joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e410
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b61b6
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x62d330]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov eax, dword [0x62d330]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x2d], 0
jne 0x44e655
cmp byte [esi + 0x2c], 0
jne 0x44e655
lea eax, [esi + 0x34]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov dword [esp + 0x4c], 0x10
mov word [esp + 0x52], ax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x54]
push eax
push 0
push dword [esi + 0x7c]
push dword [esi + 0x80]
push dword [esi + 0x28]
call dword [sym.imp.WS2_32.dll_recvfrom]
push dword [esp + 0x54]
mov edi, eax
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [esp + 0x52]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
mov dword [esp + 0x14], eax
test edi, edi
js 0x44e4db
push eax
mov eax, dword [esi + 4]
push ebx
push edi
push dword [esi + 0x80]
push esi
call eax
add esp, 0x14
jmp 0x44e64b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2746
jne 0x44e58f
lea ecx, [esp + 0x60]
call fcn.00405f20
mov dword [esp + 0xb8], 0
lea ecx, [esp + 0x34]
mov edx, edi
mov dword [esp + 0x60], 1
mov dword [esp + 0x64], edi
mov byte [esp + 0x68], 0
call fcn.004057c0
push eax
mov edx, 0x602fd0
mov byte [esp + 0xbc], 1
lea ecx, [esp + 0x20]
call fcn.00405a50
add esp, 4
lea ecx, [esp + 0x6c]
push eax
call fcn.00409850
lea ecx, [esp + 0x1c]
call fcn.00404540
lea ecx, [esp + 0x34]
mov byte [esp + 0xb8], 0
call fcn.00404540
cmp byte [esi + 0x2d], 0
jne 0x44e586
cmp dword [esi + 8], 0
je 0x44e586
push dword [esp + 0x14]
lea eax, [esp + 0x64]
push ebx
sub esp, 0x24
mov ecx, esp
push eax
call fcn.004066c0
mov eax, dword [esi + 8]
push esi
call eax
add esp, 0x30
lea ecx, [esp + 0x60]
jmp 0x44e646
cmp edi, 0x2733
je 0x44e64b
lea ecx, [esp + 0x84]
call fcn.00405f20
mov dword [esp + 0xb8], 2
lea ecx, [esp + 0x1c]
mov edx, edi
mov dword [esp + 0x84], 1
mov dword [esp + 0x88], edi
mov byte [esp + 0x8c], 1
call fcn.004057c0
push eax
mov edx, str.recvfrom_error:
mov byte [esp + 0xbc], 3
lea ecx, [esp + 0x38]
call fcn.00405a50
add esp, 4
lea ecx, [esp + 0x90]
push eax
call fcn.00409850
lea ecx, [esp + 0x34]
call fcn.00404540
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb8], 2
call fcn.00404540
cmp byte [esi + 0x2d], 0
jne 0x44e63f
cmp dword [esi + 0xc], 0
je 0x44e63f
sub esp, 0x24
lea eax, [esp + 0xa8]
mov ecx, esp
push eax
call fcn.004066c0
mov eax, dword [esi + 0xc]
push esi
call eax
add esp, 0x28
lea ecx, [esp + 0x84]
call fcn.00406690
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.005743e5
mov esp, ebp
pop ebp
ret
Function at 0x44e680
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6200
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x62d330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x2d], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x48], ebx
jne 0x44e873
lea eax, [edi + 0x4c]
push eax
mov dword [ebp - 0x4c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 0x14]
mov eax, 2
mov word [ebp - 0x44], ax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 0x10]
mov word [ebp - 0x42], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x10
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp + 0xc]
push ebx
push dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x44e86a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x44e762
xor esi, esi
jmp 0x44e720
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x48]
push dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x44e86a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x44e762
inc esi
cmp esi, 0xa
jl 0x44e720
jmp 0x44e86a
push 0
push 0x5fe3a5
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00404be0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x7c]
mov edx, ebx
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x2c], 1
call fcn.004057c0
push eax
mov edx, str.sendto_error:
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00405a50
mov esi, eax
add esp, 4
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x44e7fe
cmp dword [ebp - 0x14], 0x10
jb 0x44e7e3
push dword [ebp - 0x28]
call fcn.0044ea58
add esp, 4
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004045a0
cmp dword [ebp - 0x50], 0x10
jb 0x44e80f
push dword [ebp - 0x64]
call fcn.0044ea58
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x68], 0x10
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x64], 0
jb 0x44e836
push dword [ebp - 0x7c]
call fcn.0044ea58
add esp, 4
cmp byte [edi + 0x2d], 0
jne 0x44e859
cmp dword [edi + 0xc], 0
je 0x44e859
sub esp, 0x24
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.004066c0
mov eax, dword [edi + 0xc]
push edi
call eax
add esp, 0x28
cmp dword [ebp - 0x14], 0x10
jb 0x44e86a
push dword [ebp - 0x28]
call fcn.0044ea58
add esp, 4
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005743e5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x453734
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x453779
call fcn.0044f022
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x453779
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x453795
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0045b211
mov ebx, eax
test edi, edi
je 0x453793
test esi, esi
je 0x453793
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4597df
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0044f022
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x459816
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00459837
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46e221
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0045a840
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x46e25d
call fcn.0046e440
mov dword [esi + 0xc], 1
jmp 0x46e262
call fcn.0046e440
cmp dword [esi], 0
je 0x46e2ab
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x46e285
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004537ec
jmp 0x46e296
push 0xff
mov ecx, esi
call fcn.004426c0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00451712
jmp 0x46e2cf
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x46e2cf
push dword [esi]
push dword [ebp - 4]
call fcn.00460661
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46e395
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0046e440
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x46e3dd
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004537ec
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00451712
jmp 0x46e3e8
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00460661
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x479b4f
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0048ced0
call fcn.0044f076
cmp dword [eax + 0x14], 0
jne 0x479b6a
mov ecx, esi
pop esi
jmp fcn.00478f28
pop esi
ret

Function at 0x487715
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004057b0
call fcn.0044f076
cmp dword [eax + 0x14], 0
jne 0x487730
mov ecx, esi
pop esi
jmp fcn.00486ffe
pop esi
ret
Function at 0x58c608
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x62d330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0057ebbc
mov dword [ebp - 0x14], eax
cmp dword [0x63ab6c], esi
jne 0x58c6fb
push 0x800
push esi
push 0x5f6bf0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x58c688
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x58c7db
push esi
push esi
push 0x5f6bf0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x58c7db
push 0x5f6c08
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x58c7db
push eax
call ebx
push 0x5f6c14
push edi
mov dword [0x63ab6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5f6c24
push edi
mov dword [0x63ab70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5f6c38
push edi
mov dword [0x63ab74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x63ab7c], eax
test eax, eax
je 0x58c6f8
push 0x5f6c54
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x63ab78], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x58c720
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x58c713
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x58c735
push 4
pop eax
jmp 0x58c7dd
cmp dword [ebp - 0x14], esi
je 0x58c735
push dword [0x63ab6c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x58c71a
mov eax, dword [0x63ab78]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x58c793
cmp dword [0x63ab7c], edi
je 0x58c793
push eax
call ebx
push dword [0x63ab7c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x58c793
test eax, eax
je 0x58c793
call ecx
test eax, eax
je 0x58c788
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x58c788
test byte [ebp - 8], 1
jne 0x58c793
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x58c7c3
mov eax, dword [0x63ab70]
cmp eax, edi
je 0x58c7c0
push eax
call ebx
test eax, eax
je 0x58c7c0
call eax
mov esi, eax
test esi, esi
je 0x58c7c0
mov eax, dword [0x63ab74]
cmp eax, edi
je 0x58c7c0
push eax
call ebx
test eax, eax
je 0x58c7c0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x63ab6c]
call ebx
test eax, eax
je 0x58c7db
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x58c7dd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005743e5
mov esp, ebp
pop ebp
ret
Function at 0x59c4c2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10002302
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x10], bh
clc
cmp ecx, edi
mov byte [esp + 4], 0xc4
push 0x68f6c8eb
pushal
jmp fcn.10058170

Function at 0x1000254a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
movzx cx, al
lea eax, [esp + 0x18]
call fcn.100575b7
pushfd
mov byte [esp], cl
cmp eax, 0x5c2e5c5c
mov byte [esp], 0x5c
lea esp, [esp + 4]
jne 0x1004f9aa
cmp cl, 0x32
mov eax, dword [ebp + 4]
pushfd
pushal
cmp eax, 0x5355794d
pushal
mov byte [esp + 4], cl
pushfd
lea esp, [esp + 0x48]
jne 0x1004f9aa
inc al
mov eax, dword [ebp + 8]
jmp fcn.10052d92

Function at 0x10002600
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [0x1003d377], al
movsx si, cl
shr eax, 8
setae dl
mov byte [0x1003d378], al
jmp loc.10057943

Function at 0x10002875
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 8], eax
mov word [esp], ax
mov byte [esp], dh
pushal
mov word [esp + 0xc], bx
lea esp, [esp + 0x28]
call fcn.100567ab
pushfd
cwde
mov byte [0x1003ccd0], 0
bswap ax
pushal
pushal
mov eax, dword [esp + 0x44]
setne ah
lahf
movsx ax, dl
mov eax, dword [esp + 0x48]
push dword [esp + 4]
mov word [esp + 4], 0x38c9
mov byte [esp + 4], 0x18
mov byte [esp + 0x10], 0xed
lea esp, [esp + 0x50]
jmp fcn.100021a3

Function at 0x10002a0a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x54]
call fcn.100567ab
pushfd
pop eax
mov byte [0x1003ccd0], 0
bswap ax
jmp fcn.100550e9

Function at 0x10004802
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebp + 4]
push dword [esp]
pushfd
mov dword [esp + 0x30], eax
pushfd
lea esp, [esp + 0x34]
call fcn.100567ab
bswap eax
bswap ax
mov al, ah
pushal
mov byte [0x1003ccd0], 0
pushfd
mov eax, dword [esp + 0x24]
movsx ax, dl
bswap eax
mov eax, dword [esp + 0x28]
push eax
pushfd
lea esp, [esp + 0x34]
jmp fcn.100021a3

Function at 0x100055a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], fcn.10051c71
pushal
call fcn.100506c3

Function at 0x100055b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xaa941dbd
jmp fcn.10054498

Function at 0x10005a45
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
jne 0x1005ea2c
bt eax, 0x14
sbb al, dl
mov al, byte [ebp + 0xb]
push ebp
test ax, si
cmp al, 0x10
pushfd
jmp fcn.100548e0

Function at 0x10006f2e
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
mov byte [esp], bl
mov dword [esp + 8], 0x10039f88
pushal
mov dword [esp + 0x24], 0x10033154
call fcn.1004d847
mov bh, 0xa0
call 0x76583c1e
mov edi, dword [esp + 0x10]
xor cl, cl
test di, di
jbe 0x10006f7d
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
mov dl, byte [esi]
xor byte [eax], dl
add cl, 1
movzx dx, cl
add eax, 1
add esi, 1
cmp dx, di
jb 0x10006f66
pop esi
pop edi
ret
Function at 0x1004b271
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x7071d448
lea esp, [esp + 0x24]
jne 0x1006aa89
push 0xf1ca661f
inc byte [0x1003a08c]
pushal
clc
cmp byte [0x1003a08c], 2
pushfd
mov byte [esp], 0x4d
call fcn.10058f4b

Function at 0x1004b6e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jne 0x1005ea2c
sbb al, 0xfb
clc
inc al
mov al, byte [ebp + 0xc]
push 0xb4f2675a
cmp al, 0
jmp fcn.10057f74

Function at 0x1004bc53
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x1005ea2c
inc al
adc al, bh
inc al
mov al, byte [ebp + 3]
cmc
cmp al, 0x5b
pushfd
pushal
pushal
lea esp, [esp + 0x44]
jne 0x1005ea2c
jmp 0x10057558

Function at 0x1004dacf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
mov word [esp + 4], 0x76f2
mov dword [esp + 0x30], 0
push esp
pushfd
mov dword [esp + 0x34], 0x1005ab52
call fcn.100624c0

Function at 0x1004dfa1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp]
inc ecx
mov byte [esp + 0xc], cl
cmc
push dword [esp]
clc
cmp ecx, ebx
call fcn.100526b4
jmp 0x1005c288
stc
bt di, 1
push esi
sub esp, 0xfffffffc
cmp esi, esp
pushal
lea esp, [esp + 0x20]
call fcn.1006d285
xchg si, dx
lahf
rdtsc
mov esi, esp
pushal
mov dword [esp + 0x1c], 0
movzx ax, dl
xchg dh, al
mov dword [esp + 0x18], 0x20
rdtsc
jmp loc.1004c136

Function at 0x1004ef90
Capabilities:
Packed with generic packer

Disassembly:
bswap ax
pop eax
lea eax, [edi + 0x584af499]
pop eax
movzx ax, cl
not ax
jmp 0x10054569
setb ah
pop eax
pushfd
pushfd
mov byte [esp + 4], 0xe6
pushal
lea esp, [esp + 0x28]
jmp fcn.100021a3
Function at 0x1004f49b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
jne 0x10067cda
movsx dx, al
push 1
rdtsc
rdtsc
cwde
setbe al
lea edx, [esp + 0x18]
push 0x87d1d929
setg al
lahf
mov dword [esp], edx
lahf
cwde
lea eax, [esp + 0x28]
pushfd
push ecx
jmp fcn.10057939
shl al, cl
sar ah, 4
xor edx, esi
bt ax, 0xa
mov eax, 0x1003d12c
sar ch, 3
stc
mov ebx, dword [ebp]
cmp dh, 0x98
movzx cx, dl
mov dword [eax], ebx
not ch
bswap ebx
btr ebx, 1
mov ebx, dword [ebp + 4]
call fcn.10055a3a
jmp 0x10057e3a
push dword [esp]
lea esp, [esp + 8]
je 0x10063ec1
pushfd
mov word [esp], 0xc505
pushal
test eax, eax
pushfd
push 0x39c0a4ef
lea esp, [esp + 0x2c]
jb 0x1006aae9
jne 0x10067cda
movsx edx, al
setle al
push 1
not ah
bswap dx
lea edx, [esp + 0x18]
pushal
lahf
pushfd
mov dword [esp + 0x20], edx
cwde
lea eax, [esp + 0x48]
jmp 0x1005ee98
jne 0x10067cda
movzx eax, cl
not dh
pushal
push eax
mov dword [esp + 0x20], 1
cwde
movzx ax, al
lea edx, [esp + 0x38]
lea eax, [edx + 0x58bbe834]
setns ah
pop eax
mov dword [esp + 0x18], edx
push 0xc7e83875
movsx eax, al
lea eax, [esp + 0x44]
mov byte [esp], 0x7b
pushfd
push 0x3349a9cf
mov dword [esp + 0x20], eax
mov byte [esp + 0x1c], dh
push 0x49cac439
call fcn.100566d5
jmp 0x10066d8c
push 0xde0fca10
cmc
cmp byte [0x1003ccd0], 0x99
push 0xfa1ae946
lea esp, [esp + 8]
je 0x10068338
test ebp, 0x9a29800a
stc
pushal
seto al
aas
mov eax, dword [ebp + 6]
add cx, 0x33d6
shr cx, 5
shld cx, ax, 1
add ebp, 6
pushfd
add eax, ebp
setg bl
add eax, 5
stc
bswap bp
movsx bp, bl
pushfd
mov ebp, eax
pushfd
mov ecx, dword [0x1003d108]
btc bx, ax
imul ecx, ecx, 4
add al, dh
rdtsc
mov eax, 0x1003d10c
pushfd
shrd bx, dx, cl
add eax, ecx
lea ecx, [ebp - 0x17c1f347]
mov dword [eax], ebp
or ah, ch
sub esp, 0xfffffff0
je 0x1004f46a
bts si, sp
mov eax, 0x1003d12c
sar bx, 4
or bx, bp
movsx bx, bl
mov ebx, dword [ebp]
call fcn.10067b0e
pushfd
lea esp, [esp + 0x28]
call fcn.1006d285
mov si, ax
lea esi, [edi + 0x84407b3]
mov dword [0x1003d398], eax
call fcn.100528e0
mov dword [esp + 0x1c], eax
push dword [esp + 0xc]
jmp 0x1006763a
push 0xa110926e
mov dword [esp + 0x20], edi
pushfd
mov dword [esp + 0x20], 0x10053bd6
call fcn.1005f815
js 0x1004d896
jmp 0x1005943c

Function at 0x1004f90f
Capabilities:
Packed with generic packer

Disassembly:
bt dx, di
pushal
cmp dword [eax + 0xc], ebx
pushfd
lea esp, [esp + 0x28]
jne 0x1006aa89
ror bl, 4
mov ebx, 0x64006d
test ch, 0xa3
cmc
jmp 0x1005216f
cmp dword [eax + 0x10], ebx
call fcn.1004d704
movzx ax, dl
lahf
push dword [0x1003d2a8]
sal ax, 2
aam 0xd5
rcr ebp, 0xa
mov ebp, dword [0x1003cce0]
setbe ah
clc
shr ah, 4
or ah, 0x6a
mov ax, word [ebp + 0xa]
test dx, di
pushal
cmp ax, 0x9020
mov dword [esp + 8], eax
call fcn.1005d4b6
pop eax
pushfd
mov word [esp], 0x6873
pushal
lea esp, [esp + 0x24]
jmp fcn.100021a3

Function at 0x1004ffa7
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub al, 0x88
jmp 0x1005ff69
mov al, byte [ebp + 1]
cmc
pushal
stc
clc
cmp al, 0x5e
jmp 0x10006f24
Function at 0x100502ea
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 4]
lahf
not al
pushfd
movzx ax, cl
mov eax, dword [esp + 0xc]
push 0x7d11203d
pushal
mov byte [esp], bh
push esp
lea esp, [esp + 0x38]
jmp fcn.100021a3

Function at 0x10050709
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x1006aa89
shl bh, cl
neg bh
test dl, 0xc2
add bl, 0x68
mov ebx, 0x2e0074
test bx, 0x39c5
call fcn.1006b626
mov esi, esp
push 0xb26b84f3
lea edx, [ebp*8 + 0x38c42b9c]
mov dword [esp], str.CreateFileA
not dh
mov dh, 0xb7
push eax
mov edx, dword [0x1003d538]
jmp 0x10058517
mov byte [esp], al
push dword [esp]
mov dword [esp + 4], edx
pushal
pushfd
mov dword [esp + 0x24], 0x1005b7c5
jmp loc.1000735e

Function at 0x10050820
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1006b535
cmc
sub edi, 1
pushal
call fcn.1005cb8e

Function at 0x10051607
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [0x1003d538]
push dword [esp]
mov dword [esp + 4], ecx
push dword [esp]
pushal
mov byte [esp + 4], 0xfb
call fcn.1004b5a1
clc
push 0xfa8b7141
add esp, 4
cmp esi, esp
pushfd
pushfd
jmp 0x1005285a

Function at 0x10051fa2
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x48]
jge 0x1005fc04
push fcn.10051c71
pushfd
pushal
call fcn.1006b715
pushal
jmp 0x1006cb65
call fcn.10063559

Function at 0x10051fb8
Capabilities:
Packed with generic packer

Disassembly:
pop eax
pushal
lea esp, [esp + 0x20]
jmp fcn.100021a3
lea esp, [esp + 8]
jne 0x1006aa89
pushal
push ecx
mov word [esp + 4], si
mov dword [esp + 0x20], eax
push dword [esp + 4]
pushal
mov dword [esp + 0x40], eax
bswap ax
mov byte [0x1003ccd0], 0x99
jmp 0x1005df6f
bswap ax
mov eax, dword [ebp + 4]
lea esp, [esp + 0x40]
jle 0x1006184f
push 0xbae924eb
mov byte [esp], 0x8d
pushfd
mov dword [esp + 8], eax
push edx
mov byte [esp + 4], 0x24
mov byte [esp + 8], 0xa7
push ecx
lea esp, [esp + 0x10]
call fcn.100567ab
bswap ax
mov byte [0x1003ccd0], 0
pushal
lahf
lea esp, [esp + 0x20]
je 0x1004dd94
pop eax
jmp 0x10051444

Function at 0x10052afb
Capabilities:
Packed with generic packer

Disassembly:
pushal
push dword [esp]
mov dword [0x1003d3a0], eax
test di, sp
stc
clc
jmp 0x10053522
pushal
lea esp, [esp + 0x20]
call fcn.1006d285
ja 0x10001f94
bt bp, bx
jmp 0x1004d2df
test eax, eax
push 0xf75a32fe
lea esp, [esp + 0xc]
jl 0x100582cf
cmp cl, 0xc4
stc
add edi, eax
mov ecx, dword [esp + 0x1c]
cmp ebp, 0xca3c38db
bsf di, bp
adc di, di
neg di
mov edi, dword [ecx + edx*4]
bt edi, 0xe
cmp bh, al
call fcn.100551ab
test al, dh
cmp esi, esp
je 0x10004f55
call fcn.1006d285
call fcn.1004ee86

Function at 0x10052f0c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebp + 4]
pushfd
jmp 0x1006934d

Function at 0x10053508
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 4], 0x50
push esp
lea esp, [esp + 0xc]
je 0x10052177
push esi
mov bl, byte [ebp + edx]
call fcn.10066bbe
mov byte [0x1003ccd2], 0
push 0x47fd884e
test ax, 0x2983
bt di, 7
cmp dword [0x1003d3a4], 0
jmp 0x100574ec
pushfd
mov byte [esp], bl
call fcn.10067d54