joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408822
Capabilities:
Connect pipe
Create pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x58c]
sub esp, 0x60c
mov eax, dword [0x41228c]
xor eax, ebp
mov dword [ebp + 0x588], eax
mov eax, dword [ebp + 0x594]
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
mov esi, 0x400
push ebx
push ebx
push esi
push esi
push 1
push 6
push 0x80003
push 0x40eda8
call dword [sym.imp.kernel32.dll_CreateNamedPipeA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40889b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 5
je 0x408865
cmp eax, 0xe7
je 0x408865
jmp 0x4089a6
push ebx
push edi
call dword [sym.imp.kernel32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4088bd
call dword [sym.imp.kernel32.dll_GetLastError]
sub eax, 0x217
neg eax
sbb eax, eax
inc eax
je 0x408978
mov eax, dword [ebp - 0x7c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4088c3
push ebx
sub eax, edx
lea ecx, [ebp - 0x80]
push ecx
inc eax
push eax
push dword [ebp - 0x7c]
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x408900
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.sendMessageToBroker_WriteFile_error:__d_n
call fcn.00407fd4
pop ecx
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x4089a6
push 0x1ff
lea eax, [ebp + 0x389]
push ebx
push eax
mov byte [ebp + 0x388], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x200
lea eax, [ebp + 0x388]
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, eax
cmp esi, ebx
jne 0x408946
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xea
jne 0x408965
lea eax, [ebp + 0x388]
push eax
lea eax, [ebp - 0x78]
push 0x40ee14
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
cmp esi, ebx
je 0x40891b
jmp 0x408978
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.sendMessageToBroker_ReadFile_error:__d_n
call fcn.00407fd4
pop ecx
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push 8
mov edi, 0x40ee18
lea esi, [ebp - 0x78]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x408993
inc eax
jmp 0x4089a8
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.sendMessageToBroker_ConnectNamedPipe_error:__d_n
call fcn.00407fd4
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x588]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b376
add ebp, 0x58c
leave
ret
Function at 0x408af3
Capabilities:
Check if file exists
Check mutex on windows
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x610
mov eax, dword [0x41228c]
xor eax, esp
mov dword [esp + 0x60c], eax
push ebx
xor bl, bl
call fcn.004089cc
test eax, eax
je 0x408cb1
call fcn.00407fd4
test eax, eax
je 0x408cb1
push esi
mov esi, dword [esp + 0x624]
push edi
push 0xa
mov edi, str._shutdown
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x408b3d
inc bl
push ebp
push str.SunJavaBrokerMutex
push 1
xor ebp, ebp
push ebp
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, ebp
je 0x408ca5
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x408c9e
test bl, bl
jne 0x408cae
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
push ebp
push ebp
push 3
push ebp
push ebp
push 0xc0000000
push 0x40eef4
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x408c4a
push 0x1ff
lea eax, [esp + 0x21]
push ebp
push eax
mov byte [esp + 0x28], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebp
lea eax, [esp + 0x1c]
push eax
push 0x200
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
cmp eax, ebp
jne 0x408bda
call edi
cmp eax, 0xea
je 0x408bb6
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x220]
push 0x40ef0c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
lea eax, [esp + 0x228]
push eax
call fcn.00408580
add esp, 0x10
mov edi, str.SUCCESS
test eax, eax
jne 0x408c10
mov edi, str.FAILED
push ebp
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
push eax
push edi
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
mov edi, eax
cmp edi, ebp
jne 0x408c38
push str.Pipe__close_pipe_n
call fcn.00407fd4
pop ecx
push esi
call ebx
cmp edi, ebp
je 0x408c96
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x408b7d
call edi
cmp eax, 2
jne 0x408c61
push 0x1f4
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x408b7d
cmp eax, 0xe7
jne 0x408c84
push 0xffffffffffffffff
push str..pipejbrokerpipe
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
jne 0x408b7d
call edi
jmp 0x408b7d
push eax
push str.pipe_CreateFile_error:__d_n
call fcn.00407fd4
pop ecx
pop ecx
jmp 0x408b7d
push dword [esp + 0x10]
call ebx
jmp 0x408cae
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test bl, bl
je 0x408cae
call fcn.004089c0
pop ebp
pop edi
pop esi
mov ecx, dword [esp + 0x610]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040b376
add esp, 0x610
ret 0x10

Function at 0x40a6c1
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
cmp dword [0x412664], 0
je 0x40a6cd
mov al, 1
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
push 0
push 1
push 0
push 0x40f27c
mov edi, 0x412664
push edi
call esi
test eax, eax
jne 0x40a70f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40a70b
push 8
push 1
push 0
push str.__SunJavaKernel
push edi
call esi
test eax, eax
jne 0x40a70f
xor al, al
jmp 0x40a711
mov al, 1
pop edi
pop esi
ret
Function at 0x40a98c
Capabilities:
Check if file exists
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x41228c]
xor eax, ebp
mov dword [ebp + 0x790], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
mov dword [ebp - 0x80], esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x40a9df
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
call ebx
cmp eax, 2
je 0x40a9df
call ebx
push eax
push str.CopyPath_DeleteFile_error:__d_n
call fcn.00407fd4
pop ecx
pop ecx
xor al, al
jmp 0x40aab5
xor ebx, ebx
push ebx
push 0x80
push 1
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x40aa0d
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.CopyPath_CreateFile_error:__d_n
jmp 0x40a9d1
push ebx
lea eax, [ebp - 0x74]
push eax
mov edi, 0x800
push edi
lea eax, [ebp - 0x70]
push eax
push esi
mov esi, dword [sym.imp.kernel32.dll_ReadFile]
jmp 0x40aa58
cmp dword [ebp - 0x74], ebx
je 0x40aa80
push ebx
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x40aa60
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x74]
jne 0x40aa71
push ebx
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
call esi
cmp eax, ebx
jne 0x40aa25
jmp 0x40aa84
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.CopyPath_WriteFile_error:__d_n
jmp 0x40a9d1
push str.CopyPath_WriteFile_short_written_count_n
call fcn.00407fd4
jmp 0x40a9d7
cmp eax, ebx
jne 0x40aa95
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.CopyPath_ReadFile_error:__d_n
jmp 0x40a9d1
push dword [ebp - 0x78]
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x40aab3
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.CopyPath_CloseHandle_error:__d_n
jmp 0x40a9d1
mov al, 1
mov ecx, dword [ebp + 0x790]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b376
add ebp, 0x794
leave
ret
Function at 0x40b376
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41228c]
jne 0x40b380
repz ret
jmp fcn.0040b979

Function at 0x40b90e
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x410768
call fcn.0040b920
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x412a14], ebx
jne 0x40b6a9
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x412a10
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x40b6e3
cmp eax, esi
jne 0x40b6d6
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40b6e6
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x40b6bd
xor esi, esi
inc esi
mov eax, dword [0x412a0c]
cmp eax, esi
jne 0x40b6f9
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x40b734
mov eax, dword [0x412a0c]
test eax, eax
jne 0x40b72e
mov dword [0x412a0c], esi
push 0x40d330
push 0x40d324
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40b734
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40b84e
mov dword [0x4126c8], esi
mov eax, dword [0x412a0c]
cmp eax, esi
jne 0x40b758
push 0x40d320
push 0x40d300
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x412a0c], 2
cmp dword [ebp - 0x24], ebx
jne 0x40b765
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x412a18], ebx
je 0x40b786
push 0x412a18
call fcn.00407fd4
pop ecx
test eax, eax
je 0x40b786
push ebx
push 2
push ebx
call dword [0x412a18]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40b7df
cmp al, bl
je 0x40b79f
cmp dword [ebp - 0x1c], ebx
jne 0x40b7df
mov al, byte [esi]
cmp al, bl
je 0x40b7af
cmp al, 0x20
ja 0x40b7af
inc esi
mov dword [ebp - 0x20], esi
jmp 0x40b79f
test byte [ebp - 0x40], 1
je 0x40b7bb
movzx eax, word [ebp - 0x3c]
jmp 0x40b7be
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x4126c4], eax
cmp dword [0x4126b8], ebx
jne 0x40b834
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x40b7ee
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x40b801
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x40b78d
cmp dword [0x4126c8], ebx
jne 0x40b842
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4126c4]
call fcn.0040b965
ret
call fcn.00407fd4
jmp 0x40b67b
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401443
pop dword [ebp - 0x30]
mov eax, 0xb69d4f7f
sub eax, 0xb65d3b3c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x4596be01
add dword [ebp - 0x40], 0x8bb874a
mov dword [ebp - 0x3c], 0x31da2806
sub dword [ebp - 0x3c], 0xffa6dbc1
mov dword [ebp - 0x38], 0x3db8f2e
add dword [ebp - 0x38], 0x4870b500
mov dword [ebp - 0x34], 0x9798cec5
add dword [ebp - 0x34], 0x6867313b
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x1875fbfa
sub dword [ebp - 0x40], 0xa40392a4
mov dword [ebp - 0x3c], 0x6927ecf3
sub dword [ebp - 0x3c], 0x27bb8b7e
mov dword [ebp - 0x38], 0x9671de08
sub dword [ebp - 0x38], 0x3302719c
mov dword [ebp - 0x34], 0x36674cca
sub dword [ebp - 0x34], 0x36674cca
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5a1
push 0
call eax
mov ecx, 0x4fe7
xor esi, esi
add esi, eax
mov edi, 0xb5965292
sub edi, 0xb550c092
add edi, dword [ebp - 0x30]
mov ebx, 0x63628105
add ebx, 0x8fa51978
sub dword [ebp - 0xc], ebx
mov edx, dword [edi]
add edx, ebx
xor dword [ebp - 0x20], edi
mov dword [esi], edx
add esi, 0x2c2593a0
add esi, 0xd3da6c64
add edi, 0x6181c45f
sub edi, 0x6181c45b
loop 0x401557
add eax, 0x5e3569ed
sub eax, 0x5e34377e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x54bfe1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf053d498
jmp 0x54c004
mov dword [esp + 0x24], ebx
call fcn.0054bfac
mov dword [esp + 0x28], ebp
pushal
mov dword [esp + 0x44], esi
call 0x54bfe3
push es
mov ds, word [ebx + edi*2]
xchg esi, eax
and dword [edi - reloc.mscoree.dll__CorExeMain], ebx
jmp 0x54bfcb
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x40], edi
jmp 0x54c01a
rdtsc
lea ecx, [edx*4]
lea esi, reloc.mscoree.dll__CorExeMain
jmp 0x54c024
lea esp, [esp + 0x40]
pushfd
jmp 0x54bf91
mov ah, byte [esp]
mov edi, dword [esp + 0x2c]
cpuid
not cl
mov ax, si
jmp 0x54c070
jmp 0x54c120
bswap esi
lea ebp, [esp]
mov ax, bp
stc
jle 0x54c05a
lea ebx, [edi + ebp]
lea esi, [esp + edi]
jmp 0x54c126
setno dl
bts cx, cx
not ax
mov dl, cl
jmp 0x54c4d0
mov dl, 1
mov ax, 0x6f0f
lea eax, [ecx*4]
mov dh, byte [esp]
shl cl, cl
jmp 0x54c0d9
mov esi, esp
mov ebx, dword [esp]
mov ah, byte [esp]
lea eax, [eax + ebx]
mov ebx, edi
jmp 0x54c09c
jb 0x54c086
setno dl
bts cx, cx
call fcn.0054c0fe
sub al, 0x87
adc al, 0x24
xchg ah, ch
xchg cx, ax
lea edx, [edx - 0x24]
neg ah
jmp 0x54c144
lea ebx, [edi + ebp]
lea esi, [esp + edi]
sub esp, 0xc0
jmp 0x54c0b4
mov dl, 0x5b
setno dl
xchg al, ch
push dword [esp]
ret 4
pushfd
pop cx
add cx, bx
lea esp, [esp + 2]
xchg dword [esp], edx
mov dl, byte [esp]
jmp 0x54c12e
mov edx, edi
pushfd
xchg word [esp + 1], dx
mov ax, si
pop ecx
rdtsc
jmp 0x54c16c
mov ax, 0xfefb
rdtsc
mov ch, al
neg edi
jmp 0x54c189

Function at 0x54bfe3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf053d498
jmp 0x54c004
mov dword [esp + 0x24], ebx
call fcn.0054bfac
mov dword [esp + 0x28], ebp
pushal
mov dword [esp + 0x44], esi
call 0x54bfe3
push es
mov ds, word [ebx + edi*2]
xchg esi, eax
and dword [edi - reloc.mscoree.dll__CorExeMain], ebx
jmp 0x54bfcb
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x40], edi
jmp 0x54c01a
rdtsc
lea ecx, [edx*4]
lea esi, reloc.mscoree.dll__CorExeMain
jmp 0x54c024
lea esp, [esp + 0x40]
pushfd
jmp 0x54bf91
mov ah, byte [esp]
mov edi, dword [esp + 0x2c]
cpuid
not cl
mov ax, si
jmp 0x54c070
jmp 0x54c120
bswap esi
lea ebp, [esp]
mov ax, bp
stc
jle 0x54c05a
lea ebx, [edi + ebp]
lea esi, [esp + edi]
jmp 0x54c126
setno dl
bts cx, cx
not ax
mov dl, cl
jmp 0x54c4d0
mov dl, 1
mov ax, 0x6f0f
lea eax, [ecx*4]
mov dh, byte [esp]
shl cl, cl
jmp 0x54c0d9
mov esi, esp
mov ebx, dword [esp]
mov ah, byte [esp]
lea eax, [eax + ebx]
mov ebx, edi
jmp 0x54c09c
jb 0x54c086
setno dl
bts cx, cx
call fcn.0054c0fe
sub al, 0x87
adc al, 0x24
xchg ah, ch
xchg cx, ax
lea edx, [edx - 0x24]
neg ah
jmp 0x54c144
lea ebx, [edi + ebp]
lea esi, [esp + edi]
sub esp, 0xc0
jmp 0x54c0b4
mov dl, 0x5b
setno dl
xchg al, ch
push dword [esp]
ret 4
pushfd
pop cx
add cx, bx
lea esp, [esp + 2]
xchg dword [esp], edx
mov dl, byte [esp]
jmp 0x54c12e
mov edx, edi
pushfd
xchg word [esp + 1], dx
mov ax, si
pop ecx
rdtsc
jmp 0x54c16c
mov ax, 0xfefb
rdtsc
mov ch, al
neg edi
jmp 0x54c189
Function at 0x54c03d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], edx
call fcn.0054bfc2
push dword [esp + 6]
lea esp, [esp + 2]
mov dword [esp + 0x28], ecx
jmp 0x54bf88
push esi
jmp 0x54bf9e
push word [esp + 3]
jae 0x54c001
push esi
push dword [esp + 6]
lea esp, [esp + 2]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
jmp 0x54bf8c

Function at 0x550533
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf053d498
jmp 0x5505b2
mov dword [esp], ebp
push eax
jmp 0x5506af
lea edx, [ecx*4]
bsr ebp, ecx
jmp 0x5505b4
stc
jns 0x550575
lea edx, [ecx*4]
bsr ebp, ecx
push cx
lea esp, [esp + 2]
jmp 0x5505ba
jmp 0x55058b
push cx
lea esp, [esp + 2]
mov ebp, dword [esp + 0x2c]
jmp 0x5505c4
mov dx, di
mov si, word [esp]
mov dl, 0xdc
mov edi, ebp
jmp 0x550664
mov dword [esp + 0x17], edi
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp 0x54ffc3
call fcn.00550636
fld dword [eax - 0x2a]
mov cl, 0x40
mul dword [ecx - 3]
insd dword es:[edi], dx
hlt
sub esp, 0xbc
mov esi, esp
neg edx
jb 0x5505f4
jae 0x5505f4
lea edi, [esp]
pushfd
mov cx, si
mov dl, 0x37
jmp 0x55060a
mov byte [esp + 2], cl
pop word [esp]
lea esp, [esp + 2]
push esi
pushal
pop word [esp + 0xd]
jmp 0x5505de
Function at 0x5ea2ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, eax
xchg byte [esp + 7], ch
lea ebp, reloc.mscoree.dll__CorExeMain
mov dh, al
bsf bx, bx
dec bh
jmp 0x5ea386
bsf edx, ecx
pushfd
rdtsc
cpuid
xchg byte [esp + 2], dl
jmp 0x5ea2c7
mov dword [esp], edx
lea esp, [esp + 3]
mov ebx, dword [esp]
mov byte [esp], dl
jmp 0x5ea344
lea edi, [edi + ebp]
lea esp, [esp + 5]
lea ecx, reloc.mscoree.dll__CorExeMain
mov cl, bh
mov bx, 0xf65e
pop bx
jmp 0x5ea2fa
not ebx
rdtsc
bsr ebx, esp
add esp, 0
lea esi, [ebx*4]
mov si, word [esp]
jmp 0x5ea36b
bsr cx, ax
neg ebp
bswap ebx
xchg bl, ch
xchg byte [esp], dh
cpuid
jmp 0x5ea327
mov di, 0x207
mov esi, 0x5a55ebf4
rdtsc
clc
mov ch, al
jmp 0x5ea3c4
bt bx, ax
mov dx, word [esp]
mov dx, 0x226
cmc
shr ch, cl
xchg edi, eax
jmp 0x5ea355
add esp, 1
neg dx
xchg edx, ebx
mov ebp, 0x2aa4dd37
mov cx, word [esp]
push word [esp]
jmp 0x5ea310
mov edx, dword [esp]
rdtsc
std
lea ebp, [edx + edx]
mov dl, ch
rdtsc
jmp 0x5ea3d9
mov edi, dword [esp]
rdtsc
lea ebp, [ebx*4]
mov dx, di
bswap ebp
cpuid
jmp 0x5ea3a0
clc
mov ax, si
push ebx
xchg al, cl
clc
lea esp, [esp + 3]
jmp 0x5ea4cc
mov esi, edi
add esp, 3
std
pop ecx
mov eax, 0x13940946
mov dh, 0x72
jmp 0x5ea406
xchg dword [esp + 1], ecx
rdtsc
mov dl, byte [esp + 0xb]
xchg cx, ax
mov ah, bh
xchg esi, ebx
jmp 0x5ea41c
sub esp, 0xf
sub esp, 1
pop dword [esp + 4]
neg ecx
add esp, 1
btr ax, ax
jmp 0x5ea43a

Function at 0x5ebfc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov dx, word [esp + 3]
pushal
stc
jmp 0x5ebfe7
Function at 0x5ec40f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
cmc
neg bl
pop dword [esp + 2]
lea esi, [edx + edx]
mov bh, 0x13
jmp 0x5ec44b
mov ah, bh
mov si, word [esp + 9]
mov word [esp + 0xe], bp
lea ebx, [ecx + edx]
xchg word [esp + 0xa], si
not edi
jmp 0x5ec3d7
cpuid
jmp 0x5ec3ed
xchg bh, cl
setne bh
neg ax
mov cx, word [esp]
pushfd
jmp 0x5ec469
sets bh
mov byte [esp], ch
xchg word [esp], ax
mov bp, 0x8693
mov si, bp
xchg ebx, edi
jmp 0x5ec413
btr ax, sp
lea edx, reloc.mscoree.dll__CorExeMain
and cx, 0x4651
lea ebp, reloc.mscoree.dll__CorExeMain
pop dword [esp + 4]
add esp, 9
jmp 0x5ec429
mov dh, byte [esp + 5]
mov ah, byte [esp + 2]
mov dword [esp], edx
push word [esp + 5]
bsf eax, ebx
push word [esp + 5]
jmp 0x5edad3
cpuid
bswap ebx
cld
mov dx, 0x382d
lea ecx, [eax + ebp]
lea edi, [ecx + ecx]
jmp 0x5ec4c3
mov ah, byte [esp]
mov ebx, 0xe195b416
mov edx, esp
rdtsc
mov edi, dword [esp]
jmp 0x5ecb4c
pushal
lea esp, [esp + 0x4a]
bswap esi
mov ax, word [esp]
inc ebx
bswap ecx
jmp 0x5ec4ae
mov word [esp + 1], sp
push ebp
dec ecx
pop ax
mov word [esp + 1], dx
xchg ebx, ecx
jmp 0x5ec537
setp dl
mov dx, word [esp]
bsr bp, sp
setbe ah
mov dl, 0x14
pushfd
jmp 0x5ec4ea
mov dh, 0xce
xchg ecx, ebp
sbb dx, cx
mov cx, dx
pushal
mov di, word [esp + 0x17]
jmp 0x5ec547
mov bx, word [esp + 4]
push ax
pushfd
xchg dh, cl
mov edi, edx
bswap ecx
jmp 0x5ec514
inc bl
push dword [esp + 0xf]
pop word [esp + 0x25]
dec ecx
mov bx, word [esp + 6]
lea ecx, [ebp - 0x22]
jmp 0x5ec9db
lea edi, [ebx + ebp]
and bp, bp
mov edi, ebx
rdtsc
neg edx
mov ebx, 0xfef929af
jmp 0x5ec501
mov bx, di
lea esp, [esp + 0x1c]
call fcn.005ec60c
pushal
push dword [esp + 0xa]
push dword [esp + 9]
mov word [esp + 0x25], si
jmp 0x5ec806
mov dword [esp + 0xc], edx
push word [esp + 0x23]
call fcn.005ec83b
test eax, 0x3fcca535
mov edx, 0xff66d7a4
je 0x5ec82e
push word [esp + 0x24]
mov dword [esp + 0x17], eax
and al, 0x89
inc esp
and al, 0x17
mov byte [esp + 0x25], ch
pop dword [esp + 0x20]
pushfd
jmp 0x5ec7f0
jmp 0x5ec877
push ecx
pop dword [esp + 0x14]
push word [esp + 0x2b]
mov dword [esp + 0x24], edi
call fcn.005ec85a
mov bp, cx
rol ah, cl
not cl
push dword [esp + 0x1c]
dec cx
mov esi, dword [esp + 0x24]
jmp 0x5ec7c8
mov edi, dword [esp]
mov eax, dword [esp]
mov cl, 0x7f
lea ebp, [eax + ebx]
not ch
not eax
jmp 0x5ec56c
neg edx
mov ecx, dword [esp + 0xe]
sub cx, 0xaebc
xchg edi, esi
mov byte [esp + 0xa], dh
xchg word [esp + 0x16], cx
jmp 0x5ec4da
bts ebx, edx
xchg word [esp + 7], di
xchg edx, ecx
xchg edx, ecx
sub esp, 0x1f
cpuid
jmp 0x5ed13c
Function at 0x5ee20c
Capabilities:
Access peb ldr_data

Disassembly:
sbb dl, byte [eax + 0x11c32c93]
invalid
push word [esp + 0xd]
push dword [esp + 4]
lea esp, [esp + 1]
jmp 0x5e9d62
inc dword [eax + 0x534031]
pushfd
sub esp, 9
sub esp, 2
push dword [esp + 9]
jmp 0x5e9cd0
setl al
mov di, word [esp]
mov ecx, edi
mov bl, byte [esp]
adc ebp, eax
jmp 0x5e9d3b
cld
cld
shl ah, cl
mov bp, 0xf83d
lea ecx, [ebx*4]
mov eax, 0x8a5247a1
jmp 0x5e9cf9
add esp, 0
mov byte [esp + 0x16], bh
mov esi, eax
neg ax
sub esp, 0x19
jmp 0x5e9d8a
mov si, word [esp]
inc bh
sub esp, 0x18
mov cx, 0xb6db
bswap ebx
xchg byte [esp + 0xe], bl
jmp 0x5e9d25
lea esp, [esp + 0x14]
pushal
mov eax, dword [esp]
bswap ebp
mov cx, word [esp]
inc cx
jmp 0x5e9d0f
pop cx
xchg byte [esp + 0xd], bh
cld
mov dword [esp + 7], edi
push word [esp + 0x12]
jmp 0x5e9da2
cmp bh, bh
lea esp, [esp + 0xc]
add esp, 4
mov di, word [esp + 0x13]
mov ebp, dword [esp + 0xe]
btc dx, sp
jmp 0x5e9d74
push word [esp + 0x19]
bswap eax
popal
std
bswap esi
mov ebx, 0x6143e0ce
jmp 0x5e9dd8
jmp 0x5ec09d
dec edx
bswap ebp
mov cx, bp
bsr cx, bp
xchg byte [esp], bl
mov word [esp], bx
jmp 0x5e9f5a
xchg byte [esp + 0xa], dh
mov al, 0xc4
pop edi
pop bx
sub esp, 0xc
pop di
jmp 0x5e9e48
not dx
std
xchg edx, ebp
sub esp, 5
pop ebp
std
jmp 0x5e9e0f
xchg dword [esp + 0x14], edx
add esp, 0x32
cld
dec dl
mov eax, dword [esp]
jmp 0x5e9ea0
stc
cld
lea ebp, [edx + edx]
sub esp, 0x1d
setae ah
lea ebp, [ecx + 3]
jmp 0x5e9e32
mov dx, cx
lea edi, reloc.mscoree.dll__CorExeMain
bsr edi, ecx
xchg ecx, edi
xchg byte [esp], ch
sub esp, 0x14
jmp 0x5e9e25
xchg dword [esp + 1], eax
mov dx, 0x66d3
bswap eax
lea ebx, [edx + 0x65]
rdtsc
push word [esp]
jmp 0x5e9ee3
push word [esp + 3]
ror bl, cl
xchg byte [esp + 1], bl
bswap edi
mov bh, byte [esp + 4]
std
jmp 0x5e9e7c
mov word [esp], dx
sub esp, 0x1d
bswap ebp
pop word [esp + 4]
mov cl, 0x66
call fcn.005e9eb4
invalid
pop dword [esp]
mov word [esp + 3], ax
mov bp, di
neg ecx
pop cx
add esp, 2
jmp 0x5e9eca
stc
mov ecx, 0xea405e53
mov dx, 0xb711
mov ah, byte [esp + 1]
not bp
dec bh
jmp 0x5e9e66
call 0x5ec0a2
jmp 0x5ec6c6
pop eax
sub eax, 0x5ec0a2
jmp 0x5ec707
popal
jmp 0x5e7fab
cmp dword [eax + reloc.mscoree.dll__CorExeMain], 0
je 0x5e9ce6
lea esp, [esp + 8]
jmp 0x5ec6f1
call 0x5ee05d
jmp 0x5ee2b1
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x5ee25e
mov eax, dword [eax]
jmp 0x5ee2d7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x5ee248
pop eax
sub eax, 0x1ee05d
push eax
jmp 0x5e9dc2
mov eax, dword [eax + 8]
push eax
jmp 0x5ee058
Function at 0x1000fe03
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000fe42
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000fe42
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000fe42
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000fe42
cmp dword [ecx + 0x74], 0xe
jbe 0x1000fe42
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret