joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045aa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a110]
jne 0x4045b4
repz ret
jmp fcn.004062b5

Function at 0x4106c0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408064
and dword [ebp - 4], 0
cmp dword [0x41bf18], 0
mov ebx, eax
jne 0x410771
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410822
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41846c
push edi
call esi
test eax, eax
je 0x410822
push eax
call fcn.00407ff2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41bf18], eax
call esi
push eax
call fcn.00407ff2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41bf1c], eax
call esi
push eax
call fcn.00407ff2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41bf20], eax
call esi
push eax
call fcn.00407ff2
pop ecx
mov dword [0x41bf28], eax
test eax, eax
je 0x410771
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407ff2
pop ecx
mov dword [0x41bf24], eax
mov eax, dword [0x41bf24]
cmp eax, ebx
je 0x4107c9
cmp dword [0x41bf28], ebx
je 0x4107c9
push eax
call fcn.0040806d
push dword [0x41bf28]
mov esi, eax
call fcn.0040806d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4107c9
test edi, edi
je 0x4107c9
call esi
test eax, eax
je 0x4107c0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4107c0
test byte [ebp - 0xc], 1
jne 0x4107c9
or dword [ebp + 0x10], 0x200000
jmp 0x410802
mov eax, dword [0x41bf1c]
cmp eax, ebx
je 0x410802
push eax
call fcn.0040806d
pop ecx
test eax, eax
je 0x410802
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410802
mov eax, dword [0x41bf20]
cmp eax, ebx
je 0x410802
push eax
call fcn.0040806d
pop ecx
test eax, eax
je 0x410802
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41bf18]
call fcn.0040806d
pop ecx
test eax, eax
je 0x410822
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410824
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003ebd
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov esi, ecx
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
je 0x10003fbd
cmp dword [eax + 8], ebx
je 0x10003fbd
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb edi, edi
neg edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10014c20
test eax, eax
jne 0x10003f1b
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003ee7
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003ee7
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10003f62
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x10003f62
cmp dword [esi + 0x2c], ebx
jne 0x10003f62
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 8], ebx
cmp edi, ebx
je 0x10003fbd
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003fbd
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003f73
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 8]
push 0x3e8
push edi
mov dword [eax + 8], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003faf
mov dword [esi + 0x20], ebx
jmp 0x10003fbd
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.10023451
ret

Function at 0x10004070
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov ebx, ecx
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10014c20
test eax, eax
jne 0x100040b5
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004084
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10004084
mov ecx, dword [ebx + 0x24]
xor eax, eax
cmp dword [ebp + 8], eax
sete al
inc eax
mov dword [ecx + 0x18], eax
mov edi, dword [ebx + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100040f1
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100040f1
mov ecx, ebx
call fcn.10003ebd
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004102
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10023451
ret 4
Function at 0x1000b950
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b971
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b96d
xor eax, eax
ret

Function at 0x1000b97f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b9a0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b99c
xor eax, eax
ret

Function at 0x10014c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10014c2f
pop dword [ebp - 0x48]
mov eax, 0x13594724
sub eax, 0x357faf5
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5de55237
sub dword [ebp - 0x58], 0xf930cec
mov dword [ebp - 0x54], 0xb3bdad99
add dword [ebp - 0x54], 0x7e759eac
mov dword [ebp - 0x50], 0x6f8dc44f
sub dword [ebp - 0x50], 0x23418021
mov dword [ebp - 0x4c], 0x64a75205
add dword [ebp - 0x4c], 0x9b58adfb
lea eax, [ebp - 0x58]
push eax
mov eax, 0x5daca0e8
add eax, 0xb255d0a4
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x447432b9
sub dword [ebp - 0x58], 0xd001c963
mov dword [ebp - 0x54], 0xcf36d495
add dword [ebp - 0x54], 0x72358ce0
mov dword [ebp - 0x50], 0xe48069ff
add dword [ebp - 0x50], 0x7eef026d
mov dword [ebp - 0x4c], 0x84f5690d
add dword [ebp - 0x4c], 0x7b0a96f3
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xbde46463
add eax, 0x521e0d1d
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3fae9
push 0
call eax
mov ecx, 0x5b786f67
add ecx, 0xa487d507
xor edx, edx
add edx, eax
mov ebx, 0x10039800
add ebx, dword [ebp - 0x48]
mov edi, 0xf1eeacb2
xor dword [ebp - 0x24], 0xd5951dc2
mov esi, dword [ebx]
add dword [ebp - 0x18], 0x6ebb7432
add esi, edi
mov dword [ebp - 0x44], 0xf0e03a8a
mov dword [edx], esi
xor dword [ebp - 0x28], 0x91633ea0
add edx, 0x11cc481d
add edx, 0xee33b7e7
add ebx, 0x47c5ebab
add ebx, 0xb83a1459
loop 0x10014d47
add eax, 0xd65a48f6
add eax, 0x29a6bb95
mov ebx, eax
add eax, 0x52fc8d68
sub eax, 0x52fc8d63
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1001cacd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
mov eax, 0x10025ac4
call fcn.100233e2
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
mov eax, edi
call fcn.10014c20
pop ecx
test eax, eax
jne 0x1001cba6
mov eax, dword [edi + 4]
mov dword [ebp - 0x5c], eax
inc dword [eax + 0x38]
mov dword [ebp - 0x58], edi
inc dword [edi + 0x14]
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x54], eax
xor eax, eax
mov word [ebp - 0x4c], ax
mov word [ebp - 0x3c], ax
push 4
add edi, 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], edi
pop edi
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x52535048
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], ebx
call fcn.10014c20
mov dword [ebp - 0x24], eax
xor eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 8
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x54]
push edi
push eax
mov dword [ebp - 0x20], 0x55524544
call fcn.10014c20
or dword [ebp - 4], 0xffffffff
add esp, 0x18
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.1001bc6e
mov eax, esi
call fcn.10023465
ret
Function at 0x1001e1a1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10025ae9
call fcn.100233ac
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebx], esi
call edi
test eax, eax
jne 0x1001e2e2
cmp dword [ebp - 0x1c], 1
jne 0x1001e2e2
mov eax, dword [ebp - 0x14]
shr eax, 1
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10014c20
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x1001e2d4
push dword [ebp - 0x14]
push esi
push eax
call fcn.10014c20
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1001e2d4
cmp dword [ebp - 0x1c], 1
jne 0x1001e2d4
shr dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10014c20
pop ecx
mov dword [ebx], eax
cmp eax, esi
je 0x1001e2d4
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push esi
push eax
call fcn.10014c20
lea eax, [ebp - 0x20]
push eax
push 0x1002ac24
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_wcstok_s]
mov edi, eax
add esp, 0x18
cmp edi, esi
je 0x1001e2ba
push edi
call fcn.10014c20
pop ecx
test al, al
je 0x1001e2ba
mov eax, dword [ebp - 0x14]
push edi
inc eax
push eax
push dword [ebx]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e2d4
push dword [ebx]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], esi
jmp 0x1001e2d4
cmp dword [ebp - 0x18], esi
je 0x1001e2e2
push dword [ebp - 0x18]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023451
ret
Function at 0x1001e2e8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x438
mov eax, 0x10025b04
call fcn.10023418
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call sub.MSVCR100.dll_memset
fldz
add esp, 0x18
fstp qword [ebp - 0x444]
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSoftGrid
mov ebx, 0x104
push 0x80000002
mov dword [ebp - 0x438], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e531
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x428], esi
push esi
jmp 0x1001e402
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll__wtof]
fldz
fcomp st(1)
pop ecx
fnstsw ax
test ah, 5
jp 0x1001e3e2
fld qword [ebp - 0x444]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x1001e3e2
lea eax, [ebp - 0x21c]
fstp qword [ebp - 0x444]
push eax
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e3e4
fstp st(0)
inc dword [ebp - 0x428]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
call edi
mov dword [ebp - 0x430], eax
cmp eax, esi
je 0x1001e39a
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x430], 0x103
jne 0x1001e531
mov ebx, dword [sym.imp.MSVCR100.dll_wcslen]
push str.ClientUserInterface
call ebx
mov edi, str.SoftwareMicrosoftSoftGrid_
push edi
mov dword [ebp - 0x430], eax
call ebx
mov ecx, dword [ebp - 0x430]
lea ebx, [ecx + eax + 0x105]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10014c20
add esp, 0xc
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x1001e531
push ebx
push esi
push eax
call fcn.10014c20
push edi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR100.dll_wcscat_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push dword [ebp - 0x428]
call edi
push str.ClientUserInterface
push ebx
push dword [ebp - 0x428]
call edi
add esp, 0x30
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e525
push dword [ebp - 0x434]
push str.LaunchCommand
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x43c]
push 0x1002ac28
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023474
ret
Function at 0x4016a0
Capabilities:
Bypass uac via icmluautil

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402d8b
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
sub esp, 0x18
mov dword [ebp - 4], eax
mov ecx, esp
lea esi, [ebp - 0x230]
push 0x17
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
push str.NexMonitorInstaller.exe
mov word [ecx], ax
call fcn.004019b0
mov ecx, esi
call fcn.004012c0
add esp, 0x18
call section..text
cmp dword [ebp - 0x220], 0
je 0x401859
cmp dword [ebp - 0x21c], 8
mov eax, esi
push 2
cmovae eax, dword [ebp - 0x230]
push 0
mov dword [ebp - 0x260], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x25c], eax
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x258], 0
mov edx, 0x24
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x401770
movups xmm0, xmmword [0x4031d0]
mov ax, word [0x403208]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x254], 0x24
add edi, 0xfffffffe
movups xmmword [ebp - 0x218], xmm0
mov dword [ebp - 0x240], 4
movups xmm0, xmmword [0x4031e0]
mov word [ebp - 0x1e0], ax
movups xmmword [ebp - 0x208], xmm0
movups xmm0, xmmword [0x4031f0]
movups xmmword [ebp - 0x1f8], xmm0
movq xmm0, qword [0x403200]
movq qword [ebp - 0x1e8], xmm0
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4017e0
mov ecx, 0x13
lea eax, [ebp - 0x258]
mov esi, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
rep movsd dword es:[edi], dword [esi]
push eax
push 0x403360
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x218]
movsw word es:[edi], word [esi]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov esi, dword [ebp - 0x258]
test eax, eax
jne 0x40183e
test esi, esi
je 0x40184a
mov eax, dword [esi]
push 5
push 0
push 0
mov eax, dword [eax + 0x24]
push 0
push dword [ebp - 0x260]
push esi
call eax
test esi, esi
je 0x40184a
mov eax, dword [esi]
push esi
mov eax, dword [eax + 8]
call eax
cmp dword [ebp - 0x25c], 0
jne 0x401859
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x40189b
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401891
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401891
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00401fc7
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401f86
mov esp, ebp
pop ebp
ret
Function at 0x194c85c
Capabilities:
Packed with generic packer

Disassembly:
push esp
lea esp, [esp + 4]
push ebp
mov ebp, esp
jmp 0x194c889
jmp 0x19c3e19
push ebx
or al, 0x44
push dword [esp + 2]
jmp 0x194c8c6
mov eax, dword [0x1955b44]
jmp 0x194c8da
lea esp, [esp + 8]
push ecx
sub esp, 0x10
pop dword [esp]
setb ah
jmp 0x194c8b0
lea esp, [esp + 0xc]
test eax, eax
push bp
lea esp, [esp + 2]
jmp 0x19c3d1d
lea esp, [esp]
push word [esp + 1]
mov dword [esp], esp
jmp 0x19654f3
lea esp, [esp + 2]
mov dword [esp], ecx
lea ecx, [esi*4]
jmp 0x1965524
lea ecx, [ebx*4]
mov ecx, 0x2765b0c7
mov ecx, dword [esp]
not ch
mov ch, 0x6a
call fcn.0196550e
jbe 0x196559f
mov al, byte [0xec8355e3]
pop es
xchg dx, cx
xchg dl, ch
setbe dl
mov dl, bh
pop edx
mov cx, word [esp]
jmp 0x19656f7
mov eax, dword [esp]
mov edx, dword [esp]
lea eax, reloc.mscoree.dll__CorExeMain
xchg dx, cx
mov cl, 0x89
pop eax
jmp 0x1965581
mov cx, 0xb6a0
lea ecx, [ecx - 0x9c]
pop ecx
jmp 0x194c857
je 0x194c873
mov eax, dword [eax + 0x6c]
pushfd
jmp 0x19c3ead
xor eax, eax
leave
ret
jl 0x19c3e61
invalid
invalid
lea esp, [esp + 4]
neg eax
call fcn.019c3dfc
pushal
mov dword [reloc.mscoree.dll__CorExeMain], eax
js 0x19c3e60
inc ecx
mov cl, 0x7e
push ds
mov edx, dword [ecx]
not edx
out dx, al
ja 0x19c3f1d
xor byte [ebx + 0xb72402b], 0xe8
adc dword [edi - reloc.mscoree.dll__CorExeMain], ebx
mov eax, edx
movsb byte es:[edi], byte [esi]
cmp dword [edi - 5], 0x7dc084b
inc ebx
and al, 0x57
mov esi, 0x81a4d089
jg 0x19c3ed9
shl byte [ecx + eax*4 + 0x84bfb7f], 1
fadd qword [edi]
dec ebx
or ah, bl
pop es
test al, 0x45
jp 0x19c3ed4
mov esi, 0xbfebe179
sub eax, 0xd79f0904
aam 0x47
out dx, al
stc
popal
add eax, ebp
sbb eax, 0x538013d
push ebp
push 0xffffffffffffffe1
mov al, 0xe4
rcl esp, 1
into
push ds
xor dword [ecx + reloc.mscoree.dll__CorExeMain], ebp
in eax, 0x35
inc esi
mov edi, 0xcac7daae
les edx, [ebx]
popfd
stosb byte es:[edi], al
xchg ebx, ecx
lea ebx, [ebx + esi]
mov cx, 0x91d9
jmp 0x19c3f3c
mov ebx, dword [edi]
lea ecx, [edi*4]
mov edx, 0xcf90716b
bswap ecx
jmp 0x19c3f6f
mov ecx, dword [esp]
mov cl, byte [edi + 4]
bswap edx
bt edx, ebp
jnp 0x19c40b3
jp 0x19c40b3
mov dl, byte [edi - 0x6153854f]
invalid
call fcn.019c402e
les esi, [edi + 0x5e]
retf 0x8c69
Function at 0x195844f
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, byte [edi - 1]
bt eax, esp
jmp 0x1956e30
lea eax, [edi*4]
push sp
inc ax
pushal
mov ebx, ecx
jmp 0x1956e64
jge 0x1956e10
lea eax, [edi*4]
push sp
jmp 0x1956e7a
mov bl, 0xbb
mov bl, 0xc6
lea esp, [esp + 2]
jmp 0x1956e81
inc ax
pushal
mov ebx, ecx
jmp 0x1956e64
add cl, dl
not bx
neg eax
jmp 0x1956eda
adc bx, 0xdc3b
mov ebx, esi
jmp 0x1956ebf
mov al, cl
jmp 0x1956f54
jg 0x1956e8e
adc bx, 0xdc3b
mov ebx, esi
call 0x1956eff
invalid
bswap ebx
mov bl, 0x97
jmp 0x1956f7b
bsf bx, bp
jp 0x1956f3d
bswap ebx
mov bl, 0x97
jmp 0x1956f7b
sub esp, 6
jmp 0x19570bc
sub al, 0xc0
mov bl, ah
xchg bh, bl
mov bx, word [esp]
call fcn.01956f60
lea esp, [esp + 4]
sub al, 0x76
neg bx
jge 0x1956f62
sub esp, 6
mov ebx, esp
mov bx, 0x71d6
jmp 0x1957013
mov bl, ch
mov ebx, 0x56502345
jmp 0x1956fc7
mov bl, byte [esp]
mov bx, 0x5ece
mov ebx, eax
jmp 0x1956ff9
bsf ebx, ecx
jns 0x1956fb9
mov bl, ch
mov ebx, 0x56502345
mov bl, byte [esp]
mov bx, 0x5ece
mov ebx, eax
jmp 0x1956ff9
inc al
mov bh, byte [esp]
call 0x195708e
in al, dx
pushal
not byte [ecx - 0x62ed2ca0]
or eax, 0x6c14a754
jg 0x1957058
int1
xchg dword [esp], ebx
lea esp, [esp + 2]
jmp 0x19570c9
invalid
mov ebx, esp
mov bx, 0x71d6
xchg dword [esp], ebx
lea esp, [esp + 2]
lea esp, [esp + 4]
inc al
jmp 0x1956fde
fmul dword [ebp + reloc.mscoree.dll__CorExeMain]
add byte [eax], al
jmp 0x1958361
and ebx, edi
mov bh, bl
mov dword [ecx + ebp], eax
jmp 0x195824f
mov cx, word [esp]
mov eax, dword [esp]
bsf ax, ax
jmp 0x195827d
jmp 0x1958242
add esi, 4
sub esp, 0xc
jne 0x19582a1
je 0x19582ac
sbb al, 0x80
push ss
jno 0x19581f6
xor bh, byte [ebp - 0x6e99e074]
adc byte [esi - 0x18], dh
jbe 0x1958267
ja 0x1958267
mov word [edi], ss
xchg edx, esp
adc edx, ebx
sub cl, byte [eax + 0xf88791e]
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
stc
fmul dword [edi]
enter 0x68b, 0xfffffffffffffffe
invalid
bswap eax
mov eax, dword [esi]
inc bh
js 0x1958265
and ebx, edi
mov bh, bl
jmp 0x1958246
push word [esp + 8]
jmp 0x19582e1
push word [esp + 8]
pop eax
pop cx
jmp 0x1956da2
neg bx
jmp 0x1958293
pop eax
pop cx
jmp 0x1956da2
and ecx, 0x3c
and bx, 0x779c
ja 0x19582c6
neg bx
bswap eax
jmp 0x1958295
mov dword [esp + 0x24], ebp
call 0x1958448
push edi
call 0x195844f
cmp dword [eax - 0x17], esp
adc eax, dword [ecx]
add byte [eax], al
or dword [edx + reloc.mscoree.dll__CorExeMain], ebx
imul edi, edi, 0xb5f90a6f
inc ecx
rol byte [esi + 0x21], 1
shl byte [edx - 0x33], 1
pop esp
neg al
lea eax, [edx*4]
jmp 0x1958361
Function at 0x19584c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf194709c
jmp 0x1958549
jmp 0x1958500
lea esp, [esp + 2]
xchg dword [esp + 4], esi
call fcn.019584ea
cmp ebp, dword [ebx + reloc.mscoree.dll__CorExeMain]
dec esi
fnstcw word [eax]
sbb esi, dword [edx - 0x78]
insb byte es:[edi], dx
and al, 4
push word [esp + 0x20]
lea esp, [esp + 2]
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
pushfd
jmp 0x1957b95
not edi
xchg dx, cx
mov eax, dword [esp]
jmp 0x195857c
rol bx, cl
jns 0x19585af
js 0x19585af
leave
dec edx
fdivr dword [edi - 0x109605b6]
jg 0x19585a7
jmp 0xdd307c6
xchg bh, al
lea esp, [esp + 2]
jmp 0x19585b9
loop 0x195860d
cli
popfd
insb byte es:[edi], dx
fcom dword [ecx]
nop
mov edi, dword [esp + 0x2c]
mov ah, 0xcf
push bx
jmp 0x1958599
lea ebp, [esp]
pushal
xchg word [esp + 0xf], ax
btc bx, bp
jge 0x195876e
setnp al
jmp 0x19586a1
rdtsc
inc ch
mov eax, edi
btr ecx, esi
shl dh, cl
jmp 0x1958610
mov bh, 0x38
pushal
xchg byte [esp + 0x15], bh
mov ebx, edi
bswap edx
bsr ax, dx
jmp 0x195864e
ret 0x3eeb
jmp 0x1958711
mov eax, edi
btr ecx, esi
shl dh, cl
call 0x1958633
lcall 0xc28b, 0xf941ba66
mov eax, dword [esp]
xchg ch, dh
btc ecx, ebp
jmp 0x195866c
jo 0x19585e9
rdtsc
inc ch
jmp 0x1958626
neg dh
sbb ch, 0x67
mov ax, bx
push cx
mov cl, bh
lea esp, [esp + 2]
jmp 0x1958682
xchg dword [esp], edi
or ax, si
cmc
mov cx, di
mov cx, word [esp]
lea edi, [edi - 0x22]
jmp 0x1958656
xchg dword [esp], edi
xchg edx, ecx
bswap edx
mov cx, si
lea ecx, [ebx + 0x4a]
push dword [esp]
ret 4
setnp al
sub esp, 0xa0
mov esi, esp
jmp 0x19585ff
bsf edx, edx
jmp 0x19586ee
rcr dl, 7
lea edx, [edx + ebp]
bts eax, eax
jmp 0x19586ae
xchg cl, dl
rcr dl, 7
lea edx, [edx + ebp]
bts eax, eax
bsf edx, edx
xchg dx, ax
mov al, 0x4d
add edi, 0x6c40e359
cmc
jmp 0x1958720
add edi, 0x10ef136f
btr eax, edi
jb 0x19586e0
xchg cl, dl
jmp 0x19586c4
jne 0x1958736
setb cl
setbe cl
jmp 0x1958744
setb cl
setbe cl
mov dh, cl
jmp 0x1958791
mov dh, cl
mov eax, dword [esp]
bt ecx, edi
jmp 0x1958797
lea ecx, [ebp*4]
xor edi, 0x13037f82
rdtsc
call fcn.01958773
ret 0xc052
jmp 0x195869e
mov eax, dword [esp]
bt ecx, edi
setg ah
bswap edx
jmp 0x195874e

Function at 0x19584ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esi, [esi + 0x69]
xchg dword [esp + 0xc], esi
pushal
jmp 0x1958543
pushal
call fcn.01958592

Function at 0x19f7b7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cx, bx
sub esp, 7
stc
mov bh, byte [esp + 0xd]
jmp 0x19f7bb2
or esi, ebp
xchg word [esp + 6], di
mov ah, byte [esp + 0x12]
xchg dword [esp + 0x18], esi
jmp 0x19f7b9c