joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c4f50
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100c37c0
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x10110cf0], 0
jne 0x100c4f8d
cmp dword [0x10110cec], 0
je 0x100c4f8d
mov eax, dword [0x10110cec]
mov dword [0x10110cf0], eax
cmp dword [0x10110cf0], 0
je 0x100c500a
mov ecx, dword [0x10110cf0]
cmp dword [ecx + 8], 0
je 0x100c500a
mov edx, dword [0x10110cf0]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x100c500a
mov ecx, dword [0x10110cf0]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100c500a
mov eax, dword [0x10110cf0]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x100c4fd9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x100c4fe0
xor eax, eax
jmp 0x100c512d
mov ecx, dword [0x10110cf0]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.100609c0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x100c512d
mov edx, dword [0x10110cec]
mov dword [0x10110cf0], edx
jmp 0x100c5026
mov eax, dword [0x10110cf0]
mov ecx, dword [eax + 4]
mov dword [0x10110cf0], ecx
cmp dword [0x10110cf0], 0
je 0x100c5066
cmp dword [0x10110cf0], 0
je 0x100c5064
mov edx, dword [0x10110cf0]
cmp dword [edx + 8], 0
je 0x100c5064
mov eax, dword [0x10110cf0]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x100c5064
mov edx, dword [0x10110cf0]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x100c5064
jmp 0x100c4fbe
jmp 0x100c5018
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100c38a0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100c512b
mov eax, dword [ebp - 4]
mov dword [0x10110cf0], eax
mov ecx, dword [0x10110cf0]
mov dword [ecx], 0x52727464
mov edx, dword [0x10110cf0]
mov dword [edx + 8], 0
mov eax, dword [0x10110cf0]
mov ecx, dword [0x10110cec]
mov dword [eax + 4], ecx
mov edx, dword [0x10110cf0]
mov dword [0x10110cec], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10110cf0]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x100c50f7
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x100c511b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x100c50ee
mov eax, dword [0x10110cf0]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x100c4fbe
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100c71c2
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x100c7100
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x100c9670
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x100c982d
call fcn.100c9686
Function at 0x10128877
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x12204710
call fcn.1036a8cc
lea edx, [ebp - 0x18]
jmp 0x1045d75a
push ebx
push 0x1001ac40
jmp 0x1031b21f
push ebx
jmp 0x1019d88d
push ebx
jmp loc.1000c1a6
push edx
jmp 0x103c88b4
call fcn.101904b8
add esp, 0x18
push ebx
jmp 0x1022ad31
push 0x4d
jmp 0x103a02ab

Function at 0x10129c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10129d8c
test eax, eax
je 0x10129d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10144ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10129d73
lea edi, [eax + 4]
jmp 0x10129cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10129cec
mov dword [ebp - 4], 2
jmp 0x10129d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10129d03
mov dword [ebp - 4], 1
jmp 0x10129d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10129d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10129d46
mov byte [ecx], 0x3d
jmp 0x10129d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10129d5d
mov byte [ecx], 0x3d
jmp 0x10129d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10129cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10129d2f
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10129d8c
test eax, eax
je 0x10129d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10144ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10129d73
lea edi, [eax + 4]
jmp 0x10129cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10129cec
mov dword [ebp - 4], 2
jmp 0x10129d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10129d03
mov dword [ebp - 4], 1
jmp 0x10129d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10129d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10129d46
mov byte [ecx], 0x3d
jmp 0x10129d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10129d5d
mov byte [ecx], 0x3d
jmp 0x10129d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10129cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1015abba
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x1231008f
call fcn.1036a8cc
test eax, eax
jmp 0x1028def9
push 0xe
not ch
lea ecx, [ebp - 0x18]
push 0x4d
push ecx
call fcn.10424872
add esp, 0x18
rcr dx, cl
rcl dh, 0xcc
ror dx, 0xbc
sub ebx, ebx
mov edx, dword [ebp - 0x117c]
jmp 0x1038400c
jbe 0x1024b960
lea ecx, [ebp - 0xa58]
cwde
push ecx
lahf
movzx ecx, cx
lea edx, [ebp - 0x950]
cmovg ax, cx
mov cx, sp
push edx
jmp 0x103b1e6d
call dword [0x100d33a8]
jmp 0x10349f54
push 2
jmp 0x10355e3c
mov edx, dword [ebp - 0x1190]
jmp 0x1034414f
push edx
jmp 0x1035a1a0
call 0x103d6d34
mov dword [ebp - 0x1190], eax
cmp eax, ebx
jne 0x103ba7ae
push edx
jmp 0x102b355e
lea eax, [ebp - 0x850]
movsx ecx, dx
not cx
push eax
jmp 0x1024b944
Function at 0x101d4ca2
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
xor eax, ebp
jmp 0x1037dbe9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
rcl esi, 0x19
shld cx, cx, 0xc3
pop ecx
setl ch
and esi, edx
pop edi
shld bx, si, 0x5a
add ecx, edi
and si, ax
pop esi
shld bx, bp, 0xf5
or bx, 0x7835
pop ebx
sub ecx, 0x1aef406a
movzx ecx, dx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
jmp 0x1043d017
push ebx
jmp 0x1021a4cd
push ebp
sbb ebp, 0xf710e55
shl bp, 0x41
mov ebp, esp
mov eax, 0x48953968
push 0xffffffffffffffff
cmp edx, 0x19225478
or ax, si
sal eax, cl
push 0x100d0b27
adc ah, 0xc4
mov eax, dword fs:[0]
clc
stc
push eax
shr eax, 0xe8
bswap ax
xor ax, bp
lea esp, [esp - 0x10c]
cmp dl, 0xc9
mov eax, dword [0x10106de0]
jmp 0x101325f1
push esi
jmp 0x1028aa20
mov dword [ebp - 0x100], 0
jmp 0x103fd803
push edi
push eax
movzx eax, di
lea eax, [ebp - 0xc]
cmove di, bx
mov dword fs:[0], eax
mov edi, ecx
jmp 0x103581c3
push edi
jmp 0x1024cc9a
jmp 0x10167073
ja 0x103e1fc8
xor eax, eax
jmp 0x1030005c
push 0
jmp 0x102c3f49
mov dword [ebp - 0x10], eax
jmp 0x101c4a04
push esi
call fcn.1005b366
add esp, 4
mov ebx, eax
cmp bx, 0x5e65
cmp sp, dx
stc
push ebx
cmc
jmp loc.1002d249
call fcn.101a8c84
mov esi, eax
cmp cx, di
test esi, esi
jmp 0x1032503c
call fcn.1005a469
mov esp, ebp
not bp
pop ebp
jmp loc.10058f26

Function at 0x101d936a
Capabilities:
Hash data with crc32

Disassembly:
push edx
jmp 0x103dd84d
push 0x1226ebbe
call fcn.1036a8cc
call esi
push ebx
movzx ecx, cx
jmp 0x1028f6d6
mov eax, 0xffffffff
jmp 0x103321e3
push ebx
jmp 0x103f0f2a
call dword [0x1011ad68]
mov ecx, dword [ebp - 4]
sbb bx, si
pop edi
mov bh, 0xe5
bt bx, dx
pop esi
neg bl
dec ebx
bswap ebx
xor ecx, ebp
movzx ebx, si
pop ebx
jmp 0x10355c8c
inc eax
cmp cl, bl
jmp 0x1042d2e6
call esi
lea eax, [ebp - 0x2b8]
lea edx, [eax + 1]
mov cl, byte [eax]
jmp 0x1026ea95
push ecx
push 0xffffffffffffffff
push edi
jmp 0x102463a1
push ebx
movsx cx, ah
movzx ecx, dx
push eax
mov cx, 0x6b55
setns cl
lea ecx, [ebp - 0x2b8]
jmp 0x1028eb5b
push ecx
cmovge cx, cx
bswap cx
jmp 0x10335e7f
je 0x103ed683
jmp 0x103ca396
mov ecx, dword [ebp - 0x2d8]
jmp 0x101a8cce
push ecx
jmp 0x10267ca8
call fcn.10367925
mov eax, dword [ebp + 0x1c]
test ebp, 0x687620e
mov ecx, dword [ebp + 0x18]
rol dl, cl
bt edx, edx
mov edx, dword [ebp + 0x14]
stc
add esp, 4
jmp 0x1043e358
call fcn.1005a469
mov esp, ebp
pop ebp
ret 0x18
inc ebx
cmp ebx, ecx
jmp 0x103ed67d
push eax
jmp 0x10351b88
not eax
jmp 0x10382bd2
movzx edx, byte [ebp + ebx - 0x2b8]
sub si, 0x250
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x1010bb10]
jmp 0x1036abcf
push eax
push edi
jmp 0x10337757
jb 0x103ca396
mov esi, dword [0x1011ad94]
jmp 0x1039eac6
push ebx
jmp 0x102770c5
jne 0x102770d0
sub eax, edx
bswap ecx
mov ch, ah
not cx
mov ecx, eax
mov eax, ebp
jmp 0x1021367c
push eax
cmovge ax, si
seta al
mov eax, dword [ebp - 0x2d4]
jmp 0x102ca764
Function at 0x101fbbfa
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x1231008f
call fcn.1036a8cc
push 0xd5cb9e27
call fcn.101269e0
push eax
jmp 0x1031682d
lea edx, [ebp - 0x1068]
setge ah
push edx
movzx eax, sp
not eax
push ebx
jmp 0x1036276e
call fcn.100609c0
add esp, 0xc
push 0x200
movzx ecx, cx
lea ecx, [ebp - 0x1170]
movsx eax, bx
movzx edx, ax
mov ax, 0x9eb
push ecx
rdtsc
cdq
cmovne edx, ebx
push 0x200
jmp 0x10284a60
Function at 0x1020c8cb
Capabilities:
Read file on windows

Disassembly:
jne 0x1045725a
mov edi, 1
jmp 0x1042bc52
push ecx
jmp 0x103f80ba
jmp 0x10173b48
cmp word [ebp - 0x20], ax
jmp 0x101b3766
push eax
lea esp, [esp - 0x14]
bt eax, 0xe2
cmc
shl ah, cl
push ebx
push esi
bt ax, si
shr ah, cl
add si, di
push edi
mov eax, dword [0x10106de0]
xor dword [ebp - 8], eax
or esi, esi
xor eax, ebp
jmp 0x10381a29
call fcn.1005a8f9
add esp, 0xc
cmovb eax, ebx
shr ax, 0xb4
mov eax, dword [ebp - 0x1c]
jmp 0x1033082e
call fcn.1005ac80
lea esp, [esp + 0x14]
mov eax, 0x5a4d
jmp 0x101ccddb
cmp eax, edi
jmp 0x1037a28b
call fcn.1005add9
lea esp, [esp + 0xc]
xor al, 0x4d
cwde
stc
mov eax, dword [ebp - 0x1c]
jmp 0x102a135b
push ebp
mov ebp, esp
bt ax, 0x21
add al, 0x3b
push 0xfffffffffffffffe
push 0x101fd6e4
xor al, 0xd6
movzx eax, cx
sbb eax, 0x565565b8
push 0x10060aa0
stc
rol ax, 0x5f
mov eax, dword fs:[0]
jmp 0x1020c8cb
call dword [0x100d33bc]
jmp 0x1045725a
push eax
jmp 0x1022e502
mov esp, ebp
pop ebp
jmp 0x1034758f
cmp eax, edi
je 0x10389819
push eax
push 1
movsx ecx, cx
mov cx, bx
push 2
mov cl, 0xe8
sete cl
lea ecx, [ebp - 0x20]
jmp 0x1017b99c
ret
call fcn.1005ac80
lea esp, [esp + 0x14]
sbb cx, 0x79a1
mov ecx, 0x5a4d
test esi, eax
stc
cmp word [ebp - 0x20], cx
jmp 0x10173b48
je 0x1045725a
push eax
cdq
push 1
push 2
lea edx, [ebp - 0x20]
jmp 0x103f7578
push eax
xor si, 0x3385
add ah, ah
lea eax, [ebp - 0x10]
sub esi, esp
mov dword fs:[0], eax
cwde
rol ah, 0x11
mov dword [ebp - 0x18], esp
cmc
not si
mov esi, ecx
xor edi, edi
not ax
movsx eax, si
mov dword [ebp - 0x1c], edi
lahf
cbw
mov ax, 0x5b5
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
mov al, 0x13
push 0x100f9c7c
movzx eax, sp
cmove eax, ebp
push esi
mov al, 0xfa
cmovns ax, sp
not ah
lea eax, [ebp - 0x1c]
jmp 0x10310ae4
push 0x100f9c80
movzx ecx, dx
mov ch, 0xc5
push esi
lea ecx, [ebp - 0x1c]
jmp 0x103d9dab
call fcn.1005abec
mov eax, dword [ebp - 0x1c]
push eax
jmp 0x1034dcb2
push ecx
jmp 0x102a9953
push edx
jmp 0x10398263
call fcn.1005abec
mov edx, dword [ebp - 0x1c]
push edx
jmp 0x1028f675
mov dword [ebp - 0x24], edi
call dword [0x100d33c4]
push eax
jmp 0x1030ed7c
push 0xffffffffffffffff
jmp 0x103f9908
mov dword [ebp - 4], 0xfffffffe
cbw
mov eax, edi
mov ecx, dword [ebp - 0x10]
xchg bh, bl
cmovb si, ax
mov dword fs:[0], ecx
pop ecx
not ebx
movsx ebx, sp
pop edi
bswap bx
not bl
pop esi
cmovl ebx, edx
pop ebx
jmp 0x10322444
Function at 0x1020e046
Capabilities:
Hash data with crc32

Disassembly:
mov word [esp + 0x24], dx
call fcn.100609c0
add esp, 0xc
push 0
call fcn.100c2b10
mov esi, eax
test si, bp
mov dword [esp + 0xc], esi
test sp, 0x274
cmp di, 0x7903
cmc
test esi, esi
jmp 0x103edcb0
push ebp
mov ebp, esp
cmc
and esp, 0xfffffff8
sar cx, cl
sub esp, 0x624
mov eax, dword [0x10106de0]
xchg cx, cx
btr cx, 0x35
xor eax, esp
rol cx, 0x9a
mov dword [esp + 0x620], eax
clc
push ebx
push esi
bt ecx, edi
push edi
test bx, si
rcr cl, 0x33
xadd cx, cx
sub eax, eax
jmp 0x1038fab5
push ecx
jmp 0x103db52d
push 0x206
bswap ecx
movzx ecx, ax
push eax
not cx
movzx ecx, si
lea ecx, [esp + 0x42a]
jmp 0x1025d378
mov word [esp + 0x42c], ax
call fcn.100609c0
lea esp, [esp + 0xc]
sub edx, edx
push 0x206
movzx eax, ax
cmovnp ax, dx
mov ax, cx
push edx
cwde
lahf
movzx ax, dh
lea eax, [esp + 0x22]
jmp 0x103e00b1
push eax
jmp 0x1017ad33
je fcn.10440ee6
jmp fcn.1023417c

Function at 0x1021782a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.10017b30
add esp, 8
mov al, 0x95
mov eax, dword [0x1010b950]
mov ecx, dword [0x1010b990]
jmp 0x103d823c
push 0x1231008f
call fcn.1036a8cc
call fcn.10017b30
add esp, 0x18
jmp 0x1042090a
je 0x101dae10
mov edx, dword [0x1010b7d4]
mov ecx, dword [0x1010b804]
jmp 0x10421077
push 0x1010ba70
jmp 0x10018e13
call fcn.101806e6
cmp byte [eax + 0x26], 0
jmp 0x102ad276
mov ecx, dword [0x1011c088]
jmp 0x103fca2e
push 0x1010b888
jmp 0x10437ac7
push edx
jmp 0x101dae06
Function at 0x102c2e6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [ebp - 0xe8]
jmp 0x10356ac1
push 0x4d
jmp 0x103dc6bc
push 0x12204710
call fcn.1036a8cc
call fcn.1001ace0
test al, al
jmp 0x103d23f9
lea eax, [ebp - 0x520]
jmp 0x10032fba
call fcn.1032dd98
add esp, 0x18
cmovs ax, di
push ebx
sete ah
not si
jmp 0x101915e9
lea eax, [ebp - 0x18]
jmp 0x1027f19b
je 0x103a9a66
lea eax, [ebp - 0x520]
movsx ecx, sp
mov dl, 0x66
cwd
push eax
not al
lea ecx, [ebp - 0x950]
seto al
rdtsc
bswap eax
push ecx
lea edx, [ebp - 0x850]
cmovp ax, si
lahf
push edx
xchg ah, al
movzx ax, ch
mov ax, sp
push 3
jmp 0x103bbaa3
push eax
jmp 0x103a9a5a

Function at 0x102ceeda
Capabilities:
Read file on windows

Disassembly:
jne 0x1045725a
mov edi, 1
jmp 0x1042bc52
push ecx
jmp 0x103f80ba
jmp 0x10173b48
cmp word [ebp - 0x20], ax
jmp 0x101b3766
push eax
lea esp, [esp - 0x14]
bt eax, 0xe2
cmc
shl ah, cl
push ebx
push esi
bt ax, si
shr ah, cl
add si, di
push edi
mov eax, dword [0x10106de0]
xor dword [ebp - 8], eax
or esi, esi
xor eax, ebp
jmp 0x10381a29
call fcn.1005a8f9
add esp, 0xc
cmovb eax, ebx
shr ax, 0xb4
mov eax, dword [ebp - 0x1c]
jmp 0x1033082e
call fcn.1005ac80
lea esp, [esp + 0x14]
mov eax, 0x5a4d
jmp 0x101ccddb
cmp eax, edi
jmp 0x1037a28b
call fcn.1005add9
lea esp, [esp + 0xc]
xor al, 0x4d
cwde
stc
mov eax, dword [ebp - 0x1c]
jmp 0x102a135b
push ebp
mov ebp, esp
bt ax, 0x21
add al, 0x3b
push 0xfffffffffffffffe
push 0x101fd6e4
xor al, 0xd6
movzx eax, cx
sbb eax, 0x565565b8
push 0x10060aa0
stc
rol ax, 0x5f
mov eax, dword fs:[0]
jmp 0x1020c8cb
call dword [0x100d33bc]
jmp 0x1045725a
push eax
jmp 0x1022e502
mov esp, ebp
pop ebp
jmp 0x1034758f
cmp eax, edi
je 0x10389819
push eax
push 1
movsx ecx, cx
mov cx, bx
push 2
mov cl, 0xe8
sete cl
lea ecx, [ebp - 0x20]
jmp 0x1017b99c
ret
call fcn.1005ac80
lea esp, [esp + 0x14]
sbb cx, 0x79a1
mov ecx, 0x5a4d
test esi, eax
stc
cmp word [ebp - 0x20], cx
jmp 0x10173b48
je 0x1045725a
push eax
cdq
push 1
push 2
lea edx, [ebp - 0x20]
jmp 0x103f7578
push eax
xor si, 0x3385
add ah, ah
lea eax, [ebp - 0x10]
sub esi, esp
mov dword fs:[0], eax
cwde
rol ah, 0x11
mov dword [ebp - 0x18], esp
cmc
not si
mov esi, ecx
xor edi, edi
not ax
movsx eax, si
mov dword [ebp - 0x1c], edi
lahf
cbw
mov ax, 0x5b5
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
mov al, 0x13
push 0x100f9c7c
movzx eax, sp
cmove eax, ebp
push esi
mov al, 0xfa
cmovns ax, sp
not ah
lea eax, [ebp - 0x1c]
jmp 0x10310ae4
push 0x100f9c80
movzx ecx, dx
mov ch, 0xc5
push esi
lea ecx, [ebp - 0x1c]
jmp 0x103d9dab
call fcn.1005abec
mov eax, dword [ebp - 0x1c]
push eax
jmp 0x1034dcb2
push ecx
jmp 0x102a9953
push edx
jmp 0x10398263
call fcn.1005abec
mov edx, dword [ebp - 0x1c]
push edx
jmp 0x1028f675
mov dword [ebp - 0x24], edi
call dword [0x100d33c4]
push eax
jmp 0x1030ed7c
push 0xffffffffffffffff
jmp 0x103f9908
mov dword [ebp - 4], 0xfffffffe
cbw
mov eax, edi
mov ecx, dword [ebp - 0x10]
xchg bh, bl
cmovb si, ax
mov dword fs:[0], ecx
pop ecx
not ebx
movsx ebx, sp
pop edi
bswap bx
not bl
pop esi
cmovl ebx, edx
pop ebx
jmp 0x10322444
Function at 0x103123be
Capabilities:
Execute anti-debugging instructions
Reference processor manufacturer constants

Disassembly:
mov byte [ebp - 0x2a], 0x33
jmp 0x1034aeb9
mov dword [esi + 8], ecx
test edx, 0x4f352403
jmp 0x10214f51
jne 0x101df876
cmp dword [ebp - 0x28], 0x666f736f
jne 0x101df876
cmp dword [ebp - 0x24], 0x76482074
jmp 0x103aa8a4
mov dword [esi + 0xc], edx
test byte [ebp - 0x2c], 1
je 0x101df876
sub al, al
btc cx, 0x87
pop edi
sub si, bp
movzx cx, dh
ror bx, 0xd2
pop esi
sbb cl, ch
movsx cx, dl
btr ecx, 0xdc
pop ebx
shr ch, cl
rcl cl, 0xae
mov ecx, dword [ebp - 4]
test bl, bl
xor ecx, ebp
jmp 0x103a2699
mov byte [ebp - 0x26], 0x6c
jmp 0x10403698
mov byte [ebp - 0x27], 0x64
jmp 0x1027b05f
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov eax, dword [0x10106de0]
cmp di, 0xc24
rol edx, 0x70
xor eax, ebp
movsx edx, bx
mov dword [ebp - 4], eax
btr ecx, 0x88
push ebx
lahf
cmovnp bx, sp
add edx, esi
mov eax, 1
sal ch, 0xae
movzx bx, bh
setne ch
cpuid
jmp 0x103cc148
lea ecx, [ebp - 0x30]
mov ebx, 0x65
jmp 0x104082b3
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0x2e
jmp 0x1027f1ac
mov byte [ebp - 0x30], 0x6b
jmp 0x1045116e
call fcn.1005a469
mov esp, ebp
pop ebp
jmp 0x103bda17
mov byte [ebp - 0x2b], 0x6c
jmp 0x101602c5
jne 0x101df876
mov eax, 0x40000003
cpuid
clc
cmc
mov dword [ebp - 0x2c], 0
mov dword [esi], eax
cmp si, 0x6ed4
test cl, 0xa8
stc
mov dword [esi + 4], ebx
clc
jmp 0x101b88a5
je 0x10322eaf
xor eax, eax
xor dx, 0x3c0b
bts edx, esi
movsx ebx, di
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov ch, dl
mov eax, 0x40000000
xadd cx, bx
sar dl, cl
cpuid
cmp sp, di
mov dword [esi], eax
stc
test esp, 0x66053697
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp bx, sp
stc
cmp dword [ebp - 0x2c], 0x7263694d
jmp 0x10203205
ret
push esi
bt esi, 0x29
lea esi, [ebp - 0x30]
cmc
mov dword [esi], eax
rcl ah, cl
mov dword [esi + 4], ebx
clc
movsx eax, ax
mov dword [esi + 8], ecx
mov ah, 0x9c
rol eax, 0xa4
bts eax, eax
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x28]
cmp bl, cl
sar eax, 0x1f
push edi
test al, 1
jmp 0x103ae613
mov byte [ebp - 0x25], 0x6c
jmp loc.1003f2c4
push ecx
jmp 0x1039a797
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], bl
jmp 0x103a54f7

Function at 0x1031a440
Capabilities:
Authenticate hmac

Disassembly:
push 0x12204710
call fcn.1036a8cc
mov word [ebp - 0x16], ax
push edx
cmovno eax, ebp
lea eax, [ebp - 0x50]
jmp 0x104529b4
push ecx
jmp loc.1001d1f0
mov word [ebp - 0x14], cx
mov cx, si
push eax
mov cl, dl
lea ecx, [ebp - 0xdc]
jmp 0x10450d3c

Function at 0x103321d9
Capabilities:
Hash data with crc32

Disassembly:
push 0x12204710
call fcn.1036a8cc