joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fb47
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x3ff
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00452e00
add esp, 0xc
test esi, esi
je 0x44fd28
cmp byte [esi], 0
je 0x44fd28
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push dword [0x485c40]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x44fbd9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push esi
push str.Socket__s:__d_r_n
push dword [0x481960]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
call fcn.0044fa2d
jmp 0x44fd3d
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
mov ebx, 0x3e8
push ebx
mov dword [ebp - 0x408], esi
call fcn.0044face
test eax, eax
jne 0x44fc16
add esi, 0x2710
call edi
cmp eax, esi
jae 0x44fc16
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call fcn.0044face
test eax, eax
je 0x44fbfe
xor edi, edi
mov ebx, 0x400
cmp edi, dword [ebp + 0x10]
jl 0x44fc2a
test edi, edi
jne 0x44fd1d
push ebx
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00452e00
add esp, 0xc
push 0
push ebx
lea eax, [ebp - 0x404]
push eax
push dword [0x485c40]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 1
jl 0x44fd1d
test edi, edi
jne 0x44fc7f
push 3
lea eax, [ebp - 0x404]
push 0x46fd4c
push eax
call fcn.004549c0
add esp, 0xc
test eax, eax
jne 0x44fd3d
mov edx, dword [ebp - 0x40c]
test edx, edx
je 0x44fcb9
mov eax, dword [ebp + 0x10]
cmp edi, eax
jge 0x44fcb9
add edx, edi
je 0x44fcb9
sub eax, edi
mov ecx, esi
cmp esi, eax
jl 0x44fc9e
mov ecx, eax
test ecx, ecx
jle 0x44fcb9
cmp esi, eax
jge 0x44fca8
mov eax, esi
push eax
lea eax, [ebp - 0x404]
push eax
push edx
call fcn.00452790
add esp, 0xc
mov eax, dword [ebp + 0x10]
sub eax, edi
cmp esi, eax
jge 0x44fcc4
mov eax, esi
add edi, eax
cmp dword [ebp + 0x14], 1
je 0x44fd1d
cmp dword [ebp + 0x14], 2
jne 0x44fcd6
cmp esi, ebx
jl 0x44fd1d
push 0x3e8
call fcn.0044face
test eax, eax
jne 0x44fc1d
mov esi, dword [ebp - 0x408]
add esi, 0x2710
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jae 0x44fc1d
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call fcn.0044face
test eax, eax
je 0x44fcf4
jmp 0x44fc1d
xor eax, eax
inc eax
cmp edi, eax
jl 0x44fd3f
mov eax, edi
jmp 0x44fd3f
push esi
push str.Socket__s:_Invalid_Parameter_r_n
push dword [0x481960]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
leave
ret 0x10
Function at 0x452dee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47e5d0]
jne 0x452df8
repz ret
jmp fcn.00457ed1

Function at 0x4626ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004578b0
and dword [ebp - 0x14], 0
cmp dword [0x486acc], 0
mov dword [ebp - 0x18], eax
jne 0x46275f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x462807
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x462807
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x486acc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x486ad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x486ad4], eax
call edi
push eax
call esi
mov dword [0x486adc], eax
test eax, eax
je 0x46275f
push 0x47b0f0
push ebx
call edi
push eax
call esi
mov dword [0x486ad8], eax
mov eax, dword [0x486ad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4627b8
cmp dword [0x486adc], ecx
je 0x4627b8
push eax
call esi
push dword [0x486adc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4627b8
test ebx, ebx
je 0x4627b8
call edi
test eax, eax
je 0x4627af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4627af
test byte [ebp - 8], 1
jne 0x4627b8
or dword [ebp + 0x10], 0x200000
jmp 0x4627eb
mov eax, dword [0x486ad0]
cmp eax, dword [ebp - 0x18]
je 0x4627eb
push eax
call esi
test eax, eax
je 0x4627eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4627eb
mov eax, dword [0x486ad4]
cmp eax, dword [ebp - 0x18]
je 0x4627eb
push eax
call esi
test eax, eax
je 0x4627eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x486acc]
call esi
test eax, eax
je 0x462807
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x462809
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
leave
ret
Function at 0x10919c88
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10919c92
pushal
call 0x10919c98
pop ebp
sub ebp, 0x10
sub ebp, 0x919c88
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10919cbc
add dword [edi], ecx
test byte [edi], al
add byte [eax], al
add byte [ecx + 0x33], ah
rol byte [eax - 0x3e], 0xc
add cl, ch
add al, 0
add byte [eax], al
xlatb
sahf
mov ah, 0x49
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10919cc5
mov eax, 0x919c88
add eax, ebp
add eax, 0x63
mov ecx, 0x5a9
mov edx, 0xfeb5c71d
xor byte [eax], dl
inc eax
dec ecx
jne 0x10919cdc
jmp 0x10919cef
xchg esi, eax
rcl byte [esi + 0x1d1d2194]
sbb eax, 0x1de5dc9c
sbb eax, 0xa5d01e1d
sbb dword [0x35a71d1d], ebx
sbb eax, 0xffea1d1d
push ds
aad 0x96
pushfd
adc dword [0xd81e1d1d], ebx
nop
jns 0x10919d51
loope 0x10919cae
sbb dword [ecx], edi
dec ebp
jne 0x10919d58
mov ah, 2
sbb eax, 0x6cee7f75
sbb eax, 0x7539311c
sbb edi, esp
fbstp tbyte [ecx]
cmc
sbb byte [0x33f41d1d], bl
sbb eax, 0x79901d1d
cmp ecx, esp
xchg esp, eax
xor dword [ecx], edi
dec ecx
inc eax
xchg esi, eax
cwde
adc eax, 0x961d1d1d
mov byte [ecx], dl
sbb eax, 0x90961d1d
or eax, 0xdc1d1d1d
hlt
sbb eax, 0xf4dc1d1d
pop ds
sub al, 0x1f
pop ds
sahf
fistp word [ecx]
push esp
adc bl, byte [eax - 0x1d1d1d17]
inc eax
fist word [ecx]
sbb eax, 0x19399196
sbb eax, 0x39751d1d
mov ah, 2
sbb eax, 0x6cee7f75
sbb eax, 0x4c39311c
cmc
sbb byte [0x22f41d1d], bl
pop ds
sbb eax, 0x3979901d
loope 0x10919d1f
xor dword [ecx], edi
xchg esi, eax
int1
loop 0x10919df9
adc edx, esp
push 0x1d71f515
sbb eax, 0x15a0961d
sbb eax, 0xd42e1d1d
iretd
hlt
and al, 0x1c
sahf
sbb al, 0x9e
fcomp qword [eax]
sahf
cmc
sbb esp, esi
mov al, byte [0x34e2e2e2]
dec ecx
and al, 0x1f
sahf
fcomp qword [ebx]
sahf
neg dword [ecx]
sahf
cmc
sbb ah, dh
mov dh, 0xe2
loop 0x10919dde
loop 0x10919ddd
loop 0x10919d93
xchg esi, eax
xor dword [ecx], edi
nop
jns 0x10919e3b
sbb edi, ebx
adc dword [0x4bf19648], ebx
dec edx
dec eax
xchg esi, eax
push 0x15609611
loope 0x10919dc3
popfd
xchg edi, eax
sbb ebx, dword [ebx + ebx*8 + 0x1d1d1d1c]
xchg ebp, eax
sbb bl, byte [edx + ebx*8 + 0x1d1d1d1c]
cmpsb byte [esi], byte es:[edi]
pop ds
pushfd
ficomp dword [ebx + 0x1fa61d1d]
sbb eax, 0xcf1f1d1d
adc bl, byte [eax + 0x1d1d1d18]
xchg edi, eax
or ebx, dword [ebx + 0xf]
iretd
loop 0x10919e1f
pop ds
iretd
Function at 0x521cb5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebp, 0xe3c64246
call fcn.005224e8
aas
movsd dword es:[edi], dword [esi]
xor eax, 0x546baf5c
pop word [esp + 3]
jmp 0x521cc0
lea esp, [esp + 1]
pop word [esp]
push word [esp]
push ecx
jmp 0x521ced
push word [esp + 5]
lea esp, [esp + 6]
pushfd
mov word [esp + 1], ax
lea esp, [esp + 1]
mov dword [esp + 0x5c], edi
jmp 0x5232d7
lea esi, [esp]
mov bx, 0xbdae
mov al, byte [esp]
neg ah
jmp 0x521d58
jmp 0x521d2a
mov edi, esp
rcr bh, 6
ja 0x521d90
rdtsc
jmp 0x521d7a
jne 0x521d6f
mov edi, dword [esp]
jmp 0x521d72
mov edi, dword [esp]
sub esp, 0xc0
jmp 0x521d42
shr cx, cl
xchg ebx, eax
jmp 0x521d97
rdtsc
shr cx, cl
xchg ebx, eax
mov edx, ebp
add ah, 0xf9
jl 0x521db8
lea ecx, [ebp*4]
mov al, byte [esp]
mov ax, word [esp]
jmp 0x521b04
jmp 0x521e3e
mov ebp, dword [esp + 0x28]
mov bx, word [esp]
rdtsc
mov ch, 0xad
clc
ja 0x521d40
jbe 0x521d2a
neg ch
mov bx, word [esp]
call fcn.00521e1f
invalid
lea ecx, [ebp*4]
mov al, byte [esp]
mov ax, word [esp]
call fcn.00521dbd
cld
clc
push dword [esp + 0x14]
ret 0x18
xchg ch, dh
cpuid
lea edi, [ebx*4]
jmp 0x523290
xchg ch, dh
cpuid
lea edi, [ebx*4]
jmp 0x521dd8
lea esp, [esp + 0x5c]
pushfd
rol cl, 5
jl 0x523285
jge 0x521e83

Function at 0x52335d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
add esp, 1
call fcn.00523334
stc
jmp 0x5233e4
push esi
push edi
push ecx
jmp 0x523379
mov esi, eax
jmp 0x5233b9
add byte [ebp + 0x248d2424], cl
and al, 0xe9
pop edx
invalid
mov ebp, ebx
jmp 0x5233c6
pop ds
jl 0x5233a0
add dh, cl
dec esp
jp 0x523397
jle 0x5233ca
call 0x2786b8e3
dec esi
fnstcw word [eax]
pushal
neg ebp
jo 0x5233a3
mov ebp, ebx
jmp 0x5233fe
rdtsc
mov dword [esp], ebx
and al, 0xe8
sbb byte [eax], al
add byte [eax], al
call 0x5233e8
pop esi
rol dword [ebx + 0x26], cl
aad 0x62
les edx, [edx + ecx*8 - 0x53]
pop esp
lahf
push edx
rcl dword [ecx + 0x30], 0xc3
jle 0x5233a6
jp 0x52345b
jbe 0x523370
mov dh, byte [edi - 0x78]
ja 0x523370
push word [esp + 1]
mov word [esp + 2], bp
lea esp, [esp + 2]
jmp 0x523405
rdtsc
mov dword [esp], ebx
jmp 0x5233cb
lea esp, [esp + 4]
popal
jmp 0x52355a
popfd
jmp fcn.00521f09
salc
inc esp
and ebx, esi
insb byte es:[edi], dx
invalid
pop ecx
pop edi
pop esi
jmp 0x523439
mov ecx, ecx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x523465
Function at 0x541e4c
Capabilities:
Encrypt data using speck

Disassembly:
cmp ecx, eax
call fcn.00541e8c
rol dword [eax + reloc.mscoree.dll__CorExeMain], 0x9c
popfd
popal
cmp esi, ebp
mov edi, 0x5657247b
jae 0x514f73
lea edx, [esp + 0xb0]
mov dh, 0x9a
pushal
jmp 0x541ebd
pop word [esp]
lea esp, [esp + 2]
jmp 0x541e36
lea esp, [esp + 0x20]
lea edx, [ecx + 0x47]
jmp 0x514f89

Function at 0x61df91
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 2
btc ebx, ebx
inc al
neg bh
sub esp, 0x13
jmp 0x61df96
bsr ebp, edi
jmp 0x61df7b
mov dword [esp + 0xb], esi
mov ebp, 0xa7244b25
mov si, 0xd3de
lea esp, [esp + 0xf]
cpuid
add esp, 0xb
jmp 0x61dfe8
mov ecx, edx
mov di, word [esp + 2]
rdtsc
xchg byte [esp], dl
xchg edx, edi
mov dl, 0xd3
jmp 0x61dfd2

Function at 0x61e112
Capabilities:
Execute anti-debugging instructions

Disassembly:
sets cl
lea esp, [esp + 0xd]
pop di
bsr si, bp
push ax
mov dl, 0x85
jmp 0x61e0fc

Function at 0x61ea4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
lea ebx, [ecx + esi]
not ah
xchg bx, si
lea esp, [esp + 3]
setne dh
jmp 0x61ea6a
rdtsc
add esp, 0x39
jmp 0x61ea27
xchg bx, dx
lea esp, [esp + 1]
inc esi
neg ecx
mov byte [esp], dl
jmp 0x61eaa6
setne bl
mov ax, word [esp + 1]
mov ebx, edx
xchg edi, ebp
lea esp, [esp]
cpuid
jmp 0x61ea54
neg dx
not ecx
mov dl, bh
mov bp, si
mov ebx, dword [esp]
xchg byte [esp], bh
jmp 0x61eaba
mov dx, word [esp]
mov di, dx
clc
lea edi, reloc.mscoree.dll__CorExeMain
dec bh
mov bh, 0xcf
jmp 0x61ea90
push di
cpuid
rdtsc
push bx
cld
not cl
jmp 0x61eae1

Function at 0x61ec0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
mov al, dh
rdtsc
xchg di, bp
dec ax
mov ecx, dword [esp + 6]
jmp 0x61ebc0
mov dx, 0xe8e2
bts cx, bp
mov cl, 0xad
sete al
cpuid
setnp dl
jmp 0x61eb1b
mov ecx, eax
mov edi, 0x7c3b8ee7
bswap edi
mov word [esp + 3], bp
lea ecx, [edi*4]
lea esi, reloc.mscoree.dll__CorExeMain
jmp 0x61eb31
add esp, 2
rdtsc
push edx
call fcn.0061eb98
out dx, eax
invalid
mov dl, 0xd3
bswap ebp
bsf ebp, esi
lea eax, [esi + edi]
mov word [esp + 1], cx
cpuid
jmp 0x61eb6f
neg edx
xchg dh, bl
mov word [esp + 3], dx
add esp, 3
mov dl, 0xd0
mov si, bp
jmp 0x61eb85
mov edx, edi
pop word [esp + 2]
xchg byte [esp + 1], dh
jmp 0x61eb52
Function at 0x6208aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], cx
lea esp, [esp + 8]
call 0x6208aa
clc
mov word [esp], di
jmp 0x6208f4
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp], eax
lea eax, [ecx + edi]
jmp 0x620942
add esp, 1
lea esp, [esp + 1]
mov word [esp], dx
push edx
stc
push edx
jmp 0x6208de
mov ax, 0xe232
xor edx, 0xd647ec5f
pushfd
bswap eax
sub esp, 0x1a
jmp 0x6209bc
mov ax, 0xfd63
mov ah, cl
inc ah
and ax, di
push edx
bsf eax, esi
jmp 0x62092c
bswap edx
mov dx, word [esp]
mov ax, di
mov edx, esp
mov dx, 0x743d
jmp 0x62099b
inc dh
push bx
mov dh, 0x8d
rdtsc
stc
setle al
jmp 0x620977
not dx
pop di
neg dx
neg dh
rdtsc
xchg dh, al
jmp 0x6209cf
ror eax, cl
lea esp, [esp + 2]
mov dword [esp + 6], edi
sete dh
cmc
mov eax, dword [esp]
jmp 0x62098d
mov al, byte [esp]
xchg di, ax
mov edx, eax
pushfd
lea esp, [esp + 3]
bts ax, si
jmp 0x620c02
mov dh, dl
xchg dl, dh
stc
xchg byte [esp], dh
sub esp, 0x1f
jmp 0x620a9b
lea edi, [ebx + esi]
dec ah
push ebx
mov ah, bh
pop edi
mov dh, 0xb5
jmp 0x620a00
mov word [esp], sp
cld
mov di, word [esp + 1]
mov di, word [esp + 4]
jmp 0x620a5d
inc dl
bswap edi
pushfd
setle dh
cmp dh, ch
xchg dl, dh
jmp 0x620a23
not ax
xchg byte [esp], dh
rcr dl, 5
lea edx, reloc.mscoree.dll__CorExeMain
jmp 0x620a71
add esp, 2
xchg dword [esp], edi
mov dh, bl
btr di, cx
pop di
rcl di, 0xa
jmp 0x620a47
xchg edx, edi
mov eax, 0xeaa65651
mov edi, 0x15029917
mov dh, byte [esp + 2]
mov edi, 0xfd692100
lea esp, [esp + 2]
jmp 0x620b2a
lea edx, [ecx*4]
lea esp, [esp + 0x1d]
mov dh, ah
mov dx, cx
bsr di, di
rcl di, 2
jmp 0x620a39
mov dh, 0x9e
call fcn.00620ab5
mov dh, bl
mov edi, ebp
xchg dword [esp + 4], edi
push dword [esp + 5]
pushfd
or dh, 0x46
jmp 0x620b13
mov dh, 0xa5
seto dl
add esp, 6
pop ax
lea esp, [esp]
add esp, 2
jmp 0x620b81
pop eax
lea edx, reloc.mscoree.dll__CorExeMain
mov di, 0xceee
pop word [esp]
cld
jmp 0x620afd
mov byte [esp], dl
xchg dh, al
bsr ax, sp
mov dh, ah
lea edx, [ebx*4]
rdtsc
jmp 0x620acb
mov dh, bl
rcl ax, cl
call fcn.00620bbf
ja 0x620b47
add byte [eax], al
add byte [edi - 5], dh
imul ecx, dword [esi], reloc.mscoree.dll__CorExeMain
das
pop esi
test eax, 0x3d826bc8
not dh
mov dh, byte [esp]
bsf dx, cx
xchg di, ax
mov dx, ax
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0x620b40
btr di, cx
inc ax
mov edx, esp
bswap edi
not edi
inc dx
jmp 0x620b56
mov ax, 0x5fd4
xchg byte [esp], dl
add esp, 0
mov edx, ecx
mov edx, 0x1a2dff7b
neg edi
jmp 0x620a16

Function at 0x620c65
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 7]
ror di, cl
shl edi, cl
jmp 0x620c4f
Function at 0x62108b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edx + 0x32]
lea edx, [esi*4]
pop dx
xchg byte [esp + 0x13], ah
jmp 0x6210e9
xchg di, ax
shr di, 2
mov di, word [esp + 0x1d]
mov dh, 0x34
cmp edi, esp
jmp 0x621103
clc
cmc
pop edi
push dword [esp + 0x34]
setae dh
xchg dword [esp + 0x13], edi
jmp 0x6210b9
xchg byte [esp + 6], dh
bswap edi
shl di, 6
mov word [esp], dx
lea eax, reloc.mscoree.dll__CorExeMain
push dword [esp + 0x38]
jmp 0x6210cf
mov eax, esi
mov dx, word [esp + 0x24]
bsf dx, bx
sub esp, 0x12
lea esp, [esp + 0x52]
bts di, sp
jmp 0x621190
mov dh, cl
not dh
mov ax, word [esp + 1]
push dword [esp + 5]
mov dx, di
xchg edi, eax
jmp 0x621174
add esp, 3
xchg dword [esp], eax
mov byte [esp + 8], cl
pop edi
rcr ax, 8
mov dh, ah
jmp 0x62114a
mov edi, esi
rdtsc
push dword [esp + 6]
pop word [esp + 8]
pop dword [esp + 4]
rdtsc
jmp 0x6211b6
mov di, dx
cld
rdtsc
btr ax, dx
clc
sub esp, 0xe
jmp 0x621161
rdtsc
mov edi, dword [esp + 3]
mov dh, al
xchg byte [esp + 2], dh
pop word [esp]
call fcn.006211a0
stc
mov ah, byte [esp]
xchg word [esp + 4], ax
pop word [esp + 6]
mov word [esp + 5], di
lea edi, reloc.mscoree.dll__CorExeMain
jmp 0x62121c
push word [esp + 2]
mov dh, ah
lea edi, [edi*4]
jmp 0x621301
xchg dx, ax
push word [esp + 5]
mov word [esp + 5], bx
rdtsc
lea edx, [esi*4]
lea edi, [eax + ebp]
jmp 0x621206
xchg word [esp + 2], di
inc dh
push dword [esp + 5]
pop di
call fcn.0062128c
mov eax, dword [esp + 1]
pop dx
xchg byte [esp], dh
mov dl, byte [esp]
xchg dh, ah
neg eax
jmp 0x62138c
sub esp, 0x1c
lea esp, [esp + 0x4a]
stc
mov edx, dword [esp]
lea edi, [ebp + ebp]
jmp 0x62136e
not ax
mov dx, bx
xchg byte [esp + 0xc], dh
pushal
bsr eax, ecx
mov dh, bh
jmp 0x621346
bts eax, ebx
bsr di, cx
mov edx, 0x87749e8d
sub esp, 0x1b
lea esp, [esp + 0x19]
lea esp, [esp]
jmp 0x6213b4
pushfd
xchg word [esp + 2], dx
mov dword [esp + 2], ecx
mov dh, 0x64
rcr dh, 2
pushfd
jmp 0x62135c
lea edi, reloc.mscoree.dll__CorExeMain
sete dh
lea edx, [eax*4]
jmp 0x62142b
setle al
rcr al, 1
mov edi, 0x6b039a2
not dh
mov word [esp], sp
jmp 0x62139e
lea esp, [esp + 1]
cmc
call fcn.006213f6
mov word [esp + 0x10], ax
pop edi
mov word [esp + 0x16], si
mov ax, word [esp + 0x11]
jmp 0x621575
push dword [esp + 1]
bsr ax, bp
neg edi
pop di
bswap edi
mov byte [esp + 6], dh
call fcn.00621497
bsr ax, cx
mov word [esp + 5], bp
bswap eax
pop dword [esp + 0xa]
jmp 0x621556
add dh, bl
setp dh
setge ah
xchg edi, eax
bswap eax
pop dword [esp + 8]
jmp 0x62167c
push dword [esp + 0xd]
mov edx, dword [esp + 0x16]
add esp, 0xa
xchg byte [esp + 0xd], al
mov edi, dword [esp + 0xa]
xchg ah, dl
jmp 0x621513
ror dx, 0xb
mov dx, bp
lea edi, [eax + edx]
xchg word [esp + 2], di
call fcn.006215a8
pop word [esp + 0x13]
mov ax, word [esp + 3]
sub esp, 0x1d
bsr dx, sp
jmp 0x621661
mov byte [esp + 0xd], dh
call fcn.006216d5
mov ss, word [0x9a1fec85]
sbb byte [esi + 0x98e7314], al
mov bh, 0x9e
jmp 0xf924c185
clc
lea eax, [ebp*4]
bsr di, bp
dec ax
add esp, 0xc
bswap eax
jmp 0x621621

Function at 0x6212bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr edx, ebx
mov eax, ebp
mov edi, eax
jmp 0x6212e7
Function at 0x62189b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 1]
inc al
mov ah, byte [esp]
jmp 0x62190f
mov ah, 0x5a
not dx
rdtsc
xchg byte [esp + 0x23], dh
mov byte [esp + 0x26], ch
jmp 0x621ad9
rdtsc
xchg word [esp], di
bswap edi
neg eax
mov dx, 0xc02
pushal
jmp 0x6218e0
or edx, esp
push word [esp + 4]
cld
neg ah
xchg edi, eax
bsf edx, esi
jmp 0x6218f6
push dword [esp + 2]
mov dh, 0x54
mov byte [esp + 0x21], dh
sub esp, 6
stc
pop word [esp + 0x1d]
call fcn.00621975
adc edx, 0xb3231585
cmc
lea edi, [esp + 0x64]
sub esp, 0x1b
jmp 0x621a7c
rdtsc
xchg byte [esp + 4], al
call fcn.00621aaa
xchg edi, eax
pop es
xchg edi, eax
add dword [edx + reloc.mscoree.dll__CorExeMain], edi
push ds
push word [esp + 4]
xchg edi, eax
bswap edi
pop word [esp + 0x13]
mov dh, 0xec
push dword [esp + 0x1a]
jmp 0x621a66
mov edi, dword [esp + 0xb]
mov word [esp + 3], ax
bts di, cx
setno al
mov dword [esp + 0x20], esp
xchg byte [esp + 0xc], al
jmp 0x621a20

Function at 0x62195d
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl dh, 4
not di
lea edi, [ecx*4]
mov di, 0xfec9
jmp 0x6219db
rdtsc
sub esp, 3
pop word [esp]
rcl dx, 0xb
mov dh, byte [esp]
jmp 0x6219b9
adc dx, 0xa394
add esp, 0x3f
cmc
mov di, word [esp]
lea edi, [eax + ecx]
bsr di, si
jmp 0x621977
mov byte [esp], al
adc di, bp
rdtsc
mov di, 0xeb2c
lea eax, [ecx + ebx]
jmp 0x621a06
mov word [esp], dx
lea edx, reloc.mscoree.dll__CorExeMain
setp dh
xchg edi, eax
mov byte [esp], bl
mov ah, ch
jmp 0x6219a3
xchg di, ax
mov byte [esp + 0x20], al
mov eax, 0xa753fea3
pop di
setbe dh
sub esp, 0x1d
jmp 0x62198d
mov al, 0x75
stc
inc ax
mov ax, bp
mov di, 0x3a7a
xchg di, dx
jmp 0x621a4e
pop ax
inc eax
mov edx, ebp
lea edx, [ecx + esi]
xchg ah, dl
mov dh, 0xe4
jmp 0x6219f0
xchg dx, di
lea edx, reloc.mscoree.dll__CorExeMain
rdtsc
mov di, word [esp]
bsr ax, cx
xchg di, ax
jmp 0x621a38
Function at 0x621d79
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x61e039
call fcn.0061e03e
movzx ebx, word [eax + 0x3c]
jmp 0x621f54
call 0x62003e
jmp 0x621efd
pop dword [esp + 1]
jmp 0x621d9b
push word [esp + 9]
mov dword [esp + 0x28], esp
call 0x621daa
outsb dx, byte [esi]
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp]
jmp 0x621dcf
mov byte [esp], cl
pushal
pop word [esp + 0x13]
mov dword [esp + 0x11], ebx
mov word [esp + 4], dx
mov byte [esp + 1], bl
jmp 0x621e68
mov dword [esp + 4], ebp
lea esp, [esp + 3]
mov dword [esp + 0x40], ebp
call fcn.00621e30
mov dword [esp + 0x40], esi
pushal
push word [esp + 8]
mov dword [esp + 0xd], esp
mov byte [esp + 0x13], ah
mov byte [esp + 0x10], cl
jmp 0x621ee5
mov eax, dword [eax + 0x1c]
jmp 0x621f13
mov eax, dword [eax + 0xc]
jmp 0x621eb8
push dword [esp + 0x1e]
lea esp, [esp + 2]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
mov eax, dword fs:[0x30]
jmp 0x621ece
pop eax
jmp 0x621f1e
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x620039
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x621f3e
je 0x62000e
sub eax, 0x10000
jmp 0x621f21
add ebx, eax
cmp word [ebx], 0x4550
fsub dword [esi - 0x7f]
cmp edx, dword [eax + 0x45]
je 0x61dbe6
jne 0x621f44
int1
jg 0x621f55
mov bh, byte [ecx + 0x53]
fst dword [eax - 0x3a]
mov eax, dword [reloc.mscoree.dll__CorExeMain]
pop ebp
and al, 0xd7
cmp edx, ecx
pop esi
int3

Function at 0x621d91
Capabilities:
Parse pe header

Disassembly:
push word [esp + 3]
call fcn.00621d79

Function at 0x621daa
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x61e039
call fcn.0061e03e
movzx ebx, word [eax + 0x3c]
jmp 0x621f54
call 0x62003e
jmp 0x621efd
pop dword [esp + 1]
jmp 0x621d9b
push word [esp + 9]
mov dword [esp + 0x28], esp
call 0x621daa
outsb dx, byte [esi]
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp]
jmp 0x621dcf
mov byte [esp], cl
pushal
pop word [esp + 0x13]
mov dword [esp + 0x11], ebx
mov word [esp + 4], dx
mov byte [esp + 1], bl
jmp 0x621e68
mov dword [esp + 4], ebp
lea esp, [esp + 3]
mov dword [esp + 0x40], ebp
call fcn.00621e30
mov dword [esp + 0x40], esi
pushal
push word [esp + 8]
mov dword [esp + 0xd], esp
mov byte [esp + 0x13], ah
mov byte [esp + 0x10], cl
jmp 0x621ee5
mov eax, dword [eax + 0x1c]
jmp 0x621f13
mov eax, dword [eax + 0xc]
jmp 0x621eb8
push dword [esp + 0x1e]
lea esp, [esp + 2]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
mov eax, dword fs:[0x30]
jmp 0x621ece
pop eax
jmp 0x621f1e
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x620039
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x621f3e
je 0x62000e
sub eax, 0x10000
jmp 0x621f21
add ebx, eax
cmp word [ebx], 0x4550
fsub dword [esi - 0x7f]
cmp edx, dword [eax + 0x45]
je 0x61dbe6
jne 0x621f44
int1
jg 0x621f55
mov bh, byte [ecx + 0x53]
fst dword [eax - 0x3a]
mov eax, dword [reloc.mscoree.dll__CorExeMain]
pop ebp
and al, 0xd7
cmp edx, ecx
pop esi
int3

Function at 0x621dc3
Capabilities:
Parse pe header

Disassembly:
pop dword [esp + 3]
pop dword [esp]
call fcn.00621d91
Function at 0x621e50
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
push ebp
pushal
lea esp, [esp + 0x4b]
call fcn.00621e3a
fild word [ebp - 0x2b]
mov esp, 0xf66ffa4f
add edi, esi
jns 0x621ecf
inc eax
or al, 0xeb
in eax, 0xb8
cmp byte [esi - 0x6926c737], ch
adc eax, 0xff1fec85
add al, 0xb7
sahf
jmp 0x7561c9ef