joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445564
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4a0d38]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0044bcb0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4455c7
cmp dword [ebp - 0x114], 5
jae 0x4455c3
cmp dword [ebp - 0x114], 4
jne 0x4455c7
cmp dword [ebp - 0x110], 0x5a
jb 0x4455c7
xor eax, eax
jmp 0x4455ca
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a7da
leave
ret

Function at 0x446be3
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x446bf6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00445e77
xor eax, eax
ret 4

Function at 0x449fb7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4a306c], 0
push esi
push edi
jne 0x449f28
call fcn.00449e82
test eax, eax
je 0x449f6d
mov eax, dword [0x4a306c]
cmp eax, 1
jne 0x449f49
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x449f6d
jmp 0x449faf
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x449faf
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x449f71
xor eax, eax
jmp 0x449faf
mov eax, dword [esi]
push dword [0x4a306c]
call edi
mov edi, eax
test edi, edi
je 0x449f93
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x449faf
lea edi, [esi + 0xff0]
push esi
push dword [0x4a306c]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x449f99
mov eax, esi
pop edi
pop esi
ret
jmp 0x449f14

Function at 0x44a7da
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a0d38]
jne 0x44a7e4
repz ret
jmp fcn.00453580
Function at 0x469f22
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a0d38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00451e2b
and dword [ebp - 0x14], 0
cmp dword [0x4a3ebc], 0
mov dword [ebp - 0x18], eax
jne 0x469fd5
push 0x488a84
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x46a07d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x488a78
push ebx
call edi
test eax, eax
je 0x46a07d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x488a68
push ebx
mov dword [0x4a3ebc], eax
call edi
push eax
call esi
push 0x488a54
push ebx
mov dword [0x4a3ec0], eax
call edi
push eax
call esi
push 0x488a38
push ebx
mov dword [0x4a3ec4], eax
call edi
push eax
call esi
mov dword [0x4a3ecc], eax
test eax, eax
je 0x469fd5
push 0x488a20
push ebx
call edi
push eax
call esi
mov dword [0x4a3ec8], eax
mov eax, dword [0x4a3ec8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x46a02e
cmp dword [0x4a3ecc], ecx
je 0x46a02e
push eax
call esi
push dword [0x4a3ecc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x46a02e
test ebx, ebx
je 0x46a02e
call edi
test eax, eax
je 0x46a025
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x46a025
test byte [ebp - 8], 1
jne 0x46a02e
or dword [ebp + 0x10], 0x200000
jmp 0x46a061
mov eax, dword [0x4a3ec0]
cmp eax, dword [ebp - 0x18]
je 0x46a061
push eax
call esi
test eax, eax
je 0x46a061
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x46a061
mov eax, dword [0x4a3ec4]
cmp eax, dword [ebp - 0x18]
je 0x46a061
push eax
call esi
test eax, eax
je 0x46a061
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a3ebc]
call esi
test eax, eax
je 0x46a07d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x46a07f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a7da
leave
ret
Function at 0x45a163
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0045a10c
test eax, eax
je 0x45a2bc
lea ecx, [esp + 0x18]
call fcn.0045a10c
lea ecx, [esp + 0x18]
test eax, eax
je 0x45a22b
call fcn.0045a10c
test eax, eax
je 0x45a1ed
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0045a10c
lea edi, [eax + edi*2]
dec ebx
jne 0x45a1c3
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x45a1e4
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x45a1e7
mov byte [edx], 0
inc edx
jmp 0x45a2ce
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x45a223
test ecx, ecx
je 0x45a2b7
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x45a215
jmp 0x45a2b3
xor ebp, ebp
inc ebp
jmp 0x45a2b7
call fcn.0045a142
test edi, edi
jne 0x45a260
cmp eax, 2
jne 0x45a25b
lea ecx, [esp + 0x18]
call fcn.0045a142
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x45a2b7
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x45a250
jmp 0x45a2b3
sub eax, 3
jmp 0x45a263
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0045a142
mov ecx, eax
cmp esi, 0x7d00
jb 0x45a28a
inc ecx
cmp esi, 0x500
jb 0x45a293
inc ecx
cmp esi, 0x80
jae 0x45a29e
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x45a2b7
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x45a2aa
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x45a2d4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x45a193
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a459
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x45a48b
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x45a46c
jmp 0x45a48f
mov eax, dword [esp + 0x10]
test edi, edi
je 0x45a499
xor byte [esi], al
inc esi
dec edi
jne 0x45a493
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x405e3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x45ee10
cmp edx, dword [eax]
je 0x405e5f
add eax, 8
inc ecx
cmp eax, 0x45eea0
jl 0x405e50
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x45ee10]
jne 0x405f8d
mov eax, dword [0x45f364]
cmp eax, 1
je 0x405f67
test eax, eax
jne 0x405e90
cmp dword [0x45ed64], 1
je 0x405f67
cmp edx, 0xfc
je 0x405f8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405ec7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004063f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406560
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405f0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406560
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4083f8
push edi
call fcn.00406eb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004063f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406400
lea eax, [ebp - 0xa0]
push 0x4083d8
push eax
call fcn.00406400
push dword [esi + 0x45ee14]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406400
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406e24
add esp, 0x2c
pop edi
jmp 0x405f8d
lea eax, [ebp + 8]
lea esi, [esi + 0x45ee14]
push 0
push eax
push dword [esi]
call fcn.00406560
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x104a4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cl, 0x10
add eax, 0x10
dec cl
dec eax
movzx edx, byte [eax]
mov dl, byte [edx + str.cw]
mov byte [eax], dl
test cl, cl
jne 0x104b1
pop ebp
ret 4

Function at 0x104cc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cl, 0x10
add eax, 0x10
dec cl
dec eax
movzx edx, byte [eax]
mov dl, byte [edx + 0x173a0]
mov byte [eax], dl
test cl, cl
jne 0x104d9
pop ebp
ret 4

Function at 0x104f4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov bl, 0x10
lea eax, [edx + 0x10]
sub ecx, edx
dec bl
dec eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
test bl, bl
jne 0x10507
pop ebx
pop ebp
ret 8

Function at 0x1051e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [edi + 0x20]
sub esi, edi
mov edi, dword [ebp + 0xc]
mov bl, 0x10
lea eax, [edx + 0x10]
sub edi, edx
dec bl
dec eax
mov dl, byte [edi + eax]
dec ecx
mov byte [ecx - 0x10], dl
xor byte [eax], dl
mov dl, byte [esi + ecx]
mov byte [ecx], dl
test bl, bl
jne 0x1053e
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10614
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push 4
add ecx, 2
pop esi
mov dl, byte [ecx + 1]
xor dl, byte [ecx]
mov al, byte [ecx - 1]
mov bl, byte [ecx - 2]
mov byte [ebp - 4], dl
xor dl, al
xor al, bl
movzx eax, al
push eax
mov byte [ebp + 0xb], bl
xor dl, bl
call fcn.00010486
xor al, bl
mov bl, byte [ecx - 1]
xor al, dl
mov byte [ecx - 2], al
mov al, byte [ecx]
xor al, bl
movzx eax, al
push eax
call fcn.00010486
push dword [ebp - 4]
xor al, bl
xor al, dl
mov byte [ecx - 1], al
call fcn.00010486
xor al, byte [ecx]
xor al, dl
mov byte [ecx], al
mov al, byte [ecx + 1]
xor al, byte [ebp + 0xb]
movzx eax, al
push eax
call fcn.00010486
xor al, byte [ecx + 1]
add ecx, 4
xor al, dl
dec esi
mov byte [ecx - 3], al
jne 0x10625
pop esi
pop ebx
leave
ret 4
Function at 0x1069a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0xc
push ebx
push esi
push 4
add ecx, 2
pop esi
mov al, byte [ecx - 2]
mov bl, byte [ecx]
mov dl, byte [ecx + 1]
mov byte [ebp + 0xb], al
mov al, byte [ecx - 1]
xor dl, bl
mov byte [ebp - 0xc], dl
xor dl, al
xor dl, byte [ebp + 0xb]
mov byte [ebp - 6], dl
push dword [ebp - 6]
call fcn.00010486
mov byte [ebp - 2], al
xor al, bl
xor al, byte [ebp + 0xb]
movzx eax, al
push eax
call fcn.00010486
movzx eax, al
push eax
call fcn.00010486
mov bl, byte [ecx + 1]
xor al, dl
mov byte [ebp - 1], al
mov al, byte [ebp - 2]
xor al, bl
xor al, byte [ecx - 1]
movzx eax, al
push eax
call fcn.00010486
movzx eax, al
push eax
call fcn.00010486
xor al, dl
mov dl, byte [ecx - 1]
mov byte [ebp - 2], al
mov al, dl
xor al, byte [ebp + 0xb]
movzx eax, al
push eax
call fcn.00010486
xor al, byte [ebp + 0xb]
mov bl, byte [ecx]
xor al, byte [ebp - 1]
mov byte [ecx - 2], al
mov al, bl
xor al, dl
movzx eax, al
push eax
call fcn.00010486
push dword [ebp - 0xc]
xor al, dl
xor al, byte [ebp - 2]
mov byte [ecx - 1], al
call fcn.00010486
mov dl, byte [ecx + 1]
xor al, bl
xor al, byte [ebp - 1]
mov byte [ecx], al
mov al, dl
xor al, byte [ebp + 0xb]
movzx eax, al
push eax
call fcn.00010486
xor al, dl
xor al, byte [ebp - 2]
add ecx, 4
dec esi
mov byte [ecx - 3], al
jne 0x106ad
pop esi
pop ebx
leave
ret 4

Function at 0x10780
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 0x1d]
mov al, byte [eax + str.cw]
xor al, byte [ecx]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor al, byte [esi]
mov bl, 0x1b
mov byte [ecx], al
movzx eax, byte [ecx + 0x1e]
mov al, byte [eax + str.cw]
xor byte [ecx + 1], al
movzx eax, byte [ecx + 0x1f]
mov al, byte [eax + str.cw]
xor byte [ecx + 2], al
movzx eax, byte [ecx + 0x1c]
mov al, byte [eax + str.cw]
xor byte [ecx + 3], al
mov dl, byte [esi]
mov al, dl
shr al, 7
imul bl
add dl, dl
xor al, dl
mov byte [esi], al
push 3
lea eax, [ecx + 5]
pop esi
mov dl, byte [eax - 5]
xor byte [eax - 1], dl
mov dl, byte [eax - 4]
xor byte [eax], dl
mov dl, byte [eax - 3]
xor byte [eax + 1], dl
mov dl, byte [eax - 2]
xor byte [eax + 2], dl
add eax, 4
dec esi
jne 0x107db
movzx eax, byte [ecx + 0xc]
mov al, byte [eax + str.cw]
xor byte [ecx + 0x10], al
movzx eax, byte [ecx + 0xd]
mov al, byte [eax + str.cw]
xor byte [ecx + 0x11], al
movzx eax, byte [ecx + 0xe]
mov al, byte [eax + str.cw]
xor byte [ecx + 0x12], al
movzx eax, byte [ecx + 0xf]
mov al, byte [eax + str.cw]
xor byte [ecx + 0x13], al
push 3
lea eax, [ecx + 0x15]
pop ecx
pop esi
pop ebx
mov dl, byte [eax - 5]
xor byte [eax - 1], dl
mov dl, byte [eax - 4]
xor byte [eax], dl
mov dl, byte [eax - 3]
xor byte [eax + 1], dl
mov dl, byte [eax - 2]
xor byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x10834
pop ebp
ret 8
Function at 0x1085a
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 0x1d]
push 3
mov ecx, edi
pop esi
mov dl, byte [ecx - 5]
xor byte [ecx - 1], dl
mov dl, byte [ecx - 4]
xor byte [ecx], dl
mov dl, byte [ecx - 3]
xor byte [ecx + 1], dl
mov dl, byte [ecx - 2]
xor byte [ecx + 2], dl
sub ecx, 4
dec esi
jne 0x1086d
movzx ecx, byte [eax + 0xc]
mov cl, byte [ecx + str.cw]
xor byte [eax + 0x10], cl
movzx ecx, byte [eax + 0xd]
mov cl, byte [ecx + str.cw]
xor byte [eax + 0x11], cl
movzx ecx, byte [eax + 0xe]
mov cl, byte [ecx + str.cw]
xor byte [eax + 0x12], cl
movzx ecx, byte [eax + 0xf]
mov cl, byte [ecx + str.cw]
xor byte [eax + 0x13], cl
mov dl, 0xc
movzx ecx, dl
add ecx, eax
mov bl, byte [ecx - 4]
xor byte [ecx], bl
mov bl, byte [ecx - 3]
xor byte [ecx + 1], bl
mov bl, byte [ecx - 2]
xor byte [ecx + 2], bl
mov bl, byte [ecx - 1]
xor byte [ecx + 3], bl
add dl, 0xfc
jne 0x108c0
mov esi, dword [ebp + 0xc]
mov dl, byte [esi]
mov cl, dl
and cl, 1
neg cl
sbb cl, cl
and cl, 0x8d
shr dl, 1
xor cl, dl
mov byte [esi], cl
movzx edx, byte [edi]
mov dl, byte [edx + str.cw]
xor dl, cl
movzx ecx, byte [eax + 0x1e]
xor byte [eax], dl
mov cl, byte [ecx + str.cw]
xor byte [eax + 1], cl
movzx ecx, byte [eax + 0x1f]
mov cl, byte [ecx + str.cw]
xor byte [eax + 2], cl
movzx ecx, byte [eax + 0x1c]
mov cl, byte [ecx + str.cw]
xor byte [eax + 3], cl
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10be1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x10]
jne fcn.0002c035
bswap cx
pushfd
pushfd
bswap ecx
mov ecx, dword [eax + 0xcc]
pushfd
pushal
push ebp
push ecx
lea esp, [esp + 0x34]
jmp fcn.0002c035
Function at 0x10e1b
Capabilities:
Hash data using murmur3

Disassembly:
add dword [ebp - 0x34], eax
btc eax, 0x1c
mov eax, dword [ebp - 0x19c]
mov byte [esp], pe_nt_image_headers32
cmc
push dword [esp + 4]
add dword [ebp - 0x30], eax
lahf
and al, 3
sub eax, 0xb1a0dcec
mov eax, dword [ebp - 0x194]
mov byte [esp + 8], 0x90
cmc
push esp
add dword [ebp - 0x2c], eax
rol al, 2
lahf
mov eax, dword [ebp - 0x1a4]
bt sp, cx
add dword [ebp - 0x28], eax
pop eax
mov eax, dword [ebp - 0x1a8]
push dword [esp]
pushal
clc
add dword [ebp - 0x24], eax
rcl ah, 1
mov eax, dword [ebp - 0x1ac]
cmp cl, 0x58
jmp 0x12d8c
test dh, al
add dword [ebp - 0x1c], ebx
shr bx, 0xc
add dword [ebp - 0x38], esi
rcl bl, 7
dec bl
pushfd
lea ebx, [ebp - 0x11b4950c]
add dword [ebp - 0x20], eax
pop ebx
inc bl
not bh
add dword [ebp - 0x40], edx
movzx ebx, bl
mov dword [esp + 0x34], 0
lea ebx, [ebx - 0x1528175b]
mov ebx, dword [esp + 0x34]
pushfd
pushfd
adc dword [ebp - 0x3c], ebx
push 0xcc735b15
lea esp, [esp + 0x44]
ja 0x1c6b1
push 0x7a34ef80
mov dword [ebp - 0x48], ebx
mov byte [esp], 0x13
inc dword [ebp - 0x1b4]
pushfd
test bl, 0x5f
pushfd
cmp dword [ebp - 0x1b4], 0xf
pushal
mov byte [esp], bl
lea esp, [esp + 0x2c]
jb 0x34c07
mov ax, 0xa649
jmp fcn.00031411
pushal
mov word [esp + 4], 0x5785
pushal
pushfd
mov dword [ebp - 0x48], ebx
pushfd
inc dword [ebp - 0x1b4]
clc
cmp dword [ebp - 0x1b4], 0xf
mov byte [esp], 0xec
jmp 0x24b9d
lea esp, [esp + 0x48]
jb 0x34c07
movsx eax, cl
pushfd
mov dword [ebp - 0x1b4], ebx
jmp 0x2c9ad
mov eax, dword [ebp - 0x1b4]
pushal
dec cx
mov ecx, dword [ebp - 0x48]
push 0x9f621ff0
call fcn.0003894c
pushfd
pushfd
mov byte [ebp - 0x4c], dl
pushfd
setge dl
jmp loc.00013e2e

Function at 0x10fc6
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x14]
jae 0x2c03a
jp 0x3edf7
test si, bp
pushal
push edx
cmp edx, ecx
push esp
jmp fcn.0002cc22
call fcn.0001104f
mov dword [ebp - 0x20], ecx
call fcn.0001db1c

Function at 0x1104f
Capabilities:
Hash data using murmur3

Disassembly:
cmp edx, ecx
call fcn.0003f85d
lea esp, [esp + 0x6c]
js 0x2faab
mov dword [ebp - 0x90], ecx
pushfd
call fcn.0001be8e
pushfd
mov dword [ebp - 0x90], ecx
push dword [esp]
mov word [esp + 4], 0x710c
mov dword [ebp - 0x14], 0x9d422611
call fcn.0003084e

Function at 0x11a7e
Capabilities:
Hash data using murmur3

Disassembly:
add esp, 4
jl 0x24fd3
bt bp, bp
pushal
shr ecx, 3
jmp fcn.0002dd74

Function at 0x11a9c
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
pushal
pushfd
lea esp, [esp + 0x30]
jae 0x2bfb0
pushal
aaa
shrd di, bp, cl
sub esi, ecx
mov ax, bx
lea eax, [ebp + ecx*4 - 0x2cc]
mov cx, di
mov dword [ebp - 0x1b0], esi
movsx di, bl
rol cl, cl
not di
mov ecx, dword [eax]
clc
mov esi, ecx
jmp fcn.00036efa

Function at 0x11bc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 8], dh
push dword [esp + 8]
lea esp, [esp + 0x2c]
call sub.ntoskrnl.exe_memset
pushfd
push 0x5a2c20be
lea esp, [esp + 8]
jmp fcn.000358b1
mov dword [esp + 4], 0
push dword [esp]
pushal
pushfd
mov dword [esp + 0x28], esi
jmp 0x10d0a
Function at 0x11c38
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], ch
call fcn.0003485c
push edi
test eax, eax
jmp 0x27259

Function at 0x11d33
Capabilities:
Hash data using murmur3

Disassembly:
rol edi, 0xf
stc
mov byte [esp], 0x56
rol ecx, 0xd
test al, al
pushfd
cmp bp, bx
stc
xor edi, ecx
movsx ecx, cl
mov ecx, dword [eax]
push dword [esp + 8]
pushfd
push ebx
lea esp, [esp + 0x4c]
jmp fcn.0003471a

Function at 0x11df2
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [ebp - 0x1c0], edx
xchg dx, di
mov dword [ebp - 0x1c4], eax
bswap di
bswap di
mov dword [ebp - 0xc], 0xe8c192bb
seta dh
pushfd
seta dh
mov dword [ebp - 0x1a0], ebx
mov di, bx
mov edi, 0x100
call fcn.00036d56

Function at 0x12043
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esi], 2
mov byte [esp], 0x62
lea esp, [esp + 4]
call fcn.00013924
pushal
mov dword [esi + 8], eax
cmc
bsr si, ax
clc
bswap si
sub eax, eax
bswap si
movsx si, dl
mov word [esp], bp
mov esi, dword [esp + 0x20]
pushal
mov byte [esp], bh
pushfd
lea esp, [esp + 0x48]
jmp fcn.0002ef50

Function at 0x12616
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [eax + 4], esi
mov byte [esp], cl
mov word [esp], bp
mov dword [esp + 8], eax
mov word [esp + 4], 0x6f20
lea esp, [esp + 0x60]
jne 0x3e9fd
rdtsc
mov eax, dword [ebp - 0x34]
cmp dx, dx
jmp fcn.00029794

Function at 0x126e7
Capabilities:
Hash data using murmur3

Disassembly:
stc
bt bp, ax
stc
rol ebx, 0xd
bt dx, 4
push 0x78b97fcf
push 0xeda0c7da
xor ecx, ebx
bt ebp, 0xb
cmc
bt sp, dx
shr edx, 0xa
cmc
clc
cmp bh, 4
test cl, 6
xor ecx, edx
clc
add edi, ecx
clc
push dword [esp]
test ah, ah
jmp fcn.000314ac

Function at 0x12913
Capabilities:
Hash data using murmur3

Disassembly:
mov ah, 0xe4
movsd dword es:[edi], dword [esi]
mov byte [esp + 4], dl
mov eax, dword [ebp - 0x58]
jmp fcn.00031083

Function at 0x12973
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not di
mov edi, dword [esp + 4]
pushfd
setne bh
mov esi, dword [esp + 0xc]
push 0x1b230fd6
mov byte [esp + 4], dh
mov ebx, dword [esp + 0x14]
mov byte [esp], 0xb4
pushal
lea esp, [esp + 0x38]
jnp 0x2219e
leave
push esi
mov byte [esp], dh
push dword [esp]
push dword [esp + 8]
ret 0x14
pushfd
call fcn.00019cd7

Function at 0x12b2b
Capabilities:
Hash data using murmur3

Disassembly:
bt di, 7
and dword [ebx], 0xfffffbcc
not bh
mov ebx, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pushal
sub eax, eax
test al, 0x3d
clc
test dh, 0xfa
cmp dword [0x17b0c], eax
push eax
pushfd
call fcn.0003c113

Function at 0x12b54
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [ebp - 0x198], eax
lea eax, [ebp + 0x185bf082]
mov eax, dword [ebp - 0xa0]
mov byte [esp], dh
jmp loc.00040901

Function at 0x12f3e
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x50]
jne 0x36614
pushfd
bts edi, 0x18
sub al, ch
setp ah
sub ecx, ecx
bt bp, ax
lea eax, [ebp - 0xf7]
adc si, ax
inc di
movzx esi, byte [eax - 1]
jmp fcn.000326a3