joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462449
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49ba2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebp
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.btkPtcMsgTransport.3.0
mov dword [esi + 4], vtable.btkPtcMsgTransport.2.0
mov dword [esi + 8], vtable.btkPtcMsgTransport.1.0
mov dword [esi + 0xc], vtable.btkPtcMsgTransport.0
mov dword [esp + 0x38], 0
push 0
lea ebp, [esi + 0x28]
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], 0x4a4ac8
mov dword [esp + 0x34], vtable.btkIterator.0
call fcn.0045e190
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], vtable.btkMap_void_const___struct_btkPtcMsgTransport::ConsumerInfo__::Iter.1.0
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x14], vtable.btkMap_void_const___struct_btkPtcMsgTransport::ConsumerInfo__::Iter.0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x18]
mov dword [esp + eax + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx]
mov byte [esp + 0x38], 2
call eax
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x462513
push edi
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov edi, dword [eax + 4]
test edi, edi
je 0x4624f8
mov ecx, edi
call fcn.0045f150
push edi
call fcn.00466620
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x4624d6
pop edi
mov ecx, ebp
mov dword [esp + 0xc], vtable.btkIterBase_struct_btkPtcMsgTransport::ConsumerInfo__.0
mov byte [esp + 0x38], 0
call fcn.004220e0
lea ecx, [esi + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.0042d300
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret

Function at 0x466500
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x46650d
mov eax, 1
mov dword [esp + 4], eax
jmp fcn.00478880
Function at 0x4674b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], 1
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
push edi
mov edi, dword [esp + 0xc]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], 1
mov dword [esi + 4], esi
cmp edi, eax
je 0x46754f
lea ecx, [edi + 0x18]
mov dword [esi + 8], edi
call fcn.004766b0
mov dword [esi + 0x10], eax
movzx eax, byte [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x24], ecx
or dword [esi + 0xc], 0x40000000
pop edi
mov eax, esi
pop esi
ret 4
mov dword [esi + 8], esi
mov dword [esi + 0xc], bind
call sub.KERNEL32.dll_GetCurrentThreadId
push str.NOINTERACT
mov dword [esi + 0x24], eax
call fcn.0040c972
add esp, 4
test eax, eax
je 0x467541
or dword [esi + 0xc], 0x40000001
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x467cb0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [0x4be408]
push eax
call fcn.00467080
mov ecx, dword [0x4d36a0]
mov edx, dword [ecx + 8]
add esp, 4
cmp dword [edx], 1
mov dword [0x4be408], 0xffffffff
jl 0x467dfa
push ebp
push esi
call fcn.00476870
mov esi, eax
mov eax, dword [0x4d36a0]
mov ebp, dword [eax + 8]
lea ecx, [ebp + 0x84]
call fcn.004766c0
test eax, eax
jne 0x467d60
mov ecx, dword [0x4d36a4]
mov byte [ecx + 8], 1
mov edx, dword [0x4d36a8]
mov byte [edx + 8], 1
mov eax, dword [0x4d36ac]
mov byte [eax], 1
test esi, esi
je 0x467d23
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ecx, dword [0x4d36ac]
mov edx, dword [ecx + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x467d3e
call fcn.00476f50
push str.LIBCTX
call fcn.00465b60
mov eax, dword [0x4d36a0]
mov ecx, dword [eax + 8]
add esp, 4
test ecx, ecx
je 0x467d6d
push 1
call fcn.00467ac0
jmp 0x467d6d
test esi, esi
je 0x467d6d
push 0xffffffffffffffff
mov ecx, esi
call fcn.00476a30
mov ecx, dword [0x4d36a4]
mov esi, ecx
test ecx, ecx
je 0x467d87
call fcn.00476c80
push esi
call fcn.00476dd0
add esp, 4
mov ecx, dword [0x4d36a8]
mov dword [0x4d36a4], 0
mov esi, ecx
test ecx, ecx
je 0x467dab
call fcn.00476c80
push esi
call fcn.00476dd0
add esp, 4
mov ecx, dword [0x4d36ac]
mov dword [0x4d36a8], 0
mov esi, ecx
test ecx, ecx
je 0x467dcf
call fcn.00476f20
push esi
call fcn.00476dd0
add esp, 4
mov ecx, dword [0x4d36a0]
pop esi
cmp ecx, ebp
mov dword [0x4d36ac], 0
pop ebp
je 0x467df0
test ecx, ecx
je 0x467df0
push 1
call fcn.00467ac0
mov dword [0x4d36a0], 0
ret
Function at 0x476fe0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x49bd1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0x5c
call fcn.00466560
add esp, 4
mov dword [esp + 4], eax
xor esi, esi
mov dword [esp + 0x10], esi
cmp eax, esi
je 0x47701d
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, eax
call fcn.00476800
mov esi, eax
mov edx, dword [0x4d36ac]
mov eax, dword [edx + 4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x477290
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4d36ac]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4772a9
mov eax, 0x21
ret
cmp dword [esp + 0xc], 0
jne 0x4772c3
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push edx
push ecx
lea ecx, [eax + 0x20]
call fcn.00466810
ret
push 0
mov ecx, eax
call fcn.00477040
test eax, eax
je 0x4772a3
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push edx
push ecx
lea ecx, [eax + 0xc]
call fcn.00466810
ret
Function at 0x4861aa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4861db
call fcn.00402ce8
mov dword [eax], esi
call fcn.00402cd5
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00402c5d
add esp, 0x14
push 0x16
pop eax
jmp 0x486230
test dword [ebp + 0xc], 0xfffffff9
jne 0x4861b7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x486208
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402cfb
pop ecx
call fcn.00402cd5
mov eax, dword [eax]
jmp 0x486230
test al, 0x10
jne 0x48622e
test al, 1
je 0x48622e
test byte [ebp + 0xc], 2
je 0x48622e
call fcn.00402ce8
mov dword [eax], 5
call fcn.00402cd5
mov dword [eax], 0xd
jmp 0x4861ff
xor eax, eax
pop esi
pop ebp
ret

Function at 0x488634
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x488665
call fcn.00402ce8
mov dword [eax], esi
call fcn.00402cd5
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00402c5d
add esp, 0x14
push 0x16
pop eax
jmp 0x4886ba
test dword [ebp + 0xc], 0xfffffff9
jne 0x488641
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x488692
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402cfb
pop ecx
call fcn.00402cd5
mov eax, dword [eax]
jmp 0x4886ba
test al, 0x10
jne 0x4886b8
test al, 1
je 0x4886b8
test byte [ebp + 0xc], 2
je 0x4886b8
call fcn.00402ce8
mov dword [eax], 5
call fcn.00402cd5
mov dword [eax], 0xd
jmp 0x488689
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40bf90
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4012b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x64
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401208
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x40c018
mov dword [ebp - 4], 4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00403934
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 6
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x40c178
mov dword [ebp - 4], 7
call fcn.00403a10
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x60]
push ecx
push 0x28
mov edx, dword [ebp - 0x64]
push edx
call fcn.00403a5c
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov dword [ebp - 4], 9
lea eax, [ebp - 0x40]
push eax
push 0x403df4
lea ecx, [ebp - 0x6c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0x4025ac
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
call fcn.00403aac
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x68]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0xb
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x30]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x28], 2
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x50]
push edx
push 0x10
lea eax, [ebp - 0x34]
push eax
push 0
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.00403afc
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov dword [ebp - 4], 0xe
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
push 1
call fcn.00403b40
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x5c], 0
je 0x40c178
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.00403b8c
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor ecx, ecx
cmp dword [ebp - 0x70], 0
setne cl
neg ecx
mov word [ebp - 0x38], cx
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x5c]
push edx
call fcn.00402d0c
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov dword [ebp - 4], 0x14
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
push 0x40c1a3
jmp 0x40c1a2
ret
Function at 0xce9124
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
jmp 0xce9161
mov ebx, 0xc4ccf7f4
inc edx
jnp 0xce910e
jp 0xce9199
call 0x776a8da1
inc ecx
cli
adc dword [ebx], 0x76
test dword [esi + eax*8 - reloc.mscoree.dll__CorExeMain], edi
add byte [eax], al
add byte [edx + 0x6ae82414], cl
add byte [eax], al
add byte [eax - 0x76], dh
mov dl, byte [esp]
call 0xce91b4
jo 0xce90d6
mov dl, byte [esp]
adc al, 0x24
jmp 0xce916e
mov ebx, esi
lea edx, [esi + edi]
btr dx, si
jns 0xce9142
js 0xce914b
lea eax, [esi + 0x40]
mov dx, word [esp]
jmp 0xce917b
or edx, 0x36a01ede
jae 0xce9240
sub dl, dh
jmp 0xce9242
add esp, 0
jmp 0xce9161
or edx, 0x4d0195ba
jle 0xce9365
bsf dx, si
jmp 0xce9275
sub dl, dh
sub eax, ebx
jmp 0xce922a
je 0xce925c
lea esp, [esp + 3]
jmp 0xce92c0
lea esp, [esp + 3]
jmp 0xce92c0
bsf edx, ecx
or dx, 0x2903
jmp 0xce9371
and dl, 0xfc
sub edx, eax
call 0xce9298
mov esp, edx
pushfd
lea esi, [eax + edx - 0x40]
jmp 0xce92d7
sub esp, 0x13
jg 0xce931c
pop dword [esp + 4]
jmp 0xce92fb
mov byte [esp + 2], dl
push word [esp + 3]
lea esp, [esp + 1]
jmp 0xce934d
pop dword [esp + 4]
mov byte [esp + 2], dl
push word [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0xc], esi
stc
lea esp, [esp + 0xc]
push edi
jmp 0xce9393
mov dword [esp + 0xc], esi
jmp 0xce9331
bsf dx, si
bsf edx, ecx
or dx, 0x2903
lea edx, [ebp - 0x80]
sub esp, 3
jmp 0xce9246
setno ch
cmc
jbe 0xce941d
mov ecx, edi
jmp 0xce93c7
push ecx
mov esi, ebx
pushal
push sp
jmp 0xce937c
popal
jmp 0xce9428
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
jmp 0xce93e7
lea esp, [esp + 2]
mov dword [esp], edx
stc
jmp 0xce939b
pop esi
popfd
jmp 0xce93a7
mov ecx, edi
lea esp, [esp + 2]
mov dword [esp], edx
stc
popal
mov ecx, eax
cld
jmp 0xce93a1
Function at 0xcede88
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xcedeac
ror eax, cl
jle 0xcede67
jg 0xcedeac
rcl byte [edi - 0x39]
mov byte [0xe54a3e51], al
mov edx, esi
jmp 0xcedeae
jmp 0xcede96
add edx, reloc.mscoree.dll__CorExeMain
jg 0xcef585
movzx ebx, byte [edx]
jmp 0xceee06
sldt word [eax]
dec ecx
sub edx, 0x25021da
jmp 0xcedee4
mov dword [esp], ebx
sub bl, cl
xchg edx, eax
call 0xcedec3
je 0xcedefa
xchg word [esp], ax
jmp 0xcedefe
xchg word [esp], ax
mov al, bl
lea edx, reloc.mscoree.dll__CorExeMain
call fcn.00cedfc6
loopne 0xcedebf
invalid
pushfd
sete al
jmp 0xceded9
neg dx
jge 0xcedf2a
pushfd
sete al
mov dword [esp], ebx
jmp 0xcededc
rdtsc
jmp 0xcef590
not edx
mov al, 0xad
bswap eax
jmp 0xcee730
movzx ebx, byte [edx]
not edx
mov al, 0xad
bswap eax
rdtsc
lea edx, [esi - 0xbf]
bswap edx
mov dx, word [esp]
mov ax, si
mov dl, 0x48
jmp 0xcee24b

Function at 0xd1ef2f
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
and dword [eax], 0
jmp 0xd1efb1
push dword [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0xd1ef19
mov dword [eax + 0x14], reloc.mscoree.dll__CorExeMain
mov dword [eax + 8], reloc.mscoree.dll__CorExeMain
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
jmp 0xd1ef6e
Function at 0xd5fafc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, eax
pushal
stc
dec dword [ebp]
pushfd
jmp 0xd5fafe
jmp 0xd5fae6
lea esp, [esp + 0x54]
jmp 0xd5fb30
jne 0xd5f9d0
mov dl, cl
pushal
lea ebx, [ebx*4]
jmp 0xd5fb1a

Function at 0xd5fb4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebx
call fcn.00d5fafc
mov dword [ebp], eax
rdtsc
jmp 0xd01d0a
add esp, 0
jbe 0xd5fb14
ja 0xd5fb14
sub al, byte [ebp - 0xc]
out 0xc3, eax
cwde
cmp eax, 0x1d3d4248
pop eax
jmp ebx

Function at 0xe71da9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], dx
push word [esp + 1]
jae 0xe71dc1
mov dword [esp], eax
jmp 0xe71dc4
jmp 0xe71d92
mov dword [esp], eax
call fcn.00e71dab
out dx, eax
imul edi, ecx, 0xfee6b98
mov bl, byte [eax]
jg fcn.00e71d5e
or eax, 0x4c7dc2ab
fisttp word [ecx - 0x17b7dbb4]
mov dword [esp + 0x48], ecx
invalid
mov bh, 0xfe
invalid

Function at 0xe71dab
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jmp 0xe71df9
jp 0xe71e40
mov dword [esp + 0x5c], esp
pushfd
jmp 0xe71de3
mov dword [esp + 0x5c], esp
pushfd
pop word [esp]
mov word [esp], cx
push edx

Function at 0xe71e23
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0xe71ea0
jmp 0xe71e54
lea esp, [esp + 2]
jmp 0xe71e92
mov dword [esp + 0x60], esi
push eax
push word [esp + 2]
ja 0xe71e25
lea esp, [esp + 2]
jmp 0xe71e7c
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0xe71e9a
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
pushfd
jmp 0xe7018d
mov edi, 0xfbc35b4d
jmp 0xe7293b
bts bx, bx
dec cx
jmp 0xe71f66
bts bx, bx
dec cx
sub esp, 0xc0
mov ebp, esp
rol ecx, cl
jge 0xe71f60
jl 0xe71ee0
lea edi, [esp]
xchg dx, ax
mov dx, bp
rdtsc
jmp 0xe72084
neg al
rdtsc
lea ebx, [esi*4]
jmp 0xe72119
jmp 0xe7250b
mov ah, 0xdb
lea edx, [ebx + ebx]
mov esi, dword [esp + 0x2c]
bsr bp, ax
jp 0xe72840
neg al
rdtsc
lea ebx, [esi*4]
jmp 0xe72119

Function at 0xe71e6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 7]
lea esp, [esp + 2]
mov dword [esp + 0x60], ebp
call fcn.00e71e23

Function at 0xe72216
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
jmp 0xe7225a
lea esp, [esp + 1]
xchg edx, eax
lea eax, [ebx + edi]
push si
xchg word [esp], ax
ja 0xe7221f
lea esp, [esp + 1]
xchg edx, eax
jmp 0xe72244
Function at 0xe7372b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xc6c00a
jmp 0xe73a66
mov ax, word [esp]
xor ax, 0x6bcf
inc ax
bswap eax
xor ax, bp
jmp 0xe73768
lea esp, [esp + 3]
lea esp, [esp + 8]
xor dl, 0x5d
btc ax, di
jmp 0xe7381c
bsf eax, ebx
jg 0xe73791
jle 0xe73791
mov byte [0x2ddebb2b], al
imul ecx, eax, 0x54a5c24c
rcr dword [ecx - 0x48], cl
wait
neg dl
mov eax, dword [esp]
xchg al, ah
lea eax, [edx + 0xd8]
mov ax, 0xc701
jmp 0xe73752
mov al, bh
sub esp, 2
lea esp, [esp + 3]
jmp 0xe737c1
neg dl
lea eax, reloc.mscoree.dll__CorExeMain
sub esp, 0x15
jmp 0xe737a2
jp 0xe7377b
mov al, bh
sub esp, 2
jmp 0xe737e1
inc ax
bswap eax
xor ax, bp
jmp 0xe73768
lea esp, [esp + 0x14]
sub dl, 0x85
mov ah, 0x60
xchg al, ah
mov ah, 0xee
jmp 0xe737fd
lea esp, [esp + 3]
jmp 0xe737c1
bswap eax
lea esp, [esp + 2]
jmp 0xe73f05
lea eax, reloc.mscoree.dll__CorExeMain
sub esp, 0xa
jle 0xe737e7
bswap eax
jmp 0xe73f3c
jns 0xe736f9
mov ax, word [esp]
xor ax, 0x6bcf
jmp 0xe737b8
mov dx, 0x6626
rdtsc
jmp 0xe738bf
jo 0xe738b4
bswap edx
mov edx, dword [esp]
jmp 0xe7382c
pushal
mov dword [esp + 3], ebp
jmp 0xe73886
inc ax
jle 0xe7384b
pushal
mov dword [esp + 3], ebp
lea edx, [ecx*4]
xchg ah, al
rdtsc
jmp 0xe73891
lea edx, [ecx*4]
xchg ah, al
rdtsc
call 0xe73897
leave
jmp 0xe738dc
setge dh
mov dx, 0xf566
bsr dx, bx
ja 0xe738c6
and dx, sp
call fcn.00e73953
push 0xac5d228b
mov edi, 0x148bca0f
and al, 0x66
mov edx, 0x310f6626
bswap edx
mov edx, dword [esp]
mov dx, 0x6626
rdtsc
xor bl, 0x3d
rdtsc
jmp 0xe73861
and dx, sp
jmp 0xe73906
lea esp, [esp + 0x24]
dec bl
mov dx, bp
lea eax, [edi*4]
xchg ah, dl
jmp 0xe73899
lea edx, [ebp*4]
jmp 0xe739da
ja 0xe739a1
ror dx, cl
jmp 0xe739a4
ror dx, cl
inc esi
sub eax, edx
jmp 0xe73842
add bl, 0xd7
setnp al
mov edx, 0x562c2bca
mov dl, byte [esp]
call fcn.00e73912
mov eax, edi
mov dx, word [esp]
mov word [esp], cx
lea edx, [ebx - 0xd0]
jmp 0xe73e82
mov eax, 0xff2ab5f2
mov ax, 0xbd0e
add cl, dl
lea eax, [eax - 0x11]
dec dx
jmp 0xe7392e
bsr eax, ebp
not ah
not ax
jmp 0xe73a33
shl edx, 2
mov ax, cx
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0xe70293
jmp 0xe73a25
mov eax, dword [esp]
mov ax, 0x2bd0
jmp 0xe73a97
mov ah, ch
mov eax, 0x7bc2fe16
jmp 0xe73a50
lea esp, [esp + 3]
mov edx, ebx
bsf eax, esp
jno 0xe73a4e
bsr eax, ebp
not ah
not ax
jmp 0xe73a33
mov edx, dword [edx + reloc.mscoree.dll__CorExeMain]
mov al, 0x61
call 0xe73aa6
bound ebx, qword [ebp - 0x376b17]
invalid
sub esp, 0x16
jmp 0xe73a82
not eax
mov dh, 0xea
sub esp, 0x1d
jle 0xe73abe
sub esp, 0x16
lea esp, [esp + 3]
jmp 0xe73a86
lea edx, [ecx*4]
lea esp, [esp + 3]
inc bl
jmp 0xe73d5b
lea esp, [esp + 8]
not dl
not ax
not ah
mov ax, word [esp]
jmp 0xe73a10
lea esp, [esp + 2]
jmp 0xe73f05
Function at 0xe73897
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xc6c00a
jmp 0xe73a66
mov ax, word [esp]
xor ax, 0x6bcf
inc ax
bswap eax
xor ax, bp
jmp 0xe73768
lea esp, [esp + 3]
lea esp, [esp + 8]
xor dl, 0x5d
btc ax, di
jmp 0xe7381c
bsf eax, ebx
jg 0xe73791
jle 0xe73791
mov byte [0x2ddebb2b], al
imul ecx, eax, 0x54a5c24c
rcr dword [ecx - 0x48], cl
wait
neg dl
mov eax, dword [esp]
xchg al, ah
lea eax, [edx + 0xd8]
mov ax, 0xc701
jmp 0xe73752
mov al, bh
sub esp, 2
lea esp, [esp + 3]
jmp 0xe737c1
neg dl
lea eax, reloc.mscoree.dll__CorExeMain
sub esp, 0x15
jmp 0xe737a2
jp 0xe7377b
mov al, bh
sub esp, 2
jmp 0xe737e1
inc ax
bswap eax
xor ax, bp
jmp 0xe73768
lea esp, [esp + 0x14]
sub dl, 0x85
mov ah, 0x60
xchg al, ah
mov ah, 0xee
jmp 0xe737fd
lea esp, [esp + 3]
jmp 0xe737c1
bswap eax
lea esp, [esp + 2]
jmp 0xe73f05
lea eax, reloc.mscoree.dll__CorExeMain
sub esp, 0xa
jle 0xe737e7
bswap eax
jmp 0xe73f3c
jns 0xe736f9
mov ax, word [esp]
xor ax, 0x6bcf
jmp 0xe737b8
mov dx, 0x6626
rdtsc
jmp 0xe738bf
jo 0xe738b4
bswap edx
mov edx, dword [esp]
jmp 0xe7382c
pushal
mov dword [esp + 3], ebp
jmp 0xe73886
inc ax
jle 0xe7384b
pushal
mov dword [esp + 3], ebp
lea edx, [ecx*4]
xchg ah, al
rdtsc
jmp 0xe73891
lea edx, [ecx*4]
xchg ah, al
rdtsc
call 0xe73897
leave
jmp 0xe738dc
setge dh
mov dx, 0xf566
bsr dx, bx
ja 0xe738c6
and dx, sp
call fcn.00e73953
push 0xac5d228b
mov edi, 0x148bca0f
and al, 0x66
mov edx, 0x310f6626
bswap edx
mov edx, dword [esp]
mov dx, 0x6626
rdtsc
xor bl, 0x3d
rdtsc
jmp 0xe73861
and dx, sp
jmp 0xe73906
lea esp, [esp + 0x24]
dec bl
mov dx, bp
lea eax, [edi*4]
xchg ah, dl
jmp 0xe73899
lea edx, [ebp*4]
jmp 0xe739da
ja 0xe739a1
ror dx, cl
jmp 0xe739a4
ror dx, cl
inc esi
sub eax, edx
jmp 0xe73842
add bl, 0xd7
setnp al
mov edx, 0x562c2bca
mov dl, byte [esp]
call fcn.00e73912
mov eax, edi
mov dx, word [esp]
mov word [esp], cx
lea edx, [ebx - 0xd0]
jmp 0xe73e82
mov eax, 0xff2ab5f2
mov ax, 0xbd0e
add cl, dl
lea eax, [eax - 0x11]
dec dx
jmp 0xe7392e
bsr eax, ebp
not ah
not ax
jmp 0xe73a33
shl edx, 2
mov ax, cx
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0xe70293
jmp 0xe73a25
mov eax, dword [esp]
mov ax, 0x2bd0
jmp 0xe73a97
mov ah, ch
mov eax, 0x7bc2fe16
jmp 0xe73a50
lea esp, [esp + 3]
mov edx, ebx
bsf eax, esp
jno 0xe73a4e
bsr eax, ebp
not ah
not ax
jmp 0xe73a33
mov edx, dword [edx + reloc.mscoree.dll__CorExeMain]
mov al, 0x61
call 0xe73aa6
bound ebx, qword [ebp - 0x376b17]
invalid
sub esp, 0x16
jmp 0xe73a82
not eax
mov dh, 0xea
sub esp, 0x1d
jle 0xe73abe
sub esp, 0x16
lea esp, [esp + 3]
jmp 0xe73a86
lea edx, [ecx*4]
lea esp, [esp + 3]
inc bl
jmp 0xe73d5b
lea esp, [esp + 8]
not dl
not ax
not ah
mov ax, word [esp]
jmp 0xe73a10
lea esp, [esp + 2]
jmp 0xe73f05