joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43efa8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x463988]
cmp byte [eax + 0xc], 0
je 0x43f115
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f10e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x464b6c], 0
jne 0x43effc
push 0x43f11c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43f124
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b6c], eax
cmp dword [0x462b20], 0
jne 0x43f0f7
push 0x43f134
call sub.kernel32.dll_LoadLibraryA
mov dword [0x462b20], eax
cmp dword [0x462b20], 0
je 0x43f0f7
push 0x43f140
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b70], eax
push 0x43f150
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b74], eax
push 0x43f164
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b78], eax
push 0x43f17c
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b7c], eax
push 0x43f194
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b80], eax
push 0x43f1a8
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b84], eax
push 0x43f1c0
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b88], eax
push 0x43f1d8
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b8c], eax
push 0x43f1f4
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b90], eax
push 0x43f200
mov eax, dword [0x462b20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x464b94], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f115
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x442fa0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040407c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x442fef
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004042ec
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44a7ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44a7fc]
test si, 4
je 0x44a7c0
or bl, 1
test si, 8
je 0x44a7ca
or bl, 4
test si, 1
je 0x44a7d4
or bl, 8
test si, 2
je 0x44a7de
or bl, 0x10
test si, 0x10
je 0x44a7e8
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44a7f7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44a800
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44a838]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44a819
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44a828
or bl, 4
test esi, 0x20000000
je 0x44a833
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x450ee0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x450ef2
add esp, 0xfffffff0
call fcn.004035cc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041dfbc
mov eax, dword [0x463500]
mov dword [eax + 4], ebx
mov dword [eax], 0x451284
mov eax, dword [0x46350c]
mov dword [eax + 4], ebx
mov dword [eax], 0x451290
mov eax, ebx
call fcn.0045129c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4150b8]
call fcn.00403278
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4150b8]
call fcn.00403278
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4150b8]
call fcn.00403278
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4150b8]
call fcn.00403278
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4150b8]
call fcn.00403278
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44d6b8
push eax
push 0
push 0
mov eax, dword [0x4636d8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41fa10]
call fcn.0042114c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41fa10]
call fcn.0042114c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41fa10]
call fcn.0042114c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004516bc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451598
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451598
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451598
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45102f
call fcn.00403624
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45137c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451527
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x451508
mov dl, 1
mov eax, dword [0x41571c]
call fcn.00403278
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040407c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4514f7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043f308
test al, al
je 0x4514ea
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x451538
lea eax, [ebp - 0x254]
call fcn.00408e50
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4514ea
xor eax, eax
push ebp
push 0x4514e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x451570
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4514cc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004042ec
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4514cc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004042ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4514ea
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4513ed
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419af0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45152e
lea eax, [ebp - 0x260]
call fcn.0040407c
ret

Function at 0x451e5c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x464bb8]
cmp byte [eax + 0xa5], 0
jne 0x451ecd
cmp dword [0x464bd0], 0
jne 0x451e8e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x451e18
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x464bd0], eax
cmp dword [0x464bcc], 0
jne 0x451ea9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x464bcc], eax
cmp dword [0x464bd4], 0
jne 0x451ecd
push esp
push 0
push 0
push 0x451dbc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x464bd4], eax
pop edx
ret
Function at 0x451fc4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x451fdb
add esp, 0xfffffff0
call fcn.004035cc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041dfbc
mov eax, dword [0x4636bc]
cmp word [eax + 2], 0
jne 0x452003
mov eax, dword [0x4636bc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045369c
mov eax, dword [0x4637b8]
cmp word [eax + 2], 0
jne 0x45201d
mov eax, dword [0x4637b8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453894
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4150b8]
call fcn.00403278
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4150b8]
call fcn.00403278
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4204b8]
call fcn.00427d84
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4521a4
mov eax, dword [0x463590]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00428154
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x453e44
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x463590]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c614
test eax, eax
je 0x452112
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408844
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c63c
test eax, eax
je 0x452126
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004042ec
mov eax, dword [0x4633ec]
cmp byte [eax], 0
jne 0x45215a
mov eax, ebx
call fcn.004522cc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00454020
mov eax, ebx
call fcn.004549e4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45219a
call fcn.00403624
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45254c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x464bb8]
cmp dword [eax + 0x30], 0
je 0x4525f6
cmp dword [ebx + 0x94], 0
jne 0x4525f0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4524dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4525f0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4525b6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4525f0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417770
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4525c5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453158
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45318d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040416c
jmp 0x45319a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004040d0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4541fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45423d
mov eax, esi
call fcn.0043a9c8
test al, al
je 0x45423d
mov eax, dword [ebx + 0x84]
call fcn.0043a708
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45423d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a708
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45a460
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414668]
call fcn.004049e8
xor eax, eax
push ebp
push 0x45a5a4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46336c], 0
jne 0x45a4b3
mov ecx, dword [0x463410]
mov dl, 1
mov eax, dword [0x407208]
call fcn.0040b84c
call fcn.00403a34
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402cbc
mov eax, ebx
call fcn.004048b8
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45a5b4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040596c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004048c8
test eax, eax
jle 0x45a54b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45a544
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404304
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004042ec
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408014
test eax, eax
jne 0x45a544
mov ebx, 0x15
jmp 0x45a550
mov ebx, 0x10
jmp 0x45a550
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46336c]
call fcn.0045a3b8
mov eax, dword [ebp - 8]
call fcn.0045a3b8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a5ab
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004040a0
lea eax, [ebp - 0x10]
mov edx, dword [0x414668]
call fcn.00404ab8
ret
Function at 0x101c3f10
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, di
xchg byte [esp + 0x25], bl
cmc
sub esp, 0x15
jmp 0x101c3f21
clc
rdtsc
mov ch, 0xbc
std
mov cl, 0xe2
pop word [esp + 0x18]
jmp 0x101c3fa5
lea ebx, [ecx*4]
mov ebx, dword [esp + 9]
xchg dword [esp], ecx
jmp 0x101c3f7d
mov bl, 0xd7
mov ecx, edx
setge al
cld
mov dword [esp + 0x33], eax
mov ax, word [esp + 0x13]
jmp 0x101c3f54
mov ax, sp
mov byte [esp + 2], ah
sub esp, 0xb
lea esp, [esp + 0x46]
mov cl, 0xb
mov ecx, ebx
jmp 0x101c3fd1
bswap ecx
xchg ebx, edi
lea ebp, reloc.KERNEL32.dll_GetCurrentProcess
btr cx, dx
rol al, 2
btr ebx, ebx
jmp 0x101c3f6a
mov dword [esp], edx
lea esp, [esp + 2]
sub esp, 6
jmp 0x101c3fe0
rdtsc
mov bp, 0xb0cf
inc esi
lea edi, [edi + 0x7d]
push esp
mov edi, ecx
jmp 0x101c3fbb
lea edi, [ecx*4]
cld
lea ebp, [esi + ebp]
cpuid
call fcn.101c49ea
and eax, 0xd6ab0f66
xchg bp, bx
lea eax, reloc.KERNEL32.dll_GetCurrentProcess
lea edi, [ecx*4]
add esp, 7
jmp 0x101c4041
rol bh, cl
cpuid
lea esp, [esp + 8]
mov bx, word [esp + 2]
bts ecx, ecx
jmp 0x101c409f
mov ecx, dword [esp + 0xa]
mov bp, word [esp + 3]
xchg byte [esp + 1], dl
mov bl, 0x6e
lea edx, [edx*4]
xchg bx, si
jmp 0x101c402b
rdtsc
mov ecx, dword [esp]
mov byte [esp + 2], al
pop di
std
xchg si, bx
jmp 0x101c40af
xchg dh, bh
xchg ah, bh
clc
push word [esp + 2]
xchg cl, al
not dl
jmp 0x101c4089
bsf cx, bx
setns cl
mov ch, 0x43
bsf edi, ebx
mov bx, si
mov ebp, dword [esp]
jmp 0x101c40fb
mov byte [esp + 1], bl
mov cl, byte [esp + 8]
bts esi, ecx
lea edi, [ecx*4]
mov al, 0xf8
jmp 0x101c410f
push dword [esp + 3]
neg al
mov esi, ebx
btr edx, edi
xchg byte [esp + 1], ah
lea ebx, [edi + ebp]
jmp 0x101c40de
bt di, cx
mov edx, esp
lea eax, [ebx*4]
dec ecx
pop esi
add esp, 2
jmp 0x101c4199
mov ah, byte [esp]
add esp, 2
inc edi
inc edi
call fcn.101c4158
pop ax
push dword [esp + 0x27]
rol bl, cl
rdtsc
pop bx
add esp, 2
jmp 0x101c41e7
mov dx, bx
push dword [esp + 1]
std
mov dword [esp + 8], esi
call fcn.101c41fc
and dword [eax - 0x5d], esp
fidiv dword [reloc.KERNEL32.dll_GetCurrentProcess]
mov bl, 0xe1
popal
dec ebx
btr cx, sp
mov word [esp], ax
xchg word [esp + 0x11], ax
mov edi, dword [esp + 0xe]
jmp 0x101c41d1

Function at 0x101c40d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts si, dx
push word [esp + 2]
mov dword [esp], esp
sub dx, 0xbe36
bt ebx, esi
push dword [esp + 0xd]
not eax
jmp 0x101c3ff3
pop word [esp + 8]
mov byte [esp + 0xc], dl
pop dword [esp + 1]
stc
lea eax, [eax*4]
rdtsc
jmp 0x101c4013
lea eax, [ebp*4]
xchg dword [esp + 0xa], ebp
jmp 0x101c4070

Function at 0x101c4158
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
mov ebx, 0xa644f3df
pop si
shl ax, 0
cld
pop dx
jmp 0x101c4176
lea ecx, [ecx - 0x68]
setbe dl
jmp 0x101c4142
clc
lea ebx, [ebx*4]
stc
rdtsc
mov bx, dx
cmc
jmp 0x101c41bc
xchg bh, bl
lea ebp, [ecx + edx]
lea ecx, [eax + ebx]
xchg byte [esp], dl
setle dh
cld
jmp 0x101c4160
rol ecx, cl
not si
mov byte [esp], dh
sub esp, 0x1d
sub esp, 0x17
push word [esp + 0x27]
jmp 0x101c41a6
Function at 0x101c41fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xf
xchg byte [esp + 9], ah
jmp 0x101c4209
mov bl, 0x7e
mov dx, 0x705c
xchg bp, ax
bt ecx, ebx
lea esi, [eax*4]
stc
jmp 0x101c426f
mov dx, ax
mov byte [esp + 6], dh
cld
mov dl, 2
sub esp, 3
mov dl, 0xe8
jmp 0x101c42c8
mov ax, word [esp + 6]
push word [esp + 1]
lea esi, [ebx + edi]
mov dword [esp + 6], eax
jmp 0x101c4240
cpuid
xchg edx, esi
pop esi
and bh, bl
lea edi, [eax*4]
xchg di, bx
jmp 0x101c4256
pushfd
rdtsc
lea eax, [ebx + ebx]
pop edx
pop word [esp + 7]
not bp
jmp 0x101c42ae
mov word [esp + 6], ax
mov word [esp], ax
btc eax, edx
mov bl, bh
mov cl, 0xba
mov eax, dword [esp + 7]
jmp 0x101c4282
lea esi, [eax + ebx]
bswap eax
dec dl
lea ecx, [ebx + esi]
pop dx
rdtsc
jmp 0x101c42e0
xchg cl, al
mov bl, byte [esp + 0xb]
mov word [esp + 2], bx
mov dword [esp + 4], ecx
pop word [esp + 3]
neg ebx
jmp 0x101c4298
push dword [esp + 4]
btr edx, ebx
mov byte [esp + 8], ch
mov word [esp + 2], ax
mov cl, dl
pop dword [esp]
jmp 0x101c4325
mov dl, bl
xchg ebx, ecx
mov al, 0xfa
setnp cl
call fcn.101c466f
xor dword [ecx + reloc.KERNEL32.dll_GetCurrentProcess], ebp
push ecx
retf 0x3f58
setno ah
mov ax, word [esp]
mov cx, sp
lea edx, [eax*4]
pop dword [esp]
lea ecx, [eax + esi]
jmp 0x101c4303

Function at 0x101c46b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xe]
pop bx
cmp dl, ah
jmp 0x101c46d5

Function at 0x101c6d23
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
lea esp, [esp + 1]
cmc
cld
pushal
push sp
jmp 0x101c6cec
lea esp, [esp + 0x15]
lea esp, [esp + 1]
mov dword [esp + 6], ecx
jmp 0x101c6d48
call 0x101c6d23
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor ebp, dword cs:[esi]
xor byte [esi], ch
xor byte [eax], al
pushfd
sub esp, 0xc
mov word [esp + 4], dx
lea esp, [esp + 0xb]
jmp 0x101c6cbf
pushfd
mov ch, byte [esp + 3]
xchg ecx, eax
not eax
lea eax, [edi*4]
jmp 0x101c6ff6
mov ecx, 0xa5de1582
bswap ecx
sets cl
mov ch, dl
rcr cl, cl
mov dword [esp], eax
jmp 0x101c6d32
mov cx, word [esp]
std
rdtsc
mov eax, dword [esp]
mov dx, 0x29ef
lea edx, [eax + edi]
jmp 0x101c6dc8
not dx
cld
sete dl
mov ecx, 0x6e7b159d
shl ecx, cl
mov dx, word [esp]
jmp 0x101c6d78
mov cl, dh
xchg dword [esp + 1], ecx
xchg dword [esp + 3], eax
btc eax, ecx
pop eax
jmp 0x101c6dfa
mov cx, word [esp]
lea ecx, [ecx*4]
lea edx, reloc.KERNEL32.dll_GetCurrentProcess
xchg dx, cx
sub esp, 0xa
lea ecx, [ecx + esi]
jmp 0x101c6db2
mov ax, 0xee77
mov ah, cl
mov dl, 0x8b
xchg cl, ch
call fcn.101c6eac
sub eax, 0xa15237a7
inc esp
pop edx
btc ecx, edi
add esp, 3
sets dh
bsf ax, cx
mov eax, 0xd16d5038
inc edx
jmp 0x101c6de4
not ax
mov dl, byte [esp]
mov eax, 0x7a71c3eb
mov ecx, edi
mov ax, 0x199c
rdtsc
jmp 0x101c6d9e
xchg cx, ax
xchg byte [esp + 1], ah
mov ecx, eax
mov dword [esp], edx
neg cl
mov dl, ah
jmp 0x101c6e19
Function at 0x101c6eac
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
push si
push word [esp + 8]
setb dh
lea edx, [eax + edi]
jmp 0x101c6e92
mov byte [esp + 2], bh
mov ax, 0xc4f5
clc
xor dx, 0xe631
ror cx, cl
mov ecx, dword [esp + 3]
jmp 0x101c6e31
push word [esp + 3]
lea ecx, [edx*4]
xchg word [esp + 1], dx
and cx, cx
pop word [esp + 4]
mov dl, byte [esp + 4]
jmp 0x101c6e47
pop dx
not dh
mov ax, word [esp + 2]
cmc
rdtsc
mov dh, ch
jmp 0x101c6f73
xchg byte [esp], dl
mov dl, byte [esp + 5]
jmp 0x101c6e73
mov al, cl
push word [esp + 0xb]
pop cx
bsr ax, ax
jmp 0x101c6ee7
lea eax, [ebp*4]
rdtsc
xchg word [esp + 2], cx
mov edx, dword [esp]
lea ecx, [ebp*4]
inc dh
jmp 0x101c6eb5
lea esp, [esp + 4]
rol dx, 0xb
xchg byte [esp], dl
mov cx, 0x93ca
mov dx, bx
push word [esp + 1]
call fcn.101c6f33
fnstcw word [eax]
sbb esi, dword [edx + 0x6d]
push dword [esp + 1]
mov edx, dword [esp + 0xc]
mov eax, esp
sete cl
bt cx, ax
mov dl, al
jmp 0x101c6ecb
mov ah, byte [esp + 6]
cmc
clc
xchg word [esp + 1], cx
mov dx, word [esp + 3]
xchg dx, ax
jmp 0x101c6f08

Function at 0x101c6f33
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, reloc.KERNEL32.dll_GetCurrentProcess
xchg byte [esp + 2], dh
pop dword [esp + 6]
cmc
jmp 0x101c6f4b
jmp 0x101c6f1d
xchg ch, al
mov ecx, 0xe840b031
push edx
pushal
pop eax
bt edx, eax
jmp 0x101c6fb6
pop dword [esp]
rdtsc
lea esp, [esp + 3]
sub esp, 0x13
rcr al, 2
bt eax, ecx
jmp 0x101c6f35
lea edx, [edx*4]
std
xchg word [esp + 0x2d], ax
jmp 0x101c6fcc
mov edx, 0xe00b46a6
mov ecx, dword [esp + 7]
neg ax
xchg dx, ax
setb ah
jmp 0x101c6f88
mov cl, byte [esp + 0x29]
mov byte [esp + 3], al
rdtsc
xchg byte [esp + 3], dh
bsf dx, dx
neg ah
jmp 0x101c6f9e
mov edx, dword [esp + 0x14]
pop edx
rdtsc
btc edx, esp
mov dword [esp + 0x25], ebx
std
jmp 0x101c7036
and ecx, ebp
lea edx, [ecx*4]
mov dx, cx
mov ch, 0x93
inc al
dec ax
jmp 0x101c700b
neg al
mov cl, 0x4f
sub esp, 0x18
pop dx
mov cx, bx
cmp al, 0x70
jmp 0x101c7020
rdtsc
bts ax, si
xchg edx, eax
cld
mov word [esp + 3], ax
jmp 0x101c7292
mov ch, 2
pushal
lea esp, [esp + 0x53]
inc ecx
lea ecx, [ebp*4]
xchg dl, ah
jmp 0x101c6fdd
mov ebx, gs
xchg ecx, eax
out dx, eax
mul cl
and byte [esi - 1], ah
je 0x101c7087
push word [esp + 1]
cmc
add ebp, esi
xchg al, dl
or ch, al
call fcn.101c7049
js 0x101c7057
ja 0x101c7084
loope 0x101c70dc
xchg byte [eax], bl
mov gs, ecx
sbb byte [edi - 0x731a8a0b], bl
jg 0x101c7029
in al, 0xc0
loopne 0x101c7086
shl al, 2
push word [esp + 9]
je 0x101c70ac
and al, 9
or ebp, edi
std
add ecx, 0xe063aeb1
pop word [esp + 4]
xchg byte [esp + 1], ch
jmp 0x101c705f
dec ecx
call 0x93fa12bd
in al, dx
or byte [edi], cl
enter 0x74ff, 0x24
add eax, 0xa245489
sub esp, 8
bswap eax
push dword [esp + 5]
mov dword [esp + 0xa], edx
bsf edx, edi
call fcn.101c709b
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x57
cmp al, 0xc3
push ebx
lds esp, ss:[ecx]
add al, byte [edx + ebx - 0x4e9a7383]
mov al, 0xb3
pop dx
pop edx
mov ah, byte [esp + 0xf]
dec cx
btr ecx, esi
sbb ax, 0x82ff
setp ah
jmp 0x101c70b1
pop word [esp + 0xa]
neg ax
mov ch, byte [esp + 0xf]
btr ecx, ebp
add ecx, 0x3895a406
cld
jmp 0x101c7081