joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100011f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
mov dword [ebp - 8], eax
sub edx, edi
mov esi, edi
mov ebx, 4
lea esp, [esp]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
dec ecx
jne 0x10001215
dec ebx
jne 0x10001210
mov byte [ebp - 1], 1
mov esi, edi
mov ebx, 4
lea esp, [esp]
mov ecx, esi
mov edx, 4
jmp 0x10001240
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
dec edx
jne 0x10001240
inc esi
dec ebx
jne 0x10001230
cmp byte [ebp - 1], 0xa
movzx eax, byte [edi + 5]
mov cl, byte [edi + 1]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 0xb], al
mov byte [edi + 7], cl
je 0x100012e6
mov ecx, edi
call fcn.10001140
mov ch, byte [ebp - 1]
mov eax, edi
movzx edx, ch
mov ebx, 4
shl edx, 4
add edx, dword [ebp - 8]
mov esi, 4
jmp 0x100012d0
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
dec esi
jne 0x100012d0
dec ebx
jne 0x100012c6
inc ch
mov byte [ebp - 1], ch
jmp 0x10001225
mov ecx, dword [ebp - 8]
mov esi, 4
add ecx, 0xa0
mov edx, 4
lea esp, [esp]
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
dec edx
jne 0x10001300
dec esi
jne 0x100012f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001244
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
mov dword [ebp - 8], eax
sub edx, edi
mov esi, edi
mov ebx, 4
lea esp, [esp]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
dec ecx
jne 0x10001215
dec ebx
jne 0x10001210
mov byte [ebp - 1], 1
mov esi, edi
mov ebx, 4
lea esp, [esp]
mov ecx, esi
mov edx, 4
jmp 0x10001240
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
dec edx
jne 0x10001240
inc esi
dec ebx
jne 0x10001230
cmp byte [ebp - 1], 0xa
movzx eax, byte [edi + 5]
mov cl, byte [edi + 1]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 0xb], al
mov byte [edi + 7], cl
je 0x100012e6
mov ecx, edi
call fcn.10001140
mov ch, byte [ebp - 1]
mov eax, edi
movzx edx, ch
mov ebx, 4
shl edx, 4
add edx, dword [ebp - 8]
mov esi, 4
jmp 0x100012d0
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
dec esi
jne 0x100012d0
dec ebx
jne 0x100012c6
inc ch
mov byte [ebp - 1], ch
jmp 0x10001225
mov ecx, dword [ebp - 8]
mov esi, 4
add ecx, 0xa0
mov edx, 4
lea esp, [esp]
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
dec edx
jne 0x10001300
dec esi
jne 0x100012f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov dword [ebp - 4], eax
add eax, 0xb0
mov dword [ebp - 8], eax
mov esi, eax
push edi
mov edi, edx
test ebx, ebx
je 0x10001371
dec ebx
shr ebx, 4
inc ebx
mov eax, edi
sub esi, edi
mov edx, 0x10
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x10001350
mov edx, dword [ebp - 4]
mov ecx, edi
call fcn.100011f0
mov esi, edi
add edi, 0x10
dec ebx
jne 0x10001346
mov eax, dword [ebp - 8]
movdqu xmm0, xmmword [esi]
pop edi
pop esi
movdqu xmmword [eax], xmm0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0x6c
mov dword [ebp - 0xc], 0x6c64746e
mov word [ebp - 4], ax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x6c642e6c
push ebp
call fcn.100abeca
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x476c7452
push ecx
mov edx, 0x7372
mov dword [ebp - 0x20], 0x744e7465
push eax
mov dword [ebp - 0x1c], 0x73726556
mov dword [ebp - 0x18], 0x4e6e6f69
mov dword [ebp - 0x14], 0x65626d75
mov word [ebp - 0x10], dx
mov byte [ebp - 0xe], 0
push ecx
call fcn.100a27a3
push 0x10099164
push 0x10099170
push 0x1009916c
call eax
and dword [0x10099164], 0xfffffff
mov esp, ebp
pop ebp
ret
Function at 0x10001a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x20], 0x78323025
mov edx, ecx
mov dword [ebp - 0x1c], 0x3230252d
mov eax, 0x78
mov dword [ebp - 0x18], 0x30252d78
mov word [ebp - 4], ax
mov dword [ebp - 0x14], 0x252d7832
movzx eax, byte [edx + 5]
movzx ecx, byte [edx + 1]
push eax
movzx eax, byte [edx + 4]
push eax
movzx eax, byte [edx + 3]
push eax
movzx eax, byte [edx + 2]
push eax
push ecx
movzx ecx, byte [edx]
lea eax, [ebp - 0x20]
push ecx
push eax
push 0x12
push esi
mov dword [ebp - 0x10], 0x2d783230
mov dword [ebp - 0xc], 0x78323025
mov dword [ebp - 8], 0x3230252d
call fcn.100040e2
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001dfd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, ecx
sub esp, 0xc
mov dword [ebp - 0x438], ebx
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x470], eax
mov esi, edx
mov dword [ebp - 0x434], 0xffffffff
call fcn.10001a80
test eax, eax
je 0x10001ef9
push ecx
push esi
push ebx
lea ecx, [ebp - 0x434]
call fcn.10001b40
test eax, eax
je 0x10001ef9
test edi, edi
jne 0x10001df4
movzx eax, byte [ebp - 0x435]
push eax
movzx eax, byte [ebp - 0x436]
push eax
movzx eax, bh
push eax
movzx eax, bl
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x252e7525
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0xc], 0x75252e75
push 0x10
push eax
mov dword [ebp - 8], 0x75252e
call fcn.100040e2
add esp, 0x1c
cmp si, 0x50
je 0x10001df1
mov eax, 0x1bb
cmp si, ax
je 0x10001df1
mov eax, 0x3a
mov word [ebp - 6], di
push 0xa
mov word [ebp - 0x10], ax
xorps xmm0, xmm0
push 0xb
lea eax, [ebp - 0xf]
movq qword [ebp - 0xe], xmm0
push eax
movzx eax, si
push eax
call fcn.1000492b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push 0x20
push eax
call fcn.10004e8e
add esp, 0x1c
lea edi, [ebp - 0x30]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x46c]
push esi
push edi
push 0x10095a84
push eax
lea eax, [ebp - 0x430]
mov dword [ebp - 0x46c], 0x54534f50
mov edx, 0xa0d
mov dword [ebp - 0x468], 0x20732520
push 0x400
push eax
mov dword [ebp - 0x464], 0x50545448
mov dword [ebp - 0x460], 0x312e312f
mov dword [ebp - 0x45c], 0x6f480a0d
mov dword [ebp - 0x458], 0x203a7473
mov dword [ebp - 0x454], 0xa0d7325
mov dword [ebp - 0x450], 0x746e6f43
mov dword [ebp - 0x44c], 0x2d746e65
mov dword [ebp - 0x448], 0x676e654c
mov dword [ebp - 0x444], 0x203a6874
mov dword [ebp - 0x440], 0xa0d6425
mov word [ebp - 0x43c], dx
mov byte [ebp - 0x43a], 0
call fcn.100040e2
add esp, 0x18
lea ecx, [ebp - 0x434]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.10001c20
test eax, eax
je 0x10001ef9
mov eax, dword [ebp - 0x470]
test eax, eax
je 0x10001eda
test esi, esi
je 0x10001eda
push esi
push eax
lea ecx, [ebp - 0x434]
call fcn.10001c20
test eax, eax
je 0x10001ef9
mov esi, dword [ebp - 0x434]
lea eax, [ebp - 0x430]
push 0
push 0x10
push eax
push esi
call fcn.100a2c7c
hlt
mov esi, dword [ebp - 0x434]
xor edi, edi
cmp esi, 0xffffffff
je 0x10001f0d
push esi
push ebp
call fcn.100a650b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003e4b
mov esp, ebp
pop ebp
ret
Function at 0x10001fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push eax
push dword [ebp + 8]
lea eax, [ecx + 0x12]
mov dword [ebp - 0x500], 0x63616d62
push dword [ecx + 0x24]
mov dword [ebp - 0x4fc], 0x2673253d
push eax
push ecx
lea eax, [ebp - 0x500]
mov dword [ebp - 0x4f8], 0x63616d6c
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x4f4], 0x2673253d
push 0x400
push eax
mov dword [ebp - 0x4f0], 0x3d646963
mov dword [ebp - 0x4ec], 0x78383025
mov dword [ebp - 0x4e8], 0x61747326
mov dword [ebp - 0x4e4], 0x253d6567
mov dword [ebp - 0x4e0], 0x732564
call fcn.100040e2
mov ebx, eax
lea edi, [ebp - 0x404]
add esp, 0x20
test ebx, ebx
je 0x100021d2
call fcn.100b1469
mov esi, eax
xor ecx, ecx
mov eax, ebx
add eax, 0x20
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.10003e5a
mov edi, eax
add esp, 4
test edi, edi
je 0x100021f1
imul edx, esi, 0x343fd
lea esi, [edi + 0x10]
push ebx
add edx, 0x269ec3
mov ecx, edx
shr ecx, 0x10
mov word [edi], cx
imul ecx, edx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
imul ecx, ecx, 0x343fd
shr eax, 0x10
mov word [edi + 2], ax
add ecx, 0x269ec3
mov eax, ecx
imul ecx, ecx, 0x343fd
shr eax, 0x10
mov word [edi + 4], ax
add ecx, 0x269ec3
mov eax, ecx
imul ecx, ecx, 0x343fd
shr eax, 0x10
mov word [edi + 6], ax
add ecx, 0x269ec3
mov eax, ecx
imul ecx, ecx, 0x343fd
shr eax, 0x10
mov word [edi + 8], ax
add ecx, 0x269ec3
mov eax, ecx
imul ecx, ecx, 0x343fd
shr eax, 0x10
mov word [edi + 0xa], ax
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
mov word [edi + 0xc], ax
imul eax, ecx, 0x343fd
add eax, 0x269ec3
shr eax, 0x10
mov word [edi + 0xe], ax
lea eax, [ebp - 0x404]
push eax
push esi
call fcn.1000a810
lea edx, [ebp - 0x4dc]
mov dword [ebp - 0x4dc], 0x35247d51
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4d8], 0x28686e37
mov dword [ebp - 0x4d4], 0x2c452367
mov dword [ebp - 0x4d0], 0x68243f52
mov byte [ebp - 0x4cc], 0
mov byte [ebp - 0x408], 0
call fcn.10001030
movdqu xmm0, xmmword [edi]
lea eax, [ebp - 0x504]
mov edx, ebx
push eax
push dword [ebp - 0x408]
mov ecx, esi
movdqu xmmword [ebp - 0x418], xmm0
call fcn.10001380
mov ebx, dword [ebp - 0x504]
add esp, 0x14
test eax, eax
je 0x100021cf
push ebx
mov edx, eax
lea ecx, [ebp - 0x4c8]
call fcn.10001320
add esp, 4
add ebx, 0x10
mov ecx, dword [0x10099184]
test ecx, ecx
je 0x100021f1
mov dx, word [ecx + 4]
lea eax, [ecx + 6]
push eax
push ebx
push edi
push ecx
mov ecx, dword [ecx]
call fcn.10001d00
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003e4b
mov esp, ebp
pop ebp
ret 8
Function at 0x100034a0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push edi
test ecx, ecx
jle 0x100034c6
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x100034ce
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x100034e7
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x100034ef
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x10003508
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10003510
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x10003529
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x10003531
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x10003573
add dword [esp], 5
retf

Function at 0x10003600
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
push esi
push edi
test ecx, ecx
je 0x10003671
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x10003620
test eax, eax
je 0x10003671
test edx, edx
je 0x10003671
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
push 0x33
call fcn.10003631
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003680
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x17
push esi
push edi
test ecx, ecx
je 0x10003708
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x100036a4
test eax, eax
je 0x10003708
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
push 0x33
call fcn.100036b5
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003710
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5dc
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x1c], ecx
push edi
movlpd qword [ebp - 0x10], xmm0
push 0x33
call 0x1000372e
add dword [esp], 5
retf
Function at 0x10003a60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10099190]
sub esp, 0x1b4
mov edx, dword [0x10099194]
push ebx
push esi
push edi
test eax, eax
jne 0x10003a94
test edx, edx
jne 0x10003a94
mov ecx, str.ntdll.dll
call fcn.10003710
mov dword [0x10099190], eax
mov dword [0x10099194], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
test eax, eax
jne 0x10003aac
test edx, edx
jne 0x10003aac
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10003b08
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0x33
call 0x10003ac6
add dword [esp], 5
retf
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x1b0]
mov esi, dword [ebp - 0x14]
cdq
add eax, ebx
mov dword [ebp - 4], ecx
adc edx, esi
test ecx, ecx
je 0x10003b7a
test eax, eax
jne 0x10003b28
test edx, edx
je 0x10003b7a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0x33
call 0x10003b35
add dword [esp], 5
retf
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x10003aa1
xor ecx, ecx
lea edx, [ebp - 0x4c]
add eax, ebx
mov dword [ebp - 4], edx
adc ecx, esi
test edx, edx
je 0x10003bf2
test eax, eax
jne 0x10003ba0
test ecx, ecx
je 0x10003bf2
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
push 0x33
call 0x10003bad
add dword [esp], 5
retf
mov eax, dword [ebp - 0x38]
pop edi
call fcn.100a3887
shl eax, 2
push eax
push 0
call edi
push eax
call fcn.100ae69d
loop 0x10003b94
inc ebp
fadd qword [ebp - 0x737bf040]
invalid

Function at 0x1009fa07
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 4], al
push 0x315c26d
mov dword [esp + 0x24], edx
movzx edx, dl
bswap edx
setno dl
bswap edx
mov edx, 0x1000b5e5
pushfd
pushal
mov edx, dword [edx + 0x9c36e]
call fcn.1009dc5a

Function at 0x1009fa30
Capabilities:
Parse pe header

Disassembly:
pushal
cmp si, 0x15d2
add ecx, eax
mov dword [esp], 0x55746db3
mov dword [ebp - 0x498], eax
not ah
daa
sal ax, cl
add eax, ecx
mov eax, 0x5a4d
jmp 0x1009d959
pushfd
mov word [esp + 8], sp
mov byte [esp + 4], al
mov dword [ebp - 0x48c], ecx
clc
bt bx, sp
cmp al, 0xde
bt ax, bx
cmp word [0x10018610], ax
push esp
push 0x6d714fa6
lea esp, [esp + 0x4c]
jne 0x1009f64c
daa
mov eax, dword [0x1001864c]
cmp cx, 0xd85d
pushal
jmp 0x100a89b6
cmc
bt edx, 0x18
cmp edi, edx
shr eax, 0x10
bt ecx, 3
or edx, eax
sub ax, 0x8506
mov eax, ecx
cmp bl, bl
xor eax, dword [0x10099168]
clc
sub ecx, edx
add esp, 4
js 0x100aec25
cmp ah, 0x1d
add eax, edi
pushal
stc
bt bp, 8
cmc
mov dword [ebp - 0x490], edx
stc
jmp 0x1009ccae
cmp dword [eax + 0x10018610], 0x4550
mov byte [esp], 0x1b
lea esp, [esp + 0x20]
jnp 0x100aa96d
pushal
jmp 0x100a9f97
lea eax, [eax + 0x10018610]
pushfd
lea esp, [esp + 0x24]
jne 0x1009f64c
push edi
adc ecx, 0xa261a8f3
bt eax, 0xd
mov ecx, 0x8664
stc
stc
mov word [esp], bx
cmp bl, dh
mov dword [ebp - 0x464], 0x10018610
add esp, 4
call fcn.100af77d
add ecx, eax
call fcn.100a7fc0
cmp al, dl
bt ax, 0xe
add eax, edi
stc
mov dword [ebp - 0x490], edx
pushal
test sp, sp
jmp 0x100adf23
Function at 0x100a1f74
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
call fcn.10001980
movzx si, cl
xchg cx, si
pushfd
ror esi, cl
mov esi, dword [0x10099160]
rdtsc
imul ecx, dword [esi], 0x343fd
stc
add ecx, 0x269ec3
btc eax, 2
mov word [esp], 0xd8f
imul eax, ecx, 0x343fd
cmc
bt cx, di
and ecx, 0xffff0000
push dword [esp]
add dx, sp
add eax, 0x269ec3
shrd edx, eax, 0x1f
shld edx, eax, cl
not dl
setle dh
mov dword [esi], eax
lea edx, [ebp + 0x6720cb11]
bswap dx
shr eax, 0x10
add dx, 0x51db
cmp dl, al
jmp 0x100aff85
jmp 0x100a1e76
shr dl, 4
or ecx, eax
rdtsc
movzx ax, dl
cwde
mov dword [ebp - 0x494], ecx
bt esi, 0x12
pushfd
movzx ax, bl
rdtsc
imul edx, dword [esi], 0x343fd
movsx cx, al
das
shld ax, bx, 0xc
pushfd
add edx, 0x269ec3
stc
rcr al, 5
bt si, 4
not al
imul eax, edx, 0x343fd
sal cx, cl
call fcn.100b00fa

Function at 0x100a51ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov byte [esp + 8], 0xc7
push dword [ebp - 0x4c0]
pop dword [esp + 0x10]
mov dword [esp], 0x7e98ca4c
mov byte [esp], dh
push edx
jmp 0x100b0d24

Function at 0x100a8888
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x34], 0x20712f66
mov byte [esp + 8], 0x62
mov dword [ebp - 0x30], 0x22732522
mov byte [esp + 4], 8
jmp 0x1009cde5

Function at 0x100a8ca4
Capabilities:
Parse pe header

Disassembly:
cmc
mov dword [ebp - 0x490], edx
push dword [esp + 4]
cmc
clc
add ecx, eax
cmp sp, ax
mov word [esp], sp
cmc
mov dword [ebp - 0x498], eax
neg ax
stc
rcr ah, cl
or al, 0x6f
mov eax, 0x5a4d
add esp, 0x48
jne 0x100ae332
mov dword [ebp - 0x48c], ecx
pushfd
jmp 0x100a823f
clc
mov dword [ebp - 0x48c], ecx
pushal
cmp word [0x10018610], ax
pushfd
lea esp, [esp + 0x24]
jne 0x1009f64c
bswap ax
pushal
bswap ax
mov eax, dword [0x1001864c]
clc
pushfd
cmp dword [eax + 0x10018610], 0x4550
call fcn.100aad90

Function at 0x100a8f2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1009feac
call fcn.100a9489
lea edx, [ebx + 0x36e1d130]
push 0
cdq
rdtsc
setns dh
mov eax, dword [ebp - 0x4c4]
not dh
sete dh
sete dh
setne dl
push 0
mov dl, 0xf6
pushal
mov dword [esp + 0x1c], 0
lea edx, [ebx*8 + 0x62b2c2a7]
not dl
mov dword [esp + 0x18], 0
movsx dx, dl
pushal
bswap dx
mov dword [esp + 0x34], 0
pop edx
pop edx
bswap dx
mov dword [esp + 0x28], 0
movsx edx, bl
jmp 0x100afa39
lea esp, [esp + 0x28]
je 0x1009f64c
rdtsc
rdtsc
push 0
lea edx, [edi + 0x303a2119]
seta al
push 0
lea edx, [edi + 0x7848677f]
cdq
jmp 0x100a80b4
setbe dl
mov dword [esp + 0x24], 0
movsx edx, dl
pushfd
setb dl
mov dword [esp + 0x24], 0
push 0x7794b2da
cdq
mov byte [esp + 0xc], 0xc5
pushfd
xchg dword [esp + 0x28], edx
bswap dx
xchg dword [esp + 0x24], eax
lea edx, [esp + 0x61d113a]
mov eax, dword [ebp - 0x484]
bswap edx
bswap dx
mov dword [esp + 0x20], 0
call fcn.100b11a3
mov dword [esp + 0x2c], eax
push dword [esp + 8]
mov dword [ebp - 0x38], 0
mov byte [esp + 0x10], 3
pushfd
jmp 0x1009f08c
Function at 0x100a950e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
pushfd
mov dword [esp + 0x3c], eax
push dword [esp]
pop eax
mov eax, 0x10009342
mov byte [esp + 4], ah
pushfd
pushfd
push edi
mov eax, dword [eax + 0xa1458]
call fcn.100b0e77
push esi
lea eax, [eax + 1]
jmp 0x100a8f0a

Function at 0x100a9bbb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ecx + 0xa1b1f]
pushfd
push dword [esp + 4]
call fcn.100a34e6
jmp 0x100a2694

Function at 0x100aad01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stc
push dword [esp + 8]
mov dword [ebp - 0x40c], 0x680063
stc
cmc
mov dword [ebp - 0x408], 0x73006f
mov byte [esp + 0xc], 0x7b
cmp al, 0xc2
pushal
mov dword [ebp - 0x404], 0x2e0074
test esi, 0x208751c0
mov dword [ebp - 0x400], 0x780065
pushfd
mov byte [esp + 4], bh
clc
mov word [esp], 0x13d6
mov dword [ebp - 0x3fc], 0x65
test ah, 0x2b
cmp bx, bp
push ecx
mov byte [esp + 4], al
mov dword [ebp - 0x428], 0x680043
call fcn.100ae167

Function at 0x100af13d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x38], 0x2f206c65
mov word [esp], si
mov byte [esp], ch
pushfd
lea esp, [esp + 0x3c]
jp 0x100a0077
mov dword [ebp - 0x34], 0x20712f66
jmp 0x100afd07
pushfd
pushfd
call fcn.100a0686

Function at 0x100bc83e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je 0x100bc187
cmc
bts edx, 0x1d
btc si, si
mov esi, dword [eax + 0x3c]
rol dh, cl
add esi, eax
bt cx, 5
rol edx, cl
not dx
mov edx, dword [esi + 0x78]
bt di, 0xf
bt cx, di
pushfd
test edx, edx
pushfd
mov byte [esp], 0x39
mov byte [esp + 4], 0xc8
pushal
lea esp, [esp + 0x28]
je 0x100bc187
rcl ecx, cl
sbb ch, 0x19
add edx, eax
or ecx, ebx
and cx, si
not ch
pushfd
mov ecx, dword [esi + 0x7c]
cmc
cmc
add ecx, edx
mov word [esp], bx
call fcn.100b4e6e
push 0xed9a9be
neg ax
sub esp, 0x14
adc al, dl
rcl ah, 1
add ah, 0xc
push esi
cmp al, 0x79
push edi
rcl ax, 0xb
push ebx
sar ah, 7
movsx eax, dl
movzx ax, al
sub ah, al
push edx
bsf ax, cx
stc
mov eax, dword [ebp + 8]
test bl, 0x4b
jmp 0x100bc832
test al, bh
cmp ax, ax
test eax, eax
call fcn.100b2967
inc eax
sub ax, 0x1601
cmp al, bl
push ebp
aam 0xdf
mov ebp, esp
shld eax, ebx, cl
je 0x100b2f33
btc ax, ax
add ah, 0x9a
sub esp, 0x18
lea eax, [0xfb5f9e80]
bt dx, dx
movsx eax, cl
push esi
sbb ah, 0xad
push edi
inc al
pushfd
pop eax
lahf
push ebx
cmp bh, bh
inc al
bswap ax
push edx
rcl ah, cl
neg al
bt ax, cx
mov eax, dword [ebp + 8]
cmc
test eax, eax
push esp
pushfd
mov byte [esp + 4], 0x95
jmp 0x100b2a63