joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010c840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov byte [edx + 8], 0
mov ecx, 0x10166704
call fcn.1008f040
cmp dword [0x101660a4], 0
jne 0x1010c8bc
cmp dword [0x1016609c], 0
jne 0x1010c8bc
mov byte [0x101660a0], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1010bf50
push 0
push 0
call fcn.100ef677
add esp, 0x18
mov dword [0x1016609c], eax
cmp dword [0x1016609c], 0
je 0x1010c8bc
push 0xfffffffffffffffe
mov ecx, dword [0x1016609c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [0x101660a4]
add edx, 1
mov dword [0x101660a4], edx
mov ecx, 0x10166704
call fcn.1008f050
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40103c
Capabilities:
Terminate process

Disassembly:
mov dword [0x402475], eax
mov edx, eax
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edi, edi
call dword [sym.imp.kernel32.dll_GetVersion]
xor esi, esi
push dword [0x403587]
call dword [sym.imp.winmm.dll_waveOutClose]
add eax, 6
test eax, 0xb
jne 0x401075
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
ret

Function at 0x4033a3
Capabilities:
Get graphical window text

Disassembly:
add esi, dword [0x56db2108]
mov ecx, dword [eax + ecx*2]
jnp 0x4033d1
call 0xf35c641c
mov esi, dword [eax]
sbb al, 0xf3
inc ebp
clc
mov esi, esp
cwde
inc ebp
clc
jmp 0x40338d
jnp 0x4033c0
jns 0x403381
jnp 0x403405
cld
mov eax, ecx
mov ecx, dword [ebx + 0x1c]
or dword [ebx + 0x84b8b0b], 0x24491d79
xor byte [eax], al
pop eax
add al, 0x23
inc eax
invalid
push 0xfffffffffffffff0
push 0xfffffffffffffff0
push 0x303303
out dx, eax
adc eax, 0x30358c
inc eax
push 0x30327f
xor byte [eax], al
inc eax
inc dword [0xf0403100]
mov dword [0x303594], eax
dec eax
push 0x3032d8
inc eax
inc dword [0xf0403100]
mov dword [0x303598], eax
mov bl, 0xf
je 0x4033e4
pcmpeqb mm3, mm4
invalid

Function at 0x403462
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov edi, eax
mov esi, 0x4025b0
mov ecx, dword [0x403222]
shr ecx, 1
dec ecx
mov bl, byte [0x403226]
rdtsc
push eax
mov bh, byte [esi]
inc esi
mov byte [edi], bh
inc edi
mov al, byte [esi]
stosb byte es:[edi], al
add byte [edi - 1], bl
inc esi
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
loop 0x403482
rdtsc
pop edx
sub eax, edx
sub esp, 0x18
push 0
push dword [0x40245d]
call dword [sym.imp.Msacm32.dll_acmStreamOpen]
pop edx
sub edx, eax
push edx
push 0
push 0
push 0x4032fa
call dword [fcn.0040359c]
push 0x4032b5
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [fcn.00403590], eax
push 0
push 2
push 0x4032f8
push 0x4032c4
call dword [fcn.00403590]
pop edx
sub edx, eax
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x36c23211
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x27483733
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4027e0
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.00408dd0
mov eax, dword [0x2e7dff8]
mov ecx, dword [0x2e7cf48]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4028b5
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2e7dff8], 0x959
jne 0x4028a3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0xc00]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.0040262e
add edi, 8
dec ebx
jne 0x40280c
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4037a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8090c8]
jne 0x4037aa
repz ret
jmp fcn.00405cfe

Function at 0x405924
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404439
and dword [ebp - 4], 0
cmp dword [0x80a884], 0
mov ebx, eax
jne 0x4059d5
push 0x401930
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405a86
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401924
push edi
call esi
test eax, eax
je 0x405a86
push eax
call fcn.004043c7
mov dword [esp], 0x401914
push edi
mov dword [0x80a884], eax
call esi
push eax
call fcn.004043c7
mov dword [esp], 0x401900
push edi
mov dword [0x80a888], eax
call esi
push eax
call fcn.004043c7
mov dword [esp], 0x4018e4
push edi
mov dword [0x80a88c], eax
call esi
push eax
call fcn.004043c7
pop ecx
mov dword [0x80a894], eax
test eax, eax
je 0x4059d5
push 0x4018cc
push edi
call esi
push eax
call fcn.004043c7
pop ecx
mov dword [0x80a890], eax
mov eax, dword [0x80a890]
cmp eax, ebx
je 0x405a2d
cmp dword [0x80a894], ebx
je 0x405a2d
push eax
call fcn.00404442
push dword [0x80a894]
mov esi, eax
call fcn.00404442
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405a2d
test edi, edi
je 0x405a2d
call esi
test eax, eax
je 0x405a24
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405a24
test byte [ebp - 0xc], 1
jne 0x405a2d
or dword [ebp + 0x10], 0x200000
jmp 0x405a66
mov eax, dword [0x80a888]
cmp eax, ebx
je 0x405a66
push eax
call fcn.00404442
pop ecx
test eax, eax
je 0x405a66
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405a66
mov eax, dword [0x80a88c]
cmp eax, ebx
je 0x405a66
push eax
call fcn.00404442
pop ecx
test eax, eax
je 0x405a66
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80a884]
call fcn.00404442
pop ecx
test eax, eax
je 0x405a86
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405a88
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4081dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4081ec
pop dword [ebp - 0x30]
mov eax, 0x18f1237f
add eax, 0xe74f5e6d
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x89ea44f2
add dword [ebp - 0x40], 0xc4680059
mov dword [ebp - 0x3c], 0x3f02041f
sub dword [ebp - 0x3c], 0xcceb7da
mov dword [ebp - 0x38], 0x44859ced
add dword [ebp - 0x38], 0x7c6a741
mov dword [ebp - 0x34], 0xc5a0e556
sub dword [ebp - 0x34], 0xc5a0e556
lea eax, [ebp - 0x40]
push eax
mov eax, 0x580c0f3f
sub eax, 0x57c9decb
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x4f6197d2
sub dword [ebp - 0x40], 0xdaef2e7c
mov dword [ebp - 0x3c], 0xb4dd80
add dword [ebp - 0x3c], 0x40b783f5
mov dword [ebp - 0x38], 0xa0fbe6bd
add dword [ebp - 0x38], 0xc27385af
mov dword [ebp - 0x34], 0x7b4f05a0
sub dword [ebp - 0x34], 0x7b4f05a0
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x7504702c
sub eax, 0x74c23f08
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4126a
push 0
call eax
mov ecx, 0xce4e9918
add ecx, 0x31b1bc9c
mov edx, eax
mov ebx, 0xbb299937
sub ebx, 0xbae65537
add ebx, dword [ebp - 0x30]
mov edi, 0x4c53cd28
sub edi, 0x308ec79d
sub dword [ebp - 0x2c], edx
mov esi, dword [ebx]
mov dword [ebp - 0x18], 0xe4e9e062
add esi, edi
xor dword [ebp - 0x24], edi
mov dword [edx], esi
add edx, 4
add ebx, 4
loop 0x40830e
add eax, 0x149a3
mov ebx, eax
add eax, 0x19d09981
add eax, 0xe62f6684
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x441a26
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
push bp
lea esp, [esp + 3]
jmp 0x441a55

Function at 0x441e0c
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x1f
lea esp, [esp + 3]
mov eax, edi
jmp 0x441d55
stc
pushfd
and ecx, esi
push bx
lea esp, [esp + 1]
jmp 0x441d2b
mov ecx, edx
lea edi, [eax*4]
shr ecx, 8
mov edi, edx
jmp 0x441ce6
lea esp, [esp + 1]
mov ecx, dword [ecx*4 + reloc.mscoree.dll__CorExeMain]
shr edi, 0x10
sub esp, 0x13
call 0x441d15
sbb dword [ecx + 0x5f9b6809], ebx
or dword [eax - 0x65], ebp
pop edi
jns 0x441d43
push 0x594bfa0f
fisttp word [edi + 0x2a]
fldenv [edx]
mov dl, 0xad
mov edx, dword [eax + 0xc]
rcl edi, cl
mov cx, di
mov ch, byte [esp]
xchg di, cx
jmp 0x441d05
jmp 0x441e50
and edx, ebp
xor ecx, edx
dec dh
sub esp, 9
jmp 0x441e3a
mov word [esp], dx
lea esp, [esp + 1]
jmp 0x441f0f
lea esp, [esp + 1]
lea esp, [esp + 0x14]
movzx edi, byte [edi*4 + 0x4261d4]
xor ecx, edi
jmp 0x441e0e
mov dx, word [esp]
mov edx, 0x9b0e288d
mov dx, word [esp]
mov dword [edi], ecx
lea edx, [edx + esi]
jmp 0x441ec0
neg edx
xor ecx, dword [eax]
add ebx, 4
neg dx
jmp 0x441e64
mov edx, dword [edi]
pop edi
sub esp, 0x1a
push dword [esp + 0x10]
call fcn.00441ede
xor edx, ecx
mov cx, 0x92e8
push bp
mov ecx, dword [esp]
lea esp, [esp + 2]
jmp 0x441ec8
push edi
mov edi, eax
add edi, 4
jmp 0x441e96
mov dword [eax + 0x14], edx
setb cl
jmp 0x441ee8
mov ecx, dword [eax + 8]
xor ecx, edx
lea edx, [eax + edi]
cmc
jmp 0x441f7b
mov edx, dword [eax + 0xc]
xor edx, ecx
stc
sub esp, 7
lea esp, [esp + 3]
jmp 0x441f41
lea esp, [esp + 8]
xor ecx, dword [ebx]
mov di, word [esp]
lea edi, [eax + 0x10]
jmp 0x441e8a
lea esp, [esp + 0x24]
cmp ebx, 0x4279fc
jne 0x41afa6
xchg esi, ebp
call fcn.00441f50
setge byte [0x6c17a754]
jg 0x441f87
mov dword [eax + 0x1c], edx
sub esp, 3
mov byte [esp], cl
lea esp, [esp + 3]
jmp 0x441f21
mov dl, byte [esp]
setle dh
mov dword [eax + 0x18], ecx
setl dh
jmp 0x441ef6

Function at 0x441ede
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 0x15], cl
lea esp, [esp + 2]
jmp 0x441ea5

Function at 0x442036
Capabilities:
Encrypt data using aes

Disassembly:
push ax
mov word [esp], cx
lea esp, [esp + 2]
jmp 0x4422e2
pushfd
pop word [esp + 3]
jmp 0x442083
lea edx, [esi + ebx*4 + 8]
mov edi, ebp
btc ax, di
jmp 0x442063
lea esp, [esp + 2]
lea esp, [esp + 4]
jle 0x41b626
lea ecx, [edx + ebx]
shl ax, cl
jmp 0x44203e

Function at 0x4421e0
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
jmp 0x442225
sub esp, 0xb
jmp 0x4421ca
mov dword [ecx], eax
mov eax, dword [edx + 4]
call 0x442201
Function at 0x44222f
Capabilities:
Encrypt data using aes

Disassembly:
pushal
lea esp, [esp + 0x20]
jmp 0x442ab5
jmp 0x44233f
mov dword [ecx + 4], eax
jmp 0x442264
pop word [esp + 0x16]
lea esp, [esp + 2]
jmp 0x4422a7
mov dword [edx + 4], edi
lea esp, [esp + 0x40]
sub ebx, 4
pushal
jmp 0x44224e
sub edx, 0x10
push ax
lea esp, [esp + 2]
jmp 0x4422da
lea esp, [esp + 0x1c]
add ecx, 0x10
pushal
lea esp, [esp + 0x20]
jmp 0x442291
cmp dword [ebp - 4], ebx
call fcn.004422b5
cmp eax, 1
push bx
pushal
pop dword [esp + 1]
lea esp, [esp + 2]
jmp 0x4424da
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x4423a2
movzx ebx, byte [esi + 0x11]
lea edi, [eax*4]
lea edi, reloc.mscoree.dll__CorExeMain
not edi
xchg dx, di
jmp 0x442329
pushfd
jmp 0x44237c
mov edi, edx
shr edi, 0x18
cmc
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x442357
and edi, ecx
pushal
call 0x4423c4
pop word [esp + 0x12]
pop dword [esp + 3]
lea esp, [esp + 3]
jmp 0x4423ae
add esi, 0x10
mov edx, dword [esi]
mov edi, 0x2823804
jmp 0x44236d
and ebx, ecx
clc
call fcn.004423e6
cmp ebx, dword [edi + reloc.mscoree.dll__CorExeMain]
jb 0x4423ae
add ax, si
insd dword es:[edi], dx
jl 0x442350
cmp al, 0xbd
aam 0x65
inc edx
add byte [ebx - 0x4b14e614], al
mov dword [eax], ecx
pop eax
mov edi, esp
mov ecx, 0xff
jmp 0x41b6f0
push eax
mov eax, ebp
add eax, 0xfffffffc
jmp 0x44240d
lea esp, [esp + 0x1c]
jle 0x41b63c
lea ecx, [eax - 1]
mov di, bx
jmp 0x442461
pop edi
mov esi, ebx
pop esi
pop ebx
call fcn.00442a9f
pushfd
lea esp, [esp + 8]
leave
ret

Function at 0x4422b5
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 2], bl
pushal
lea esp, [esp + 0x24]
jmp 0x4422f8
mov eax, dword [ebp - 8]
jmp 0x41b626
jl 0x41b60e
setl ah
mov ah, bl
not ax
jmp 0x4422c0
Function at 0x44250e
Capabilities:
Encrypt data using aes

Disassembly:
mov bh, bl
lea esp, [esp + 8]
movzx ebx, byte [esi + 2]
call fcn.0044241c
pop word [esp + 3]
push dword [esp + 3]
lea esp, [esp + 2]
jmp 0x44247f
lea esp, [esp + 1]
jmp 0x4424a9
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
stc
sub esp, 0x13
push dword [esp + 7]
and al, 7
add esp, 0xa
jmp 0x442469
lea esp, [esp + 3]
jmp 0x4424bb
and ah, bl
jae 0x44247f
xchg byte [ebp - 0x3c], dh
sti
je 0x44248c
lea edi, [esp + ecx*8 - 0x1f]
and byte [ebx - 0x66], ah
and ebx, ecx
sub esp, 7
mov word [esp + 4], dx
stc
mov word [esp + 3], sp
jmp 0x442493
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov bl, 0xe1
jmp 0x442505
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
stc
call 0x44250e
sbb ecx, dword [edi + 0x27897a1f]
mov byte [0xb60f2cdd], al
pop esi
add eax, 0xeb51ca21
loope 0x442498
movzx ebx, byte [esi + 5]
and edx, ecx
push ecx
jmp 0x4424ef
cmp al, 0x24
mov byte [esp], ah
and edx, ecx
jmp 0x4425cc
mov dx, 0x7210
jmp 0x44257c
mov edi, 0xe21ad278
lea edi, [ebx + 0x44]
neg edi
jmp 0x44255f
pushal
mov dword [esp + 0x10], esi
popal
mov dword [ebx], edi
pop ebx
jmp 0x44253e
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov edi, 0xc17bde3b
push si
lea esp, [esp + 2]
jmp 0x44259f
mov edx, dword [esi + 4]
sub esp, 0x19
lea esp, [esp + 1]
push ebx
jmp 0x442554
sub esp, 0x1f
push dword [esp + 0x12]
lea esp, [esp + 3]
lea esp, [esp + 0x20]
popal
jmp 0x4425ad
pushal
xchg bx, cx
setle ch
bswap ecx
mov dword [esp], edx
jmp 0x442589
pushal
pop word [esp + 0x16]
lea esp, [esp + 2]
jmp 0x4425f8
push ecx
mov dword [esp], esi
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
neg edx
jmp 0x44251b
shr edi, 0x18
sub esp, 0x17
mov byte [esp + 3], cl
call fcn.004425e2
bsr ebx, esp
mov bx, word [esp]
jmp 0x442646
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov bh, bl
jmp 0x442607
movzx ebx, byte [esi + 6]
call fcn.00442630
call fcn.004426af
dec ebp
rol dword [ecx + 0x20], 1
rcl dword [edi], cl
int 0x52
shl byte [edi - 0x35ac18ae], 0x65
xchg esp, eax
pop es
push word [esp + 0x2b]
lea esp, [esp + 1]
and ebx, ecx
call 0x44264f
mov al, 0x2c
mov byte [0xa6f234c5], al
cmp dword [ecx - reloc.mscoree.dll__CorExeMain], ebp
sti
ror byte [ebp - 0x24], cl
das
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
and edi, ecx
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x44261f

Function at 0x4426f8
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
jmp 0x442760
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov edi, 0x1e19e629
mov edi, dword [esp]
mov edi, edx
pushal
jmp 0x442735
pushal
push word [esp + 3]
lea esp, [esp + 0x42]
call 0x442781
sub esp, 4
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
cmc
pushal
jmp 0x44276b
mov ebp, esi
add ebp, 4
mov dword [ebp], edi
pop ebp
jmp 0x4426fb
and edi, ecx
call fcn.004427b5
push es
cwde
push cs
imul ebx, dword [eax + reloc.mscoree.dll__CorExeMain], 0x6448ff0c
xchg edi, eax
inc cl
out dx, eax
sbb cl, bh
jmp 0x442744
Function at 0x442843
Capabilities:
Encrypt data using aes

Disassembly:
stc
pop word [esp]
stc
jmp 0x44289f
mov dh, byte [esp]
push edi
mov edi, esi
jmp 0x4428b3
lea esp, [esp + 2]
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
inc edx
mov dh, cl
jmp 0x442874
add edi, 0xc
mov edx, dword [edi]
pop edi
clc
call fcn.0044287c
push ebp
jecxz 0x442935
push ss
in eax, 0x22
lodsd eax, dword [esi]
and al, 0xba
invalid

Function at 0x44287c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp]
sub esp, 0x12
jmp 0x4428f2
mov dword [esi + 8], edi
mov edi, 0x4c450b28
bt di, bx
mov di, word [esp]
jmp 0x4428dc
lea esp, [esp + 2]
jmp 0x442884

Function at 0x442a31
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 1], dh
jmp 0x442a49
jmp 0x442a1b
lea esp, [esp + 2]
jmp 0x442a71
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
dec dword [ebp - 4]
push di
jmp 0x442a33
mov dword [esi + 0xc], edi
call fcn.00442a5b
jns 0x442a74
imul ecx, dword [eax], reloc.mscoree.dll__CorExeMain
dec eax
das
fisubr dword [ebx - 0x45]
xchg edx, eax
or eax, 0x8bf6ef9c
sbb al, 0x9d
aam 0x61
inc edx
add byte [ebx + 0x66], dl
not edi

Function at 0x442a5b
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 1], di
jmp 0x442ae8
lea esp, [esp + 4]
jne 0x41b6f0
je 0x41b63c

Function at 0x44a815
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, eax
jnp 0x44ade5
mov eax, dword [esp]
clc
bswap edx
bsf eax, esp
jmp 0x44a8a4
pushal
jmp 0x44a8ad
mov dx, word [esp]
jmp 0x44a945
lea esp, [esp + 0x20]
add cl, bl
pushfd
mov byte [esp], dh
mov al, 4
jmp 0x44a8ce
xchg word [esp + 1], ax
mov dl, cl
neg eax
je 0x44a91d
jne 0x44a907
mov ax, 0xb4b4
jmp 0x44a929
bsf eax, ebp
rcl eax, cl
lea eax, [ebx - 0x7d]
jmp 0x44a8db
bsf eax, ebp
rcl eax, cl
lea eax, [ebx - 0x7d]
mov ax, 0xb4b4
dec dl
mov eax, dword [esp]
mov ax, word [esp]
sub esp, 0x13
jmp 0x44a9e9
mov eax, ebx
dec dx
js 0x44a88e
pushal
jmp 0x44a8ad
call fcn.0044aabd
salc
inc ecx
ret
js 0x44ab39
jns 0x44ab39
mov ah, 0x51
mov eax, 0x37763c94
jmp 0x44a9df
call 0x44a96b
lea edx, [ebx*4]
rcl dh, 6
lea edx, [eax + edx]
jmp 0x44ac04
clc
bswap edx
bsf eax, esp
call fcn.0044a87f
mov eax, dword [esp]
jmp 0x44ac96

Function at 0x44aa44
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x44aa8a
push word [esp + 3]
jle 0x44aa2e
mov al, bh
xchg word [esp + 1], ax
setne al
mov ah, byte [esp + 1]
lea esp, [esp + 2]
jmp 0x44aa96
mov al, bh
xchg word [esp + 1], ax
setne al
jmp 0x44aa74