joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405542
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x407374
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x407364
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x405593
xor eax, eax
jmp 0x4055ba
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x4055ba
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x40558f
call esi
pop esi
leave
ret 4

Function at 0x4055f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x43d538], 0x44
push eax
xor eax, eax
push 0x43d538
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405633
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4056bd
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405ab1
mov edi, eax
cmp edi, 0xffffffff
je 0x4056fe
test byte [esp + 0x10], 1
push esi
je 0x4056e0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4056e6
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4056ef
xor eax, eax
inc eax
jmp 0x405700
test byte [esp + 0x10], 4
jne 0x4056fe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405705
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004059c3
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405744
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4467a8], eax
jmp 0x4058ce
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40575e
test eax, eax
je 0x40587c
test bl, 2
je 0x40587c
mov esi, 0x439538
push edi
push esi
call fcn.00405e63
cmp dword [ebp + 8], 0
je 0x40577d
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405783
push edi
call fcn.0040591c
cmp byte [edi], 0
jne 0x405791
cmp byte [0x439538], 0x5c
jne 0x40579c
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405872
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405900
cmp byte [eax], 0
je 0x4057e2
cmp byte [ebp - 0x1c], 0
je 0x4057e2
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x4057f8
mov al, byte [esi + 1]
test al, al
je 0x405851
cmp al, 0x2e
jne 0x4057f8
cmp byte [esi + 2], 0
je 0x405851
push esi
push ebx
call fcn.00405e63
test byte [ebp - 0x14c], 0x10
je 0x40581d
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405851
push dword [ebp + 0xc]
push edi
call fcn.00405705
jmp 0x405851
push dword [ebp - 4]
push edi
call fcn.004056bd
test eax, eax
jne 0x405849
cmp dword [ebp - 4], eax
je 0x405841
push edi
push 0xfffffffffffffff1
call fcn.0040507c
push 0
push edi
call fcn.00405d1e
jmp 0x405851
inc dword [0x4467a8]
jmp 0x405851
push edi
push 0xfffffffffffffff2
call fcn.0040507c
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4057c0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40587c
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4058ce
cmp dword [ebp - 0xc], esi
jne 0x405890
inc dword [0x4467a8]
jmp 0x4058ce
push edi
call fcn.00406167
test eax, eax
je 0x4058ce
push edi
call fcn.004058d5
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004056bd
test eax, eax
jne 0x4058c6
cmp dword [ebp - 4], esi
je 0x405888
push edi
push 0xfffffffffffffff1
call fcn.0040507c
push esi
push edi
call fcn.00405d1e
jmp 0x4058ce
push edi
push 0xffffffffffffffe5
call fcn.0040507c
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4059c3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x43b538
push esi
call fcn.00405e63
push esi
call fcn.0040596e
mov edi, eax
test edi, edi
jne 0x4059e4
xor eax, eax
jmp 0x405a36
push edi
call fcn.004060ce
test byte [0x446738], 0x80
je 0x4059fd
mov al, byte [edi]
test al, al
je 0x4059e0
cmp al, 0x5c
je 0x4059e0
sub edi, esi
jmp 0x405a15
call fcn.00406167
test eax, eax
je 0x405a0f
test byte [eax], 0x10
je 0x4059e0
push esi
call fcn.0040591c
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405a01
call fcn.004058d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ab1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ad0
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405ad6
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405b05
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4093c4]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405b4a
test edi, edi
jne 0x405b10
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405b44
Function at 0x405bac
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x43dac0
push 0x4093e0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov ebx, 0x400
je 0x405bfa
push 1
push 0
push esi
call fcn.00405ad6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405d19
cmp eax, ebx
jg 0x405d19
mov esi, 0x43dec0
push ebx
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x405d19
cmp eax, ebx
jg 0x405d19
push esi
push edi
push str._s_s_r_n
push 0x43d6c0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x446730]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405e85
push 4
push 0xc0000000
push esi
call fcn.00405ad6
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405d19
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405d12
push edi
push esi
push ebp
call fcn.00405b4e
test eax, eax
je 0x405d12
push str._Rename__r_n
push esi
call fcn.00405a3b
test eax, eax
jne 0x405cb0
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405ce5
add eax, 0xa
push 0x4093c8
push eax
call fcn.00405a3b
mov ebp, eax
test ebp, ebp
je 0x405ce1
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405cd2
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405ccc
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405ce7
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x43d6c0
push eax
call fcn.00405a91
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405b7d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405d1e
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405d41
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405bac
pop ecx
pop ecx
inc dword [0x4467b0]
ret 8
Function at 0x405d4a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405dbb
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405daa
cmp dword [ebp + 0x14], 1
je 0x405dac
cmp dword [ebp + 0x14], 2
je 0x405dac
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x40618e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4061b2
xor eax, eax
test eax, eax
je 0x4061c4
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4061c4
xor ecx, ecx
jmp 0x4061c7
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406271
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43e2c4], 0
push esi
jne 0x4062a8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406282
mov dword [ecx*4 + 0x43e2c0], eax
inc ecx
cmp ecx, 0x100
jl 0x40627d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4062d9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43e2c0]
xor eax, esi
inc ecx
dec edx
jne 0x4062bb
pop edi
not eax
pop esi
ret 0xc
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x100288a
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10065f0
call fcn.01002a74
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10074a4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100269f
cmp eax, esi
jne 0x1002692
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10026a2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002679
xor esi, esi
inc esi
mov eax, dword [0x10074a0]
cmp eax, esi
jne 0x10026b5
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10026f0
mov eax, dword [0x10074a0]
test eax, eax
jne 0x10026ea
mov dword [0x10074a0], esi
push 0x1001190
push 0x1001184
call fcn.010025f6
pop ecx
pop ecx
test eax, eax
je 0x10026f0
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10027ba
mov dword [0x100704c], esi
mov eax, dword [0x10074a0]
cmp eax, esi
jne 0x1002714
push 0x1001180
push 0x1001178
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10074a0], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002721
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10074a8], ebx
je 0x1002742
push 0x10074a8
call fcn.010029e9
pop ecx
test eax, eax
je 0x1002742
push ebx
push 2
push ebx
call dword [0x10074a8]
push dword [0x1007034]
push dword [0x1007038]
push dword [0x1007030]
call fcn.0100231c
add esp, 0xc
mov dword [0x1007048], eax
cmp dword [0x100703c], ebx
jne 0x10027a0
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100704c], ebx
jne 0x10027ae
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1007048]
call fcn.01002ab9
ret
call fcn.01002bc1
jmp 0x1002657
Function at 0x96b6c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0096b71b
lea esp, [esp + 5]
pushal
lea esp, [esp + 3]
mov dword [esp + 0x1c], eax
push esi
jmp 0x96b6f1
push dword [esp + 1]
jae 0x96b736
mov dword [esp + 0x20], ecx
pushal
jmp 0x96b720
push dword [esp + 0xa]
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], ecx
pushal
jmp 0x96b702

Function at 0x96b6ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0096b71b
lea esp, [esp + 5]
pushal
lea esp, [esp + 3]
mov dword [esp + 0x1c], eax
push esi
jmp 0x96b6f1
push dword [esp + 1]
jae 0x96b736
mov dword [esp + 0x20], ecx
pushal
jmp 0x96b720
push dword [esp + 0xa]
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], ecx
pushal
jmp 0x96b702
Function at 0x96b771
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x96b7d8
mov dword [esp + 0x44], esp
mov dword [esp + 0x40], ebp
call fcn.0096b777

Function at 0x96b777
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
call fcn.0096b7af
cmc
mov dl, 0xef
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - reloc.mscoree.dll__CorExeMain]
cwde
mov esi, 0xdbf8990e

Function at 0x96b7af
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
jge 0x96b799
jl 0x96b7bf
aas
jp 0x96b7e1
insd dword es:[edi], dx
xor ecx, dword [edi + ecx + reloc.mscoree.dll__CorExeMain]
add dword [ecx + reloc.mscoree.dll__CorExeMain], ecx
push ebp
mov byte [esp + 1], ah
mov dword [esp + 0x48], esi
push bp
jmp 0x96b7e5
xchg edx, eax
invalid
push cx
mov byte [esp], ah
jmp 0x96bc4f
Function at 0x96bc66
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp + 3]
lea esp, [esp + 3]
jmp 0x96bc85
Function at 0x984825
Capabilities:
Encrypt data using aes

Disassembly:
lea eax, [edi*4]
jmp 0x9d5a28
call fcn.009d5c6b
pop word [esp]
jmp 0x9d5c42
jmp 0x9d5cd6
call fcn.009d6247
jle 0x984917
call 0xfb9e8b50
ret
call 0x9a6179
bsr ebx, esp
mov bx, word [esp]
and dword [ebp - 4], 0
jmp 0x984912
push edi
mov esi, dword [esp]
not si
mov esi, ecx
jmp 0x9848dd
mov bl, dl
mov ebx, eax
call 0x98491c
add dword [eax], eax
add byte [eax], al
test ecx, 0xec8302e3
sbb eax, 0x63f3eeb
mov cl, 0xb0
fsubr qword [ecx + 0x47c3fb06]
dec edi
fist word [edx - 0x6a8f1fa1]
push esi
mov esi, dword [esp]
mov si, 0x394a
mov esi, dword [esp]
mov esi, 0x8b8e093f
jmp 0x984903
push ebx
jmp 0x9d5a60
lea esp, [esp + 2]
mov dword [esp + 0x24], edx
call fcn.009d5a6d
lea ecx, [edx + eax*4]
in eax, 0x14
std
sbb dword [eax + 0x5b], edi
pushal
neg cx
bswap ebp
xchg ebp, ecx
sub esp, 0x16
jmp 0x9d5a4a
mov word [esp], cx
lea esp, [esp + 2]
jle 0x9848c7
lea ebx, [eax + edi]
neg dh
jmp 0x9d5c8d
lea esp, [esp + 4]
cmp eax, 1
call 0x984825
mov di, ax
jmp 0x9d5d1d
btr bx, bx
lea ecx, [eax - 1]
shl edi, 0x13
mov bl, byte [esp]
lea edx, [esp + 0xa6]
jmp 0x9d5c77
lea esp, [esp + 4]
jmp 0x984820
bsf dx, dx
rol dh, 3
jmp 0x9d5d01
movzx ebx, byte [esi + 0x11]
mov di, word [esp]
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov dx, 0x31b6
jmp 0x9d5cbe
mov edi, 0x241dddd1
jmp 0x9d5d4b
add esi, 0x10
neg dl
mov edx, dword [esi]
bsr di, di
jmp 0x9d5ceb
mov dword [ebp - 4], ecx
not bl
neg ch
mov ecx, 0xff
jmp 0x984886
mov dword [esp], edx
cmc
popal
sub esp, 0x14
jmp 0x9d5d59
pushal
btc ecx, ebp
lea eax, [eax + ebx]
bswap edi
xchg si, cx
jmp 0x9d5d2e
shr edi, 0x18
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
clc
call 0x9d5d6a
xchg edi, eax
jmp 0x9d5dab
jl 0x98480a
mov ax, 0x92e9
bswap eax
push edx
mov eax, dword [ebp - 8]
jmp 0x9d5cb5
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, edi
bt ebx, eax
jmp 0x9d5db8
and edi, ecx
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
and ebx, ecx
jmp 0x9d5d95
movzx ebx, byte [esi + 2]
clc
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x9d5e22
movzx ebx, byte [esi + 5]
cmc
call fcn.009d5e03
xor eax, 0xb34021b1
push ebx
xor eax, 0xb24720b2
inc ecx
xor ebp, dword [edx]
inc ebp
lea esp, [esp + 4]
cmp dword [ebp - 4], ebx
pushfd
lea esp, [esp + 4]
jmp 0x9d5d80
and ebx, ecx
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
setne bh
lea ebx, [esi*4]
mov ebx, esi
jmp 0x9d5dc6

Function at 0x992cd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, reloc.mscoree.dll__CorExeMain
call 0x992c58
Function at 0x9a6e81
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 1], sp
mov si, cx
bswap esi
mov esi, 0x94b217d8
mov esi, dword [esp + 1]
jmp 0x9a6e38

Function at 0x9d5798
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, ecx
lea ecx, [eax + ebp]
neg ch
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0x9d57b8
xor edx, eax
mov ax, word [esp]
jmp 0x9d5773
mov dword [ecx + 0x18], eax
rcl ebx, 0xc
mov ebx, dword [esp]
mov bh, byte [esp]
jmp 0x9d5734
lea esp, [esp + 4]
jmp 0x9d50c4
mov dword [ecx + 0x1c], edx
lea edx, [esi + ebp]
lea ecx, reloc.mscoree.dll__CorExeMain
mov ebx, 0x9900dc
jmp 0x9d575d
mov dword [ecx + 0x14], ebx
setle bl
inc bl
jmp 0x9d574f
pushal
ror ebp, 0
bswap esi
mov dword [esp + 0x18], edx
popal
jmp 0x9d57da
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, 0xdbf0af81
jmp 0x9d57a2
and ecx, esi
jmp 0x9d57e4
shr ecx, 8
bsf edi, edx
mov edi, edx
jmp 0x9d57c4
mov ecx, dword [ecx*4 + reloc.mscoree.dll__CorExeMain]
jmp 0x9d5825
and edi, esi
jmp 0x9d58ad
shr edi, 0x10
sub esp, 6
cmc
lea esp, [esp + 2]
jmp 0x9d580f
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
lea esp, [esp + 4]
and ecx, 0xff0000
call fcn.009d5861
mov edx, dword [esp]
call fcn.009d5903
lea edi, [eax + 0x10]
btc dx, si
jmp 0x9d58ed
xor ecx, dword [eax]
jmp 0x9d5929
lea edx, [edx + esi]
jmp 0x9d5938
add ebx, 4
lea edx, reloc.mscoree.dll__CorExeMain
mov dword [edi], ecx
mov edx, eax
jmp 0x9d5913
mov edx, dword [eax + 4]
jmp 0x9d5c33
push ebx
jmp 0x9d5a88
xor ecx, edx
mov edx, ecx
pushal
mov dword [eax + 0x18], ecx
jmp 0x9d595d
mov ebx, eax
add ebx, 0xc
mov edx, dword [ebx]
pop ebx
call fcn.009d5a26
push ebp
jmp 0x9d5a9c
mov ebp, ecx
add ebp, 0xfffffff8
mov edi, dword [ebp]
pop ebp
jmp 0x9d5ae1
mov dword [ecx - 8], eax
rol ah, cl
shr eax, 0xf
jmp 0x9d5b08
sub esp, 0x15
lea esp, [esp + 1]
lea esp, [esp + 0x18]
add dword [ebp - 4], 4
jmp 0x9d5acb
mov edi, dword [ecx - 4]
jmp 0x9d5b12
mov eax, dword [edx - 4]
mov dword [edx - 8], edi
neg edi
jmp 0x9d5af2
mov dword [ecx - 4], eax
dec ah
xchg al, ah
jmp 0x9d5b50
add ebp, 8
mov ecx, dword [ebp]
pop ebp
pushfd
jmp 0x9d5973
mov edi, esi
jmp 0x9d5b8a
mov eax, dword [edx]
mov dword [edx - 4], edi
mov edi, edx
pushal
jmp 0x9d5b3a
mov edi, dword [ecx + 4]
sub esp, 0xa
push word [esp + 6]
mov word [esp + 5], dx
jmp 0x9d5b93
mov eax, dword [edx + 4]
push edi
mov dword [edx], edi
mov di, si
mov edi, edx
jmp 0x9d5b5a
mov edi, dword [ecx]
mov dword [ecx], eax
sets ah
jmp 0x9d5b70
mov dword [ecx + 4], eax
pushfd
push ebp
jmp 0x9d5c01
mov dword [esp + 0x16], ebx
lea esp, [esp + 3]
lea esp, [esp + 0x18]
popal
jmp 0x9d5bdf
xchg cl, ch
sub cx, 0x1fa1
push ebp
mov ebp, eax
jmp 0x9d5b2d
mov word [esp], ax
lea esp, [esp + 2]
jmp 0x9d5beb
add ebp, 4
mov dword [ebp], edi
pop ebp
stc
push cx
jmp 0x9d5bc9
lea esp, [esp + 0x34]
sub ebx, 4
jmp 0x9d5c15
pushal
lea edi, reloc.mscoree.dll__CorExeMain
bsr edi, edx
mov dword [esp + 8], edx
cmc
sub esp, 0x1b
jmp 0x9d5b9a
add ecx, 0x10
pushal
lea esp, [esp + 0x20]
sub edx, 0x10
call fcn.009d5e9f
enter 0xffffffffffffc353, 0xffffffffffffffa6
push ebp
aam 0x56
aam 0x4a
sub eax, 0x80c110dc
xor edx, ecx
mov dword [eax + 0x14], edx
neg cl
lea ecx, [edi + ebp]
jmp 0x9d5bba