joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100df76d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov esp, ebp
not bp
pop ebp
jmp loc.1005cd80
push ebp
lea ebp, [esp - 0x78]
cmp bx, sp
lea esp, [esp - 0x2dc]
cmp eax, edi
cmp dword [0x1008e968], 0
jmp 0x101339b7
mov dword [ebp + 0x58], 0
jmp fcn.1017e98d
jne 0x101d6cad
mov eax, 4
shl eax, 0
clc
mov ecx, dword [eax + 0x10081004]
btc eax, edx
not ecx
sar dx, 0xa5
bt ax, 0x3d
xor ecx, 0x9b113c90
mov edx, 4
btr eax, edx
test esi, edx
imul eax, edx, 3
ror dx, 0x13
mov edx, dword [eax + 0x10081004]
sub ax, si
cmp bx, 0x2e80
adc ax, 0xd50a
not edx
dec al
ror eax, 0x98
sal ax, 0xa3
xor ecx, edx
mov dh, dh
or al, bl
mov dword [ebp + 0x50], ecx
rdtsc
mov eax, 4
shl eax, 0
xchg cl, ch
adc cx, di
setnp cl
mov ecx, dword [eax + 0x10081004]
shr edx, cl
inc dl
not ecx
cmc
cmp esi, 0x39941c33
xor ecx, 0x9b113e98
bts dx, si
cmp dl, 0x10
mov edx, 4
cwde
cbw
or eax, edx
imul eax, edx, 3
mov edx, dword [eax + 0x10081004]
bt ax, 0x86
test esp, ecx
cmp edi, ecx
not edx
xor ecx, edx
mov dword [ebp + 0x54], ecx
bswap cx
cwd
not ax
mov eax, dword [ebp + 0x50]
movzx edx, bx
mov dword [ebp - 0x30], eax
movsx edx, si
mov dh, bh
mov dx, 0xd35
mov ecx, dword [ebp + 0x54]
movzx edx, dx
xchg edx, edx
mov dword [ebp - 0x38], ecx
cwd
movzx edx, bp
cmovl edx, ebp
lea edx, [ebp - 0x264]
mov dword [ebp - 0x34], edx
jmp 0x100fd04d
mov ecx, 4
bts ax, si
neg dl
shr ah, cl
shl ecx, 0
sbb ax, 0x32a3
dec ax
mov edx, dword [ecx + 0x10081004]
bts ecx, ecx
adc ax, si
not edx
bts ax, si
xor edx, 0x9b113e99
movzx ecx, di
cmovle ax, bp
mov eax, 4
sar cx, 0x2a
imul ecx, eax, 3
bts eax, esp
mov eax, dword [ecx + 0x10081004]
ror ch, cl
mov ecx, 0xbf1c7526
ror cx, 0x84
not eax
xor edx, eax
lahf
mov dword [ebp - 0x1c], edx
and dx, bx
rol al, 0x9f
cdq
mov ecx, dword [0x1008e968]
cmc
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x5c], ecx
movsx eax, bp
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x1c]
sal ah, cl
mov dword [ebp - 0x1c], edx
nop
rol eax, cl
mov eax, dword [ebp - 0x5c]
clc
add ebp, 0x78
jmp 0x100d808c

Function at 0x100df7ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100e1561
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], dx
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x100e7297
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc esi, 2
push 0x83260b3a
mov dword [esp + 4], 0xdc857518
shr dl, cl
push 0xfcaa3b3a
jmp 0x10123b4c
mov word [esi], dx
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x100e7bd5
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebp
movzx bp, byte ss:[eax]
mov dword [esp], 0xcb96c6b1
not dword [esp]
inc dword [esp]
adc esi, 2
push 0xa8aa4baf
mov word [esi], bp
push 0x3b1606bd
jmp 0x10198914
push 0x4e2e4521
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x100e8eaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dl, cl
mov dword [esp], 0x633ee40d
jmp 0x101a874f
mov word [esi], dx
lea esp, [esp + 8]
jmp fcn.1014ffcc
Function at 0x100ea84f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], eax
push 0xf2181c2f
jmp 0x10154ce8
push 0x169dddab
lea esp, [esp + 0x18]
jmp fcn.1014ffcc

Function at 0x100ec9e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp + 0x20]
or cx, 0x7d84
rcl edx, 0xaa
xor ecx, esp
xor eax, dword [ebp + 0x20]
mov dword [ebp + 0x20], eax
adc dh, cl
cmp di, 0x2d0e
mov ecx, dword [ebp + 0x1c]
btc dx, sp
xor ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x1c], ecx
mov edx, 4
shl edx, 0
mov eax, dword [edx + 0x10081004]
cdq
not eax
bts dx, bp
rcl cx, 7
xor eax, 0x9b113e9c
dec dh
mov ecx, 4
shl dl, 0x1e
imul edx, ecx, 3
ror cx, cl
mov ecx, dword [edx + 0x10081004]
not ecx
or edx, 0x2fa09213
btr edx, esp
xor eax, ecx
mov dword [ebp + 0x14], eax
sal edx, 0xf
mov edx, 4
sub ecx, 0xe6beb48c
and ecx, edi
bt ecx, 0x13
shl edx, 0
xadd ax, cx
movzx eax, si
mov eax, dword [edx + 0x10081004]
not eax
adc edx, 0x36b0930c
xor eax, 0x9b113e9f
xor ecx, edi
xor ch, 0xa3
btc ecx, 0x9e
mov ecx, 4
imul edx, ecx, 3
mov ecx, dword [edx + 0x10081004]
stc
not ecx
movzx dx, ah
bts edx, esp
xor eax, ecx
cdq
mov dh, 0x1d
mov dword [ebp + 0x18], eax
cwde
movzx edx, ax
lea edx, [ebp + 0x5c]
push edx
mov eax, dword [ebp + 0x14]
setle dh
cdq
push eax
movsx edx, si
lea ecx, [ebp + 0x68]
movsx edx, ax
push ecx
mov dx, di
xchg dl, dl
cwd
mov edx, dword [ebp + 0x18]
jmp 0x10173ae6
mov edx, dword [ebp + 0x24]
inc eax
sbb ah, 0x35
bswap ax
add edx, 1
sub ax, ax
mov dword [ebp + 0x24], edx
mov eax, dword [ebp + 0x24]
test esi, eax
cmp eax, dword [ebp - 0xa0]
jmp 0x100ec9f5
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25
jge 0x1006ded1
mov ecx, dword [ebp - 0xa4]
cmp bh, 0x9a
add ecx, dword [ebp + 0x24]
mov dl, byte [ebp - 0xa8]
jmp 0x10127fa5
mov byte [ecx], dl
jmp 0x100c9ca2

Function at 0x100ef768
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push esi
mov dword [esp + 0x10], 0x89759865
lea esp, [esp + 0x10]
call fcn.100a4b25

Function at 0x100f03b5
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
mov byte [esp + 0xb], 0xb9
jno 0x1011314e
sbb esi, 2
jmp 0x101ac02f
jmp 0x1001a1aa

Function at 0x100f1563
Capabilities:
Execute anti-debugging instructions

Disassembly:
not al
jmp 0x1014d6d0
push 0xb10bf50c
mov word [esi], ax
push 0xca8b6aab
jmp 0x101b4cec
push 0x6f9072b3
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x100f61d6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
seta dl
mov edx, dword [esp + edx - 0x460a6ffd]
add dword [esp + 0x10], 0xeff5979f
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25

Function at 0x100fa383
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol word [esp], 0x87
rol dl, 1
push 0x658fd536
push 0xb888bc91
jmp fcn.10031520
xor dl, bl
neg dl
mov dword [esp], 0x9316b29d
jmp 0x100c0369
Function at 0x100fa650
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ecx
or edx, ecx
mov dword [esi], edx
mov dword [esp], 0x3ea86c97
jmp 0x10124cde
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100fb1c5
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0xc6d6f265
lea esp, [esp + 4]
call fcn.100a4b25

Function at 0x100ff0f6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shr edi, 0x49
lea edi, [edi*4 + 0x450fbb02]
js fcn.1002f4cf
lea edi, [edi*2 - 0x7492ad3]
mov edi, dword [esp + edi + 0x7b4898db]
jb 0x100484b1
push dword [esp + 4]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25

Function at 0x10100dc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x82b908ba
add esi, 2
rol word [esp + 2], 0xe3
shr dx, cl
jmp loc.1005cc4c

Function at 0x101018e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
not byte [esp + 5]
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x10103933
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp], 0x89759865
call fcn.100a4b25

Function at 0x10103ae9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x101041a2
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc
mov dword [esi], ebp
jmp 0x100e4fbc

Function at 0x10105c41
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.10009b06
lea ecx, [ebp - 0x21f0]
call fcn.10009b06
lea ecx, [ebp - 0x21f4]
call fcn.10009b06
lea ecx, [ebp - 0x21f8]
jmp 0x1010d7a6
call fcn.10009b06
lea ecx, [ebp - 0x2208]
jmp 0x101588e6
call fcn.10009b06
lea ecx, [ebp - 0x2204]
jmp 0x100abf47
call fcn.10009b06
lea ecx, [ebp - 0x2200]
jmp 0x100c945b
call fcn.101bd2f3
call fcn.10009b06
lea ecx, [ebp - 0x21ec]
jmp 0x100910bd
call fcn.10009b06
lea ecx, [ebp - 0x21fc]
jmp 0x100e59a2
call fcn.10009b06
lea ecx, [ebp - 0x220c]
jmp fcn.1000496e

Function at 0x101071a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword es:[eax], ebp
jmp 0x1013ba12
mov dword [esp + 8], 0x3a362598
lea esp, [esp + 0xc]
jmp fcn.1014ffcc
Function at 0x101071aa
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
stc
mov ebp, esp
adc dl, 1
movsx edx, bx
xor eax, edi
sub esp, 0x60
inc dx
sub ax, dx
mov dword [ebp - 8], 0
ror ah, cl
xadd dh, ah
mov eax, dword [ebp + 8]
sub edx, 0x72308e2d
mov dword [ebp - 0xc], eax
rcr dx, 0xb7
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sal al, 0x1c
mov ax, 0xcb9b
add edx, dword [ecx + 0x3c]
setge al
shl cx, cl
mov dword [ebp - 0x54], edx
or edx, 0x2ba48714
rol edx, cl
bt dx, 0x9a
mov eax, 4
shld edx, edx, 0x25
cmovb cx, bx
shl eax, 0
rcr dx, 2
mov ecx, dword [eax + 0x10081004]
not ecx
rcl dx, 0xab
xor ecx, 0x9b113e98
mov edx, 4
sub ax, 0x4687
imul eax, edx, 3
rcl dh, cl
cmovge edx, esp
sbb dl, 0xa4
mov edx, dword [eax + 0x10081004]
lahf
not edx
movzx eax, sp
bt ax, di
xor eax, 0x1aa8f429
xor ecx, edx
movsx eax, sp
bt ax, 0x8b
mov dword [ebp - 0x28], ecx
add ch, 0x2d
mov eax, dword [ebp - 0x28]
ror cx, 0x88
cmp ebp, ebp
rcr cl, 0x33
mov ecx, dword [ebp - 0x54]
lea edx, [ecx + eax*8 + 0x78]
bts eax, eax
not ax
or ax, si
mov dword [ebp - 0x5c], edx
inc eax
ror edx, cl
mov eax, dword [ebp - 0x28]
btc cx, dx
cmova edx, eax
xor eax, dword [ebp - 0x28]
bsr edx, esi
jmp 0x1013c982
mov dword [ebp - 0x50], eax
sal cx, 0x28
sub dl, 0x83
cmp sp, 0x1315
mov ecx, dword [ebp - 0x10]
bts edx, ecx
sal dh, 0xb
shld edx, ebp, 0x32
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x10]
clc
sub edx, 1
test ax, 0xc233
cmc
mov dword [ebp - 0x10], edx
jmp 0x101cbe44
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x5c]
inc ah
or eax, ebx
mov edx, dword [ebp - 0xc]
btc ax, bp
shl al, cl
add edx, dword [ecx]
stc
btr ecx, 0x34
movzx ecx, si
mov dword [ebp - 0x2c], edx
sub cx, 0x8be
xadd dx, ax
mov eax, dword [ebp - 0x2c]
adc ch, 0x9f
or ecx, esi
mov ecx, dword [ebp - 0xc]
bt dx, bp
shl edx, cl
add ecx, dword [eax + 0x1c]
or al, 0xa0
mov dword [ebp - 0x1c], ecx
stc
mov edx, dword [ebp - 0x2c]
add ax, 0x229e
sub eax, edx
mov eax, dword [edx + 0x18]
test sp, 0x942e
mov dword [ebp - 0x10], eax
rcl edx, cl
mov ecx, dword [ebp - 0x2c]
xadd eax, edx
add dh, 0xad
sar ax, cl
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
btr ecx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
dec ah
mov al, dh
mov dword [ebp - 0x20], ecx
rdtsc
sal dh, 0x91
shl dh, cl
mov edx, dword [ebp - 0x54]
bsf ax, si
test bp, cx
btc ecx, 0x8a
mov eax, dword [edx + 0x50]
jmp 0x1011e853
cmp dword [ebp - 0x60], 0
jmp loc.10080425
Function at 0x10108432
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0xcd25fbbf
jp 0x101d5dcc
call fcn.10009b06
lea ecx, [ebp - 0x14b8]
call fcn.10009b06
lea ecx, [ebp - 0x14bc]
call fcn.10009b06
lea ecx, [ebp - 0x14c0]
jmp 0x101ca15a
call fcn.10009b06
lea ecx, [ebp - 0x14b4]
jmp 0x100b0f66
call fcn.10009b06
lea ecx, [ebp - 0x14ac]
jmp 0x101a53bc
mov word [eax], cx
jne 0x10015cd1
call fcn.10009b06
lea ecx, [ebp - 0x14a4]
jmp 0x1012e61f
call fcn.10009b06
lea ecx, [ebp - 0x14a8]
jmp 0x100c89e8
call fcn.10009b06
lea ecx, [ebp - 0x14b0]
jmp 0x100bf744
call fcn.10009b06
lea ecx, [ebp - 0x14c4]
jmp loc.1006ccb2
lea esp, [esp + 0x20]
jno fcn.1014ffcc

Function at 0x1010b5bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x1010b5c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd89148ae
mov byte es:[eax], dl
mov dword [esp + 4], 0xe2159db0
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x1010c165
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + ebp*2 + 0x3cc669b4]
mov dword [esp + 8], 0x36359b65
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.100a4b25
Function at 0x1010d732
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Inspect section memory permissions

Disassembly:
cmp dword [0x1008e97c], 0
jmp 0x10151954
sbb dword [eax], edx
add byte [ebp + 0x130c0c4c], cl
lea ecx, [esp + ecx + 0xc]
adc ebp, ebp
pushfd
test ebp, ebp
push esi
mov esi, 0xdb857e05
call fcn.1010d710
les esi, [esi + 0x43]
dec edx
or esp, ebp
add eax, 0x3eb59e31
insd dword es:[edi], dx
jno 0x1004c790
jnp 0x1004c72a
rcl dword [ebx - 0xe]
mov ebp, 0x98f9d6d7
sti
sbb bh, byte [ecx + 0x20]
bound eax, qword [edx - 0x4a]
sahf
bound esi, qword [edx]
js 0x1004c7f1
out dx, eax
mov al, byte [0xdf2a2c16]
mov bl, 0xb4
fcom qword [edi + 0xe6242f9]
mov eax, dword [0x5a380d6b]
mov ecx, 0xefde7bef
or byte [edi], ah
das
test al, 0xf2
pushfd
int1
out dx, eax
fistp word [ecx + 0xd45a2af]
add bh, byte [ecx]
out dx, al
insd dword es:[edi], dx
int1
shr dh, 0xf7
invalid
out dx, al
insd dword es:[edi], dx
int1
or al, 0x80
adc byte [edx], bh
add dword [eax - 0x2d319a1], 0x2c5592db
lahf
adc bh, byte [esi + 0x2c]
invalid
push 0x10055090
jmp 0x1019533d
mov ebp, dword [esp + esi*2 + 0x48f50402]
mov dword [esp + 0xc], 0x54a2f165
mov esi, dword [esp + esi + 0x247a81ff]
jo 0x1004c77c
jno 0x10139e63
mov ebp, 0x6f0196a4
dec ebp
jge 0x10189125
jns 0x10184e80
xor bp, bx
shr dword [esp + 3], 0xd9
inc bp
call fcn.10198922
lea edi, [edi + ebp - 0x6f0196a5]
push ebp
ror bp, 0x2f
movzx ebp, word [edi + ebp - 0x6f012d47]
push 0x2da9043c
jns 0x1014d6ba
mov dword [ebp - 0x724], edx
movzx ecx, bp
mov ecx, 0x20ba9b17
not ecx
mov ecx, dword [ebp - 0x724]
push ecx
jmp 0x1010c957
call dword [0x1008c29c]
mov edx, dword [ebp - 0x724]
not eax
or eax, 0xad188798
xor edx, dword [ebp - 0x724]
shl ch, 0x12
mov dword [ebp - 0x724], edx
rol cx, cl
xor cx, 0xf9aa
or ax, sp
mov eax, dword [ebp - 0xe14]
btc cx, 0x1f
mov dword [0x1008e960], eax
shl ch, cl
btc cx, 0x88
mov ecx, dword [0x1008ef0c]
test sp, sp
and ecx, 1
jmp 0x101a4682
jne 0x10001370
mov edx, dword [0x1008ef0c]
cmc
or edx, 1
mov dword [0x1008ef0c], edx
jmp 0x1000135d

Function at 0x1010e602
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xeaa502b9
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x10114a88
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x1c9b9d94
adc esi, 1
shl edx, cl
jmp 0x10198b98
mov dword [esi], edx
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x10116a79
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x10118077
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], edx
mov dword [esp], 0x9c9c723b
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x10119ca0
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25
mov byte [eax], cl
jmp loc.10048090

Function at 0x1011d4ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x6f933f39
lea esp, [esp + 0x20]
jmp fcn.1014ffcc
Function at 0x1011e826
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pushfd
add dword [esp + ebx*2 + 0x64f979d4], 0xeffa311d
add bl, 0x96
mov ebx, dword [esp + ebx + 0x327cbc5c]
mov dword [esp + 0xc], 0x89759865
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.100a4b25

Function at 0x101227c9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.100c1761
mov dl, byte [eax]
mov byte [ebp - 0xb6e], dl
bswap cx
push 0xe47f683d
jmp 0x100f14a7
call fcn.100c1761
mov cl, byte [eax]
mov byte [ebp - 0xb6f], cl
mov ecx, 0x7ab008bc
not cl
push 0xe47f6824
bswap cx
mov ecx, edi
lea ecx, [ebp - 0x2cb0]
jmp 0x100c949c
lea ecx, [ebp - 0x2cac]
call fcn.100c1761
mov al, byte [eax]
or edi, 0x64345da4
mov byte [ebp - 0xb6d], al
sub ecx, ecx
mov byte [ebp - 0xb6c], cl
cwd
mov ecx, 0x11
lea esi, [ebp - 0xbb2]
bswap di
mov dx, bp
lea edi, [ebp - 0x35a8]
movsx edx, dx
rep movsd dword es:[edi], dword [esi]
mov dx, si
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dh, ah
cdq
lea edx, [ebp - 0x35a8]
mov dword [ebp - 0x15c], edx
jmp loc.1005c6d6
inc al
sub word [esp + 5], 0xef26
jp 0x1019056b
not dword [esp + 4]
rol al, 1
rol dword [esp + 4], 0x3c
jb 0x10101fa3
not ecx
push 0xe47f6836
movzx ecx, si
lea ecx, [ebp - 0x2cb4]
jmp 0x100c98a2
mov dword [esp], 0x5c2ecc04
neg al
sub byte [esp + 1], 0x8a
jne 0x10193202
ror al, 1
neg byte [esp + 1]
xor bl, al
call fcn.100b0837
mov ecx, edi
not cx

Function at 0x10123c3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x10126c60
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x10127d12
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x1012b678
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x76b1b1af
not dword [esp]
mov dword [esi], ebp
jmp 0x101bcf15
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x1012ccab
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
pushfd
mov ebx, 0xbc0bcba0
not bl
test bl, 0xf
mov ebx, dword [esp + ebx + 0x43f434a5]
mov dword [esp + 4], 0xc3499c65
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.100a4b25

Function at 0x1012eb39
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ecx], eax
jmp 0x101bb95e
jmp 0x101c46f6
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x1012f16d
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
mov dword [esp], 0x88b09965
call fcn.100a4b25
mov byte [edx + eax], cl
jmp loc.10077829

Function at 0x10131e66
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc
mov dword [esi + 4], eax
jmp 0x10159388
push 0x58864d87
jmp 0x100eb8f4

Function at 0x1013377e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, 4
push 0x99a0f730
shrd ax, bp, cl
jmp 0x1019a5e9
push 0xd9920403
mov word [esi], ax
jmp 0x100b084c
Function at 0x101343f1
Capabilities:
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
shr word [esp + edx + 9], 0xc8
dec al
bswap edx
rol al, 1
xchg byte [esp + edx + 0xb], dl
and edx, dword [esp + edx + 6]
inc edx
not al
not word [esp + edx + 7]
call fcn.100f0bfe

Function at 0x10137987
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x1013880f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x1013d0e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], eax
jmp 0x1018124d
lea esp, [esp + 4]
jmp fcn.1014ffcc

Function at 0x1013d719
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.1014ffcc

Function at 0x1013daed
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push edx
mov edx, 0xcb90952b
pushfd
sub edx, 0x12204000
jge 0x1013db07
mov edx, dword [esp + edx + 0x468faad9]
mov dword [esp + 4], 0x89759865
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.100a4b25

Function at 0x1013ec0a
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [esp + 4], ecx
mov dword [esp], 0x68999eb7
push 0xde8952b7
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x10140467
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sub dl, 0xb8
push 0xc793ca90
xor dword [esp + 8], 0x43b9c526
call fcn.1007c8b9

Function at 0x10141b30
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.100a4b25
dec cx

Function at 0x101423da
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x10142425
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], dx
push 0x240e56bc
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x1014285a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x38], 1
ror cx, cl
xchg ecx, ecx
add edx, 0x101156b2
mov dword [ebp - 0x28], 1
cwd
mov ecx, 0xc
sub eax, edi
sal ax, cl
imul edx, ecx, 0
shr al, cl
xor cx, sp
mov eax, dword [ebp + 8]
mov dword [ebp + edx - 0x24], eax
add cl, dl
rol dh, cl
mov ecx, 0xc
neg dh
cdq
btr edx, ebx
imul edx, ecx, 0
jmp 0x1014b3ce
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.100a4b25
jge 0x1009e0ff
mov eax, dword [ebp - 4]
jmp 0x1013108f
jmp 0x10132081
mov esp, ebp
mov bp, di
pop ebp
jmp 0x10001992
push ebp
mov ebp, 0x19039d0e
pushfd
xor ebp, ebp
jg 0x10142871
mov dword [esp + 8], 0x89759865
mov ebp, dword [esp + ebp*2 + 4]
jno 0x100c9470

Function at 0x10143ab8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0x7439d69a
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x10145f27
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], eax
lea esp, [esp + 0xc]
jmp fcn.1014ffcc
Function at 0x10146142
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf52a60a2
push 0xb2b40a85
mov dword [esi + 4], eax
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x101468b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], edx
push 0x90a10f1d
push 0xdfb915ba
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x10147623
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xdcac9e94
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
not byte [esp + 0xb]
mov word [esi], ax
jmp 0x100d6495

Function at 0x1014988c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x1014ace3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sub al, 0xb8
push 0x1c2bc50d
push 0x10843e8f
sar dword [esp + 4], 0x92
ror al, 1
add al, 0x8e
sal dword [esp + 0xc], 0x59
xor al, 0x8b
mov dword [esp + 0x10], 0xe49b243c
shl word [esp + 0xc], 4
shl byte [esp + 0xe], 0xa6
xor bl, al
call fcn.1005aca7
adc esi, 1
sub edi, 1
push eax
movzx eax, byte [edi]
push 0xa0922b9b
xor al, bl
jmp 0x100e8a38

Function at 0x1014b406
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x89759865
lea esp, [esp + 4]
call fcn.100a4b25
mov cx, bp

Function at 0x1014b4c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc esi, 3
mov dword [esp], 0xe32d95b5
and byte [esp + 2], 0x1f
shld dx, ax, cl
push 0xe51fdf3a
mov word [esi], dx
push 0x4e05c807
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x1014b8d3
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x1014dce8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25