 4
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esp + 8]
mov dword [esi + 0x24], edi
call fcn.0040dcaa
mov ecx, dword [esi + 0x14]
lea edx, [esp + 8]
inc ecx
mov dword [esp + 0x18], edi
push ecx
push 0x804b
push edx
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x14]
push eax
call fcn.00403d70
add esp, 0x10
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40d743
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x40d78a
mov eax, dword [esi + 0x68]
test eax, eax
jne 0x40d78a
mov eax, dword [esp + 0x38]
push 1
lea ecx, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x10], 0x41c
call dword [sym.imp.MSVCRT.dll_strncpy]
mov ecx, dword [esi + 0x40]
add esp, 0xc
lea edx, [esi + 0x44]
lea eax, [esp + 4]
push 0x10
push edx
push 0
push 9
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
pop esi
add esp, 0x30
ret 4
Function at 0x48db1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jmp 0x48db36
mov dword [esp + 0x5c], esp
call 0x48daf0
jmp 0x48dc65
mov dword [esp], ecx
push dword [esp]
pop word [esp + 5]
push word [esp + 1]
push word [esp + 3]
jmp 0x48db14
push esp
call 0x48dc3a
btr edx, esp
mov ch, byte [esp]
lea esi, [esi - 0x23b]
lea ecx, [edx + edx]
jmp 0x48dd58
xchg cx, dx
rdtsc
bsr cx, cx
btc eax, edx

Function at 0x48dc98
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
xchg dword [esp + 0xc], esi
mov edx, ebp
mov cx, sp
sub ch, ah
jmp 0x48dc6b
neg dh
bsr ax, bp
sub esp, 0xe
bt edx, edx
bswap ecx
jmp 0x48dc81

Function at 0x48e241
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ax, si
jmp 0x48e04f
inc ebp
add edx, ebp
jno 0x48e012
bsf ax, si
mov ax, word [esp]
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x48e136
mov dx, word [esp]
mov dh, 0x20
jmp 0x48e02b
mov ax, word [esp]
sub esp, 0xe
lea esp, [esp + 2]
call fcn.0048e0a2
les edx, [eax - 0x3a]
mov eax, dword [0xdc4d9550]
clc
jno 0x48e047
mov dx, word [esp]
mov dh, 0x20
jmp 0x48e02b
mov edx, eax
sub esp, 0x14
jp 0x48e0f5
rcl dh, 3
jmp 0x48e118
sub esp, 0x1a
neg ah
lea eax, [eax + 0x6fd5ac21]
not eax
pushal
lea esp, [esp + 0x4e]
jmp 0x48e0fe
rcl dh, 3
jmp 0x48e0dd
not eax
jmp 0x48e0ea
bswap edx
sub cl, 0x53
btc edx, ebx
jo 0x48e13a
jno 0x48e17d
lodsd eax, dword [esi]
movsb byte es:[edi], byte ss:[esi]
ret
sub esp, 0x1a
neg ah
lea eax, [eax + 0x6fd5ac21]
jmp 0x48e0fa
mov dl, dh
jmp 0x48e0cd
lea edx, [esp + ebp]
setb dh
lea eax, [eax*4]
mov dl, 0xf4
jmp 0x48e1f3
mov dl, 0xf4
lea edx, [esp + edx]
jmp 0x48e1f6
lea edx, [esp + ebp]
setb dh
lea eax, [eax*4]
jmp 0x48e163
mov al, ah
pop eax
mov ax, 0x8fcd
sub bl, dl
xchg dx, ax
jmp 0x48e067
lea eax, [ecx*4]
mov dl, dh
mov dx, word [esp]
call fcn.0048e21e
xchg ecx, eax
adc byte [ebx + 0x48da50a], dl
lea eax, [eax]
add byte [eax], al
add byte [edx + 0x148b66d6], cl
and al, 0xb0
salc
lea eax, [ecx*4]
mov dl, dh
mov dx, word [esp]
mov al, 0xd6
jmp 0x48e2d4
jmp 0x48e2b1
lea edx, [esp + edx]
sub dh, ah
cmc
jg 0x48e1c0
jle 0x48e1a9
xchg dword [esp], ecx
mov al, byte [esp]
bswap edx
rcr dh, 5
not ah
rcl edx, 0xd
jmp 0x48e29f
bswap eax
mov eax, 0xb9f96484
xchg dword [esp], eax
jmp 0x48e198
xchg dword [esp], ecx
mov dx, 0xf8f3
neg dh
mov dx, word [esp]
xchg edx, eax
xchg ah, dh
jmp 0x48e26a
lea ecx, [ecx + 0x1b]
bt eax, esp
mov dh, byte [esp]
not eax
lea eax, [edi + edi]
xchg edx, eax
jmp 0x48e282
pop edx
mov ax, sp
cmc
jmp 0x48e2bc
lea esp, [esp + 0x10]
ror cl, 0
lea edx, [ebp - 0xd7]
dec edx
jmp 0x48e301
dec cl
mov dl, dh
mov dx, cx
sub esp, 0x14
jle 0x48e1dd
pop edx
mov ax, sp
cmc
jmp 0x48e2bc
shr ah, 1
jmp 0x48e30a
jne 0x48e32b
mov eax, dword [esp]
inc dx
jmp 0x48e2eb
sub cl, 0x4c
mov ax, 0x22dd
rol dx, cl
je 0x48e891
jne 0x48e59c
dec edi
rcl byte [esi + 0x31], 0xc0
ja 0x48e324
sal byte [edi - 3], 0xcc
pop edi
cmpsb byte [esi], byte es:[edi]
ror dword [ebx + 0x42662404], 1
int3
mov eax, dword [esp]
inc dx
shr ah, 1
jmp 0x48e30a
lea eax, [eax + 0xe9]
mov edx, eax
mov edx, ebp
jmp 0x48e4c8
lea eax, [eax + 0xe9]
Function at 0x48e743
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x34]
neg cl
mov ax, 0xff81
jmp 0x48e71b

Function at 0x48fb28
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x48fac8
pop ecx
sub ecx, 0x100104c9
jmp 0x48fb28
pop esi
jmp 0x48fb38
push esi
mov esi, ecx
lea esi, [esi + 0x100104b7]
mov dword [esi], eax
jmp 0x48fb12
movzx ebx, byte [eax]
add ebx, 0x874e2948
jmp 0x4911ca
call 0x490446
jmp 0x4912b6
inc dword [esp + 8]
popfd
jmp 0x49129c
cmp ebx, 0x874e2a14
je 0x49122e
sti
adc al, 0x2a
dec esi
xchg dword [esp + ebx*2 + 0xf], esi
test ebp, ebp
out 0xff, eax
dec dword [edi]
test dword [edi + edi*8 - 1], ebp
dec dword [edi]
test byte [eax], ah
add al, byte [eax]
add byte [ebx - 0x1b], bh
jne 0x48f9c5
jne 0x49114a
je 0x491404
jnp 0x4911cb
jne 0x491204
out dx, eax
pop ecx
mov edx, dword [esi]
test bl, ah
push ds
scasb al, byte es:[edi]
pop es
scasb al, byte es:[edi]
cmp dword [esp + 4], 0
jmp 0x4911d8
fsincos
ror byte [ebp - 0x24], cl
ret 4
pop eax
pushal
jmp 0x490441
Function at 0x4aed8d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0xa
xchg dword [esp], edi
lea esp, [esp + 2]
jmp 0x4aea93
push esp
lea esp, [esp + 3]
push edx
lea esp, [esp + 1]
jmp 0x4aed00
add esp, 5
push word [esp]
lea esp, [esp + 1]
jmp 0x4ae9d5
push edx
mov edx, ebp
lea edx, [edx - 8]
jmp 0x4aea09
mov dword [edx], eax
pop edx
call 0x4aea12
push edi
mov byte [esp], ch
pop word [esp]
push word [esp + 1]
jmp 0x4aea48
lea esp, [esp + 0x1c]
test ebx, ebx
push edx
push word [esp + 1]
push edx
push dword [esp + 2]
jmp 0x4aeb54
push ebx
jmp 0x4aeae7
mov eax, dword [edx - 8]
bswap edi
bsf di, ax
jmp 0x4aea7d
bswap edi
lea ecx, [esi + 8]
jmp 0x4808f2
lea esp, [esp + 0x10]
add dword [ebp - 4], 4
sub esp, 0xa
pop word [esp + 3]
jmp 0x4aeaf1
sub esp, 0xc
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x4aeab4
mov ebx, ecx
lea ebx, [ebx - 8]
mov edi, dword [ebx]
pop ebx
jmp 0x4aead0
mov dword [ecx - 8], eax
mov eax, 0x527ca5a4
mov eax, dword [edx - 4]
cmc
jmp 0x4aeb29
mov edi, 0x86c5849e
lea edx, [esi + ebx*4 + 8]
lea eax, [ecx - 0xf92f05]
xchg ecx, eax
neg di
jmp 0x4aeaaa
sub esp, 0x1a
mov byte [esp + 0x12], ah
lea esp, [esp + 3]
lea esp, [esp + 3]
mov dword [edx - 8], edi
jmp 0x4aec07
lea esp, [esp + 2]
lea esp, [esp + 0xc]
jle 0x48090b
lea edx, [esp + ecx]
and edi, ecx
jmp 0x4aeb14
mov eax, ecx
lea eax, [eax - 4]
mov edi, dword [eax]
pop eax
call fcn.004aeb69
not ax
mov eax, dword [edx]
sub esp, 0
sub esp, 0x10
jmp 0x4aebee
mov edi, dword [ecx]
sub esp, 6
push edx
lea esp, [esp + 2]
jmp 0x4aec57
mov dword [edx - 4], edi
lea edi, [edi*4]
jmp 0x4aebcd
bsf di, si
lea edi, [eax*4]
adc di, 0x88d2
push eax
jmp 0x4aeb8f
mov dword [ecx], eax
call 0x4aec36
push eax
mov eax, edx
mov dword [eax], edi
pop eax
jmp 0x4af1ff
cmp dword [ebp - 4], ebx
call fcn.004aecbb
lea esp, [esp + 4]
cmp eax, 1
call fcn.004aeff7
test dword [ebx], ecx
wait
dec byte [0x22ac2db8]
inc ebp
mov ah, 0xa
cmp dword [eax], ebx
jnp 0x4aed6e
pushal
lea esp, [esp + 0x20]
add ecx, 0x10
sub edx, 0x10
jmp 0x4aecf8
mov di, dx
mov edx, dword [esi]
btr edi, ebx
inc edi
inc edi
jmp 0x4aed84
mov ebx, dword [ebx*4 + 0x48abe0]
mov dx, 0x9b9f
add esi, 0x10
lea edi, [eax + 0xe1]
jmp 0x4aed51
push esp
mov edi, edx
call 0x4aed8d
or dword [ebx + 0x648d03c4], eax
and al, 1
jmp 0x4aedd6
mov edi, dword [edi*4 + 0x48abe0]
sub esp, 2
pushal
lea esp, [esp + 2]
jmp 0x4aedbd
and edi, ecx
mov edi, dword [edi*4 + 0x48afe0]
jmp 0x4aeef1
shr edi, 0x18
sub esp, 0
stc
sub esp, 0x14
jmp 0x4aed96
xor edi, dword [ebx*4 + 0x48b7e0]
lea ebx, [esi + 0x6966983d]
mov ebx, dword [esp]
call 0x4aee3f
and edx, ecx
lea esp, [esp + 0x50]
xor edi, dword [edx*4 + 0x48bbe0]
jmp 0x4aef2c
and ebx, ecx
push esp
pushal
lea esp, [esp + 0x5c]
jmp 0x4aeea4
mov edx, dword [esi + 4]
call 0x4aef15
mov edi, edx
sub esp, 0xc
cmc
shr edi, 0x18
jmp 0x4aef43
clc
mov edi, dword [edi*4 + 0x48abe0]
call 0x4aef61
invalid
lea esp, [esp + 0x5c]
sub ebx, 4
stc
clc
clc
jmp 0x4aed1c
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
jmp 0x4af06e