joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45020c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4503b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x450398
mov dl, 1
mov eax, dword [0x417f78]
call fcn.0040362c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043b0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x450387
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043dcbc
test al, al
je 0x45037a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4503c8
lea eax, [ebp - 0x254]
call fcn.004090a0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45037a
xor eax, eax
push ebp
push 0x450373
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x450400
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45035c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404618
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45035c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45037a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45027d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041c0d4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4503be
lea eax, [ebp - 0x260]
call fcn.004043b0
ret

Function at 0x450cec
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x457bfc]
cmp byte [eax + 0xa5], 0
jne 0x450d5d
cmp dword [0x457c14], 0
jne 0x450d1e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x450ca8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x457c14], eax
cmp dword [0x457c10], 0
jne 0x450d39
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x457c10], eax
cmp dword [0x457c18], 0
jne 0x450d5d
push esp
push 0
push 0
push 0x450c4c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x457c18], eax
pop edx
ret
Function at 0x450e54
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x450e6b
add esp, 0xfffffff0
call fcn.004039a8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421b5c
mov eax, dword [0x455f40]
cmp word [eax + 2], 0
jne 0x450e93
mov eax, dword [0x455f40]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00452408
mov eax, dword [0x455fd0]
cmp word [eax + 2], 0
jne 0x450ead
mov eax, dword [0x455fd0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00452600
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417a88]
call fcn.0040362c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417a88]
call fcn.0040362c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423c9c]
call fcn.004298e8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x451034
mov eax, dword [0x455e80]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429cb8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x452b80
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x455e80]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c7cc
test eax, eax
je 0x450fa2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004089fc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c7f4
test eax, eax
je 0x450fb6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404618
mov eax, dword [0x455d94]
cmp byte [eax], 0
jne 0x450fea
mov eax, ebx
call fcn.0045115c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00452d5c
mov eax, ebx
call fcn.0045370c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45102a
call fcn.00403a00
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4513d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x457bfc]
cmp dword [eax + 0x30], 0
je 0x45147a
cmp dword [ebx + 0x94], 0
jne 0x451474
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x451360
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x451474
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45143a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x451474
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a128
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x451449
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x451f58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x451f8d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044a0
jmp 0x451f9a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404404
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x452f38
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452f79
mov eax, esi
call fcn.00439584
test al, al
je 0x452f79
mov eax, dword [ebx + 0x84]
call fcn.00439280
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452f79
push 0
mov eax, dword [ebx + 0x84]
call fcn.00439280
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x429603
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x42948c
mov eax, 0x5dee6ba9
jmp 0x42961d
jbe 0x4295bd
mov eax, 0x5dee6ba9
jmp 0x42961d
bt eax, ebp
btc dx, ax
xchg ebx, edx
rdtsc
neg bl
call fcn.0042966d
inc esp
retf 0x3f58
dec dx
jmp 0x4295e1
bt eax, ebp
btc dx, ax
xchg ebx, edx
jmp 0x4296b3
lea esp, [esp + 4]
xor ebp, 0x1a5c3ffe
neg ax
jno 0x4295ea
jo 0x429607
adc dword [ebx + reloc.mscoree.dll__CorExeMain], esp
imul esp, esp, 0x53ec1d7a
adc dword [ecx], reloc.mscoree.dll__CorExeMain
adc byte [edi], cl
leave
mov ebp, dword [esp + 0x2c]
bt dx, bp
jl 0x429558
jge 0x429558
lea esp, [esp + 4]
dec ebp
mov edx, 0xf9c7b6cd
setl dl
and bx, si
jmp 0x429676
jg 0x42968c
bt ebx, edi
rcr bx, 0xa
jmp 0x42969c
bt ebx, edi
rcr bx, 0xa
xor bh, 0x21
jmp 0x4296d2
xor bh, 0x21
jmp 0x4296d2
rdtsc
neg bl
jmp 0x4295f7
not dh
lea edx, [esp + edx]
inc bx
mov ax, word [esp]
jmp 0x4296db
rol ebp, 0
jl 0x4296bc
not dh
jmp 0x4296f5
inc ebp
xor dx, 0xda8a
jge 0x429716
rdtsc
inc edx
jmp 0x429701
lea edx, [esp + edx]
inc bx
mov ax, word [esp]
jmp 0x4296db
inc edx
call fcn.00429730
xchg ecx, eax
add al, 0x9a
std
or al, 0xc9
sub dword [ecx + reloc.mscoree.dll__CorExeMain], esi
xor byte [ebx], dh
sub al, byte [ebp + 0xf]
xor ebx, ebp
out 0xe8, al
add byte fs:[eax], al
add ch, ch
rdtsc
jmp 0x429700
jbe 0x429706
cmp dword [esi - 0x31], reloc.mscoree.dll__CorExeMain
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fisttp word [esi]
cdq
clc
invalid

Function at 0x42966d
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], ax
xchg bh, bl
jmp 0x429657

Function at 0x429f74
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edx + ebp]
neg ax
ja 0x429f3c
jbe 0x429f3c
Function at 0x42a8cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
add cl, dl
jge 0x42a8ad
mov ah, 0x40
jmp 0x42a8af
pop word [esp]
lea eax, [edi*4]
lea esp, [esp + 2]
jmp 0x42a88b
Function at 0x42aa2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 2]
push word [esp + 1]
jno 0x42aa63
mov edx, dword [esp + 1]
jmp 0x42aa65
lea eax, [ecx - 0xf3]
mov dword [esp], edi
add esp, 3
lea esp, [esp + 3]
jmp 0x42aa91

Function at 0x436fc9
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], esp
jmp 0x436f97
lea esp, [esp + 2]
mov dword [esp + 3], edx
xchg dh, dl
xchg dh, dl
mov edx, 0x2e646b74
mov dh, byte [esp]
jmp 0x436fb9
mov edx, dword [esp]
push edi
mov dx, si
mov dh, dl
pushal
call 0x436fc9
and cl, byte [ecx - 0x14eadb8c]
inc edx
mov al, byte [0x446351f0]
jnp 0x436f70
stosd dword es:[edi], eax
adc ah, byte [edi]
push ss
in eax, 0xd6
jae 0x436fb9
xor ch, byte [0xa4b8663c]
xchg esp, eax
Function at 0x46094a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edx
lea esp, [esp + 4]
pop edi
jmp 0x460b99
lea ebx, [ebp*4]
jmp 0x4608c9
test edi, edi
jmp 0x460b6d
rcr cl, 5
jmp 0x41a4b7
mov cx, sp
mov ecx, dword [esp]
jmp 0x41a495
mov byte [esp + 2], bl
lea esp, [esp + 4]
je 0x41a303
jne 0x41a46b
aam 0x47
out dx, al
stc
push ebx
jmp 0x41a3d4
push eax
mov eax, ebp
add eax, 8
jmp 0x41a4c3
mov ecx, dword [eax]
pop eax
mov cl, byte [ecx]
dec edi
jmp 0x460850
cmc
jmp 0x460862
sub esp, 0xa
pushal
lea esp, [esp + 2]
lea esp, [esp + 0x28]
mov byte [eax + esi + 0x18], cl
jmp 0x46083a
inc eax
inc dword [ebp + 8]
stc
cmc
jmp 0x4608b6
xor ecx, ecx
rol dl, 0
inc ax
jmp 0x46089a
lea eax, [esi + 0x1a]
jmp 0x41a334
cmp eax, 0x40
jne 0x41a34a
btr bx, cx
bt ax, bx
jmp 0x46086a
movzx edx, byte [eax + 1]
mov bh, al
lea ebx, reloc.mscoree.dll__CorExeMain
add bx, di
mov ebx, 0x91006138
jmp 0x460913
clc
lea esp, [esp + 1]
jmp 0x4608fd
or edx, ebx
mov bl, byte [esp]
jmp 0x460935
movzx ebx, byte [eax]
push esp
shl edx, 8
sub esp, 0xd
jmp 0x4608df
or edx, ebx
mov bx, si
mov ebx, dword [esp]
rcl bx, 8
jmp 0x460940
nop
adc ecx, dword [edi]
mov dh, 0x58
call [eax - 0x14f71d3f]
fisttp word [edi]
mov dh, 0x58
invalid
movzx ebx, byte [eax - 1]
pushfd
pushal
shl edx, 8
jmp 0x46091f
movzx ebx, byte [eax - 2]
call 0x46094a
mov bh, bh
je 0x460971
add byte [eax], al
add byte [edx + 0x12474ff], cl
jmp 0x460b57
add ecx, ebp
add al, 2
add byte [eax], al
and eax, 0x8a6ec754
and byte [eax + edi*4 - 0x209bccc7], al
cmp dword [ecx + 0x58], 0x53
push ebx
cdq
mov dl, 0x9d
mov dh, 0xc1
adc al, 0x86
fdiv qword [esi]
outsd dx, dword [esi]
lds eax, [ecx - 0x6a8f8e66]
cdq
xchg byte [edi], ah
lcall 0x2786, 0x99957071
adc bl, dl
push edi
pushal
cmp byte [esi + 0x65], bh
push eax
aaa
inc edx
dec edi
jl 0x460933
and byte [ecx - 0x51], bl
ja 0x4609ad
jns 0x46095f
jg 0x460946
push cs
pop dword [ecx]
push edi
fsubr dword [esi]
ljmp 0xe867
add al, 0xb5
push eax
int 0xb8
in eax, 0x62
imul eax, dword [ebx - 0x77], 0x51
cmp al, 4
push ebp
ljmp 0xdc86
lea esp, [esp + 0x3c]
inc ecx
jmp 0x460c7a
shl edx, 8
or edx, ebx
mov dword [ebp + ecx*4 - 0x40], edx
jmp 0x460b3f
ror eax, cl
xor al, 0xf9
xor eax, eax
jmp 0x41a34a
jne 0x41a3d4
mov bx, 0x3da4
lea ebx, [esi + esi]
jmp 0x460baf
mov ah, byte [esp]
lea eax, [ebp - 0x40]
call 0x436e61
and eax, 0x4b56bc8f
jmp 0x460b62
leave
ret
pop ebx
jmp 0x41a303
jb 0x41a334
mov ecx, dword [esp]
lea ecx, [esi + 8]
mov ah, bl
lea eax, [ecx + edi]
jmp 0x460b87
add eax, 4
cmc
cmp ecx, 0x10
jmp 0x460bd7
Function at 0x4c5ef1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, 0xb801
bts eax, ebx
mov esi, 0x5ff27597
xchg word [esp + 3], bx
mov edx, 0x5546c692
pop edx
jmp 0x4c5eb0
bsr edx, edx
xchg cx, ax
neg ebp
mov dword [esp + 2], ecx
inc bl
pop si
jmp 0x4c5e62
cmc
mov edx, edi
mov bp, 0xa61
mov eax, esi
rdtsc
xchg edx, edi
jmp 0x4c5eda
add esp, 0
neg edi
lea edi, [ebx*4]
mov dl, 0x23
xchg bl, ah
pop dx
jmp 0x4c5e9a
bswap esi
xchg dh, bl
neg dh
sub esp, 0xc
mov ah, byte [esp + 4]
cld
jmp 0x4c5f5c
setae al
mov al, bh
inc eax
xchg edx, ecx
bsf cx, cx
bswap ecx
jmp 0x4c5ec4
mov byte [esp + 5], dl
jmp 0x4c5e88
xchg si, bp
rcl bp, cl
lea ebx, [ebx + edi]
mov edx, dword [esp]
inc ebx
call fcn.004c5f3f
push edi
mov esi, 0xc78a2889
mov al, bh
and ebx, edx
lea edx, [ebp*4]
mov eax, 0xa0a49437
rdtsc
rol cl, cl
jmp 0x4c5ef7
lea esp, [esp + 8]
lea ebx, [esi + ebp]
cld
pop cx
bsf dx, bx
shl ch, 0
jmp 0x4c5f0d
mov byte [esp + 1], ch
mov ebx, 0xd316fa11
mov al, bh
mov byte [esp], ah
inc ah
pop si
jmp 0x4c5f2c
Function at 0x4c606a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
push ecx
add dx, 0x7920
rdtsc
xchg dword [esp], esi
sub esp, 0x15
jmp 0x4c603d
add dh, 0xd6
bsf di, di
mov ah, 0xfc
mov dx, sp
xchg word [esp + 3], ax
lea esp, [esp + 5]
jmp 0x4c5ffa
seto dl
pop ebx
pushal
add bx, 0xfa19
push dword [esp + 0x2b]
jmp 0x4c6051
pop edx
inc al
mov ecx, 0x650ab7b4
lea esp, [esp]
not ax
xchg byte [esp + 8], al
jmp 0x4c6027
sub esp, 4
rcr al, cl
bt bx, bp
pop ecx
rdtsc
inc cl
jmp 0x4c60dc
mov ebp, 0x98b1813a
add edi, eax
add esp, 0
rol ecx, cl
jmp 0x4c6010
mov bl, 0x35
mov ebp, edx
mov di, 0xc11e
mov cx, bp
sub dx, 0x5372
lea eax, [esi*4]
jmp 0x4c60b3
push dword [esp + 0x11]
lea ecx, [eax*4]
sub esp, 5
lea esp, [esp + 0x42]
lea ebp, reloc.mscoree.dll__CorExeMain
inc bp
jmp 0x4c6078
mov cx, word [esp]
not eax
cpuid
bt ebx, ecx
bsf ecx, esp
mov bx, dx
jmp 0x4c60f4
cpuid
not edi
rdtsc
not ax
bswap ecx
xchg si, cx
jmp 0x4c6330
lea ebx, [esi + ebp]
xchg word [esp + 0x17], di
mov cx, sp
mov dx, cx
xchg si, dx
pop word [esp + 0x21]
jmp 0x4c6097
cpuid
cmc
mov bl, 0xdf
mov ebx, edx
xchg cx, di
std
jmp 0x4c60c6
rcr cl, 6
neg dx
neg edi
cpuid
mov dl, byte [esp]
stc
jmp 0x4c6143
stc
lea esi, [esi*4]
shl ah, 1
std
cpuid
mov ecx, dword [esp]
jmp 0x4c611b
pushal
cld
dec al
mov word [esp + 8], bx
xchg byte [esp + 0xe], dh
add esp, 7
jmp 0x4c6188
pop dx
mov ebx, dword [esp]
mov ch, cl
btr ax, di
sub dx, 0x9c6b
pop ax
jmp 0x4c6131
sub esp, 2
popal
pop word [esp + 0x10]
lea ebx, reloc.mscoree.dll__CorExeMain
jmp 0x4c621c
pop ecx
pop word [esp + 0xa]
pushfd
cld
lea esi, reloc.mscoree.dll__CorExeMain
pushal
jmp 0x4c6172
setge ah
mov ah, byte [esp]
rdtsc
mov ebx, dword [esp]
push ebx
cmc
jmp 0x4c615e
mov eax, dword [esp + 9]
xchg si, ax
push word [esp + 0xc]
mov eax, dword [esp]
stc
jmp 0x4c6249
lea edi, reloc.mscoree.dll__CorExeMain
stc
xchg dh, ah
cld
mov eax, dword [esp + 0xb]
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0x4c61af
add esp, 8
mov dword [esp + 4], esi
lea edi, [edi*4]
shl si, 0xb
mov bx, word [esp + 6]
lea ebp, [ebp - 0x44]
jmp 0x4c61c5
lea esp, [esp + 8]
push word [esp + 4]
mov bh, byte [esp]
push dword [esp + 1]
cpuid
rol ch, 0
jmp 0x4c61eb
push eax
lea edx, [ebp*4]
call fcn.004c629f
invalid
xchg byte [esp + 8], dl
lea esp, [esp + 1]
mov dword [esp + 6], eax
xchg word [esp + 2], bp
rcl edi, 0x11
xchg dword [esp + 7], ecx
jmp 0x4c6233
push ebp
xchg dword [esp], esi
mov cl, dl
mov dl, dh
pop ebp
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0x4c61a0
sub ax, 0xb664
mov bp, word [esp]
cpuid
mov dl, dh
mov bl, al
shr ebp, 0x13
jmp 0x4c6275
mov dh, byte [esp]
mov ah, al
rdtsc
not ebx
cmp al, ch
xchg bp, ax
jmp 0x4c62d0
Function at 0x4c629f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xa], bx
rdtsc
setbe bh
dec ax
pop dword [esp + 0xa]
jmp 0x4c62ae
xchg dword [esp + 0xc], edx
mov byte [esp + 0xc], bh
pop si
mov dword [esp], edx
jmp 0x4c6289
mov si, 0xd667
xchg ebp, eax
lea eax, reloc.mscoree.dll__CorExeMain
push dword [esp + 3]
xchg dword [esp + 4], edi
mov si, word [esp + 7]
jmp 0x4c62f9
pop dword [esp + 4]
pop bx
xchg esi, eax
pop di
xchg dword [esp], ecx
pushal
jmp 0x4c6312
lea edx, [esi*4]
mov esi, dword [esp + 8]
setp bl
and ah, 0x52
xchg dx, bp
mov bx, sp
jmp 0x4c62e3
xchg byte [esp + 0x16], bh
mov esi, ecx
lea esp, [esp + 0xe]
xchg al, cl
lea ebp, [ecx*4]
mov si, sp
jmp 0x4c6499
mov byte [esp + 0xf], bh
and al, dl
setae cl
rdtsc
mov dl, byte [esp + 3]
inc esi
jmp 0x4c6441
lea edx, [esp + esi]
xchg word [esp + 0x15], si
xchg byte [esp + 0x23], al
push dword [esp + 0xe]
mov bl, cl
jmp 0x4c6340
rdtsc
add esp, 6
bsr bp, bp
mov si, 0xf2d3
mov word [esp + 0x19], sp
lea esi, [eax + edi]
jmp 0x4c6356
xchg bp, si
bswap eax
stc
xchg dh, dl
mov bh, byte [esp + 8]
xchg word [esp], dx
jmp 0x4c63d3
bsr ebp, edx
pop word [esp + 1]
push bp
mov byte [esp + 8], ah
push word [esp + 2]
cmc
jmp 0x4c6388
xor dh, bh
push dword [esp + 1]
shr dh, 6
bsr ecx, eax
setge dh
call fcn.004c63b4
lea ecx, [ebx*4]
rdtsc
pop edx
mov ah, cl
pushfd
jmp 0x4c6428
bsr cx, bx
sub esp, 0x1e
setg dh
mov bh, 0xcd
pop dword [esp + 6]
jmp 0x4c6472
mov bp, 0xd47a
mov bl, byte [esp + 5]
add esp, 0xc
mov byte [esp], dh
push bp
jmp 0x4c6412
xchg byte [esp + 0x1a], ah
xchg si, ax
mov si, word [esp + 1]
mov ebx, 0x6d96b675
mov word [esp + 3], dx
popal
jmp 0x4c639e
mov ch, 0xb9
mov ch, 0x24
push word [esp + 0x1c]
rcl cx, 7
popal
inc ch
jmp 0x4c64cd
mov dh, 0xb2
mov bh, 0x4c
neg edi
xchg byte [esp + 0x11], bh
mov cl, byte [esp + 3]
bswap ebp
jmp 0x4c645c
xchg ah, bh
rdtsc
lea edi, [esi*4]
sub esp, 0xe
mov bh, byte [esp + 9]
lea ebp, [ebx*4]
jmp 0x4c6371
btc edx, ebx
mov dh, 0x19
setge ch
mov ax, 0x2b1d
rcl ch, 5
cld
jmp 0x4c64e7
mov di, 0x7f79
lea ecx, reloc.mscoree.dll__CorExeMain
bts edi, ecx
and esi, 0x5a6656b7
lea ecx, [ecx + ebx]
xchg edx, ebx
jmp 0x4c64b7
xchg edi, ecx
xchg ah, bh
mov bp, 0xdf4a
xchg dx, ax
mov si, word [esp]
jmp 0x4c6579
xchg bp, dx
lea edi, [edx - 0x24]
inc ah
xchg ecx, eax
call fcn.004c652d
xchg byte [esp + 7], ah
bsr ax, dx
rcr edx, cl
xchg bh, al
jmp 0x4c65ba
mov si, word [esp + 4]
xchg al, cl
lea ecx, [esi*4]
lea ebx, reloc.mscoree.dll__CorExeMain
jmp 0x4c65e7
pop esi
pop bp
mov di, word [esp + 6]
lea ebx, [ebx + ebp]
xchg dword [esp], ebp
xchg word [esp + 4], si
jmp 0x4c6637
push dword [esp + 3]
mov dword [esp + 1], esi
setnp dh
mov ax, si
jmp 0x4c664b
push dword [esp + 5]
mov eax, dword [esp + 1]
rdtsc
not ax
push dword [esp + 0xa]
cmc
jmp 0x4c6621
rol ch, 3
neg al
add esp, 8
sbb bx, 0x4f5a
cpuid
mov cx, bx
jmp 0x4c694a
lea edi, reloc.mscoree.dll__CorExeMain
mov bl, byte [esp + 3]
lea esi, [edi*4]
mov byte [esp + 2], al
cmc
neg cl
call fcn.004c669e
pop bx
lea edx, [edx + edx]
mov word [esp + 2], si
xchg word [esp + 3], bx
cld
pop dword [esp]
jmp 0x4c66e3
Function at 0x4c654b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr esi, ecx
mov word [esp + 4], cx
dec ax
mov eax, edi
xchg esi, edi
rdtsc
jmp 0x4c6550
lea edi, [edi + edi]
jmp 0x4c6535
rol dl, cl
add esp, 0xa
mov dh, 0xa9
xchg edi, ebp
cpuid
mov di, word [esp + 1]
jmp 0x4c660f
mov byte [esp + 2], ch
lea eax, [edi*4]
and bp, bp
mov ebp, 0x1cda1db9
mov ax, 0xff14
ror ax, cl
jmp 0x4c6588
bt edi, ebp
mov eax, ebx
not bl
xchg edi, ebp
sub esp, 9
push word [esp]
jmp 0x4c659e
add esp, 0
cld
mov ebp, eax
lea ecx, [edi + 0x55]
not si
btr bx, ax
jmp 0x4c65d5

Function at 0x4c72b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
clc
lea esp, [esp + 3]
pushal
xchg al, cl
mov di, word [esp]
jmp 0x4c7280
btr ebp, esp
setns ah
mov dx, 0x73db
cmc
not bp
jmp 0x4c7316
call 0x4c72b7
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
push edx
jmp 0x4c725f
sub esp, 0x1d
cmc
and ax, 0x4887
lea eax, [ecx*4]
setg cl
std
jmp 0x4c72dd
mov ebx, dword [esp]
xchg ah, bh
mov ebp, dword [esp]
not edx
xchg bh, dh
lea ebp, [ecx*4]
jmp 0x4c72f3

Function at 0x4c7929
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg al
mov byte [esp + 6], al
lea esi, [ecx + esi]
mov dword [esp + 3], ecx
mov edx, dword [esp + 7]
mov bx, dx
jmp 0x4c794d
cmc
bsf ebp, ecx
cpuid
bsf ax, cx
cpuid
jmp 0x4c7906
mov si, 0xa0d6
add esp, 4
rdtsc
cld
mov eax, esp
mov bp, word [esp]
jmp 0x4c7975
mov byte [esp + 5], cl
mov ebp, eax
pop bx
mov ecx, eax
xchg dword [esp + 0xc], esi
mov edi, ecx
jmp 0x4c7937
add eax, 0x89556df2
bts ebx, ebp
shr esi, cl
xchg cl, dl
mov ax, bp
jmp 0x4c7a1c
xchg word [esp + 2], si
bswap ebx
bsf dx, dx
mov al, byte [esp]
mov dword [esp + 4], ebx
mov ah, bh
jmp 0x4c795f
lea eax, [ebp*4]
add esp, 0
xchg bp, di
mov ecx, edi
jmp 0x4c79f0
rdtsc
mov esi, 0xffde082f
push word [esp + 1]
rol bx, 2
pop ebp
cld
jmp 0x4c79a9
mov di, 0xfbe7
not ecx
push dword [esp + 8]
add esp, 2
lea ebp, [esp + eax]
lea esp, [esp + 0xa]
jmp 0x4c79bf
lea edx, reloc.mscoree.dll__CorExeMain
std
bswap ecx
pop cx
stc
sub esp, 0x15
jmp 0x4c7a05
lea esp, [esp + 0x12]
call fcn.004c7a56
dec eax
rol dword [ecx + 0x20], 1
sar dword [eax - 0x36], cl
push edx
shl byte [edi - 0x35ac1aae], 0xf
mov byte [0x241c8b66], al
cpuid
mov bx, word [esp]
bsr cx, cx
xchg si, ax
mov byte [esp + 0xb], al
xchg si, dx
jmp 0x4c79da
Function at 0x4c7c51
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x1f]
popal
xchg bp, cx
mov bl, dh
jmp 0x4c7c6a
pop eax
jmp 0x4c7c3b
mov ebx, 0xc19ae156
and ax, 0x7ecf
mov byte [esp + 5], bh
jmp 0x4c7ce1
lea ebp, [esi*4]
pop dword [esp + 6]
add esp, 1
mov dl, 0x5d
stc
jmp 0x4c7c54
not esi
lea eax, [ebp + ebp]
neg dx
bsr ax, di
xchg ecx, edi
jmp 0x4c7cba
mov bp, cx
lea ebp, [eax*4]
lea esp, [esp + 9]
rcl ebp, 4
bt ax, si
pop edi
jmp 0x4c7c8c
mov ah, dh
clc
xchg ebp, ecx
mov edi, dword [esp]
pushfd
not dx
jmp 0x4c7d0c
neg ebp
pop bx
mov byte [esp], dh
rdtsc
and ax, si
cmc
jmp 0x4c7cf6
mov ax, word [esp + 0xa]
xchg bp, di
bswap ecx
rol ebx, cl
btc eax, edi
xchg dword [esp + 4], ebx
jmp 0x4c7ca2
mov byte [esp], ch
lea esp, [esp]
lea ebx, reloc.mscoree.dll__CorExeMain
mov ch, byte [esp]
jmp 0x4c7d25
xchg word [esp + 1], bx
mov edx, edi
mov edi, dword [esp + 3]
sub esp, 1
pop word [esp]
mov cx, word [esp + 1]
jmp 0x4c7cc8
bswap ebx
rdtsc
mov dl, bh
mov cl, 0xf0
mov ebp, dword [esp]
xchg bp, cx
jmp 0x4c7f8d
bsr edi, esp
xchg ch, dl
mov bp, word [esp]
cpuid
xchg ch, bl
rdtsc
rdtsc
btr cx, ax
lea eax, reloc.mscoree.dll__CorExeMain
xor dh, 0x55
mov ecx, 0xf77fa1a6
lea ebp, reloc.mscoree.dll__CorExeMain
jmp 0x4c7ec3

Function at 0x4c7f45
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, edi
jmp 0x4c7fac
rdtsc
mov cl, ah
mov dword [esp + 0xa], ecx
mov bh, byte [esp + 0xa]
pushal
xchg word [esp + 0x16], bx
jmp 0x4c7fe7

Function at 0x4c8334
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.004c80a6
jmp 0x4c8478
push word [esp + 3]
push word [esp + 5]
push dword [esp + 2]
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x4c83db
push eax
jmp 0x4c80a1
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x4c8370
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x4c8390
mov byte [esp], al
mov dword [esp], ebp
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x44], esi
push esi
jmp 0x4c8339