joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100de570
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x103
push eax
push str._APPDATA_TencentQQDoctor_
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 8]
push ecx
call fcn.100de310
add esp, 4
test eax, eax
je 0x100de5de
mov eax, dword [esp + 0x110]
lea edx, [esp + 8]
push 0x103
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x100de5f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x103
push eax
push str._ALLUSERSPROFILE_Application_DataTencentQQPCMgr_
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 8]
push ecx
call fcn.100de310
add esp, 4
test eax, eax
je 0x100de65e
mov eax, dword [esp + 0x110]
lea edx, [esp + 8]
push 0x103
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x100deea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100e46f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x18]
mov dword [esi], 0x100e80d0
call fcn.100e1a80
mov cl, byte [esp + 0xf]
xor eax, eax
mov dword [esp + 0x1c], eax
mov byte [esi + 0x34], cl
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
lea ecx, [esi + 4]
xor edi, edi
mov ebx, ecx
mov dword [esi], fcn.100defa0
mov edx, 1
push esi
mov dword [ebx], edi
mov byte [esp + 0x20], dl
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [esi + 8], edx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], edx
mov dword [ecx], edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
call fcn.100defa0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100defe0
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x310
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
mov byte [esp + 0x21c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov esi, dword [esp + 0x324]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push esi
xor ebp, ebp
mov dword [esp + 0x18], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100df184
lea eax, [esp + 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100df184
push 0x104
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
mov ebp, dword [sym.imp.MSVCRT.dll__mbsstr]
lea edx, [esp + 0x20]
push 0x1017e9ac
push edx
call ebp
mov edx, eax
add esp, 0x14
cmp edx, ebx
jne 0x100df0a7
mov dword [esp + 0x10], 1
lea edx, [esp + 0x14]
jmp 0x100df0bc
add edx, 2
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x100df174
inc edx
push 0x1017ec68
push edx
call ebp
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x100df154
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esp + 0x10]
mov byte [esi], bl
cmp eax, ebx
lea eax, [esp + 0x14]
push eax
je 0x100df108
lea ecx, [esp + 0x220]
lea edx, [esp + 0x11c]
push ecx
push 0x1017ee20
push 0x104
push edx
call edi
add esp, 0x14
jmp 0x100df11f
push 0x1017c3a4
lea ecx, [esp + 0x120]
push 0x104
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x118]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100df13f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100df191
mov byte [esi], 0x5c
inc esi
push 0x1017ec68
push esi
call ebp
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x100df0d8
mov eax, dword [esp + 0x324]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100df174
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100df191
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x310
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x310
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x310
ret
Function at 0x100df1a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x103
push eax
push str._ALLUSERSPROFILE_Application_DataTencentQQPCMgr_
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 8]
push ecx
call fcn.100defe0
add esp, 4
test eax, eax
je 0x100df20e
mov eax, dword [esp + 0x110]
lea edx, [esp + 8]
push 0x103
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret
Function at 0x100e0890
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e80f0
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x26c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x124], bl
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x158], ebx
push 0x104
push str.6BE417DD_264A_4678_A036_74D2173ECCEB
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
cmp dword [ebp - 0x158], ebx
jne 0x100e0920
lea ecx, [ebp - 0x25c]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x158], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x104
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x154]
rep stosd dword es:[edi], eax
push 1
push ebx
lea ecx, [ebp - 0x154]
push ecx
push ebx
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.imagehlp.dll_MapAndLoad]
cmp eax, ebx
je 0x100e0a22
mov dword [ebp - 4], ebx
cmp byte [ebp - 0x133], bl
jne 0x100e09fa
mov eax, dword [ebp - 0x148]
mov cx, word [eax + 0x18]
cmp cx, 0x10b
jne 0x100e098f
add eax, 0x98
jmp 0x100e099b
cmp cx, 0x20b
jne 0x100e09fa
add eax, 0xa8
mov dword [ebp - 0x26c], eax
mov ecx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [eax + ecx]
cmp edx, dword [ebp - 0x128]
ja 0x100e09f4
cmp eax, ebx
je 0x100e09f4
cmp ecx, ebx
je 0x100e09f4
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x27c], ebx
mov edx, dword [ebp - 0x14c]
add eax, edx
mov dword [ebp - 0x260], eax
lea edx, [ecx + eax]
mov dword [ebp - 0x264], edx
cmp eax, edx
jae 0x100e09fa
mov ecx, dword [eax]
cmp ecx, ebx
je 0x100e09f4
lea eax, [ecx + eax + 7]
and al, 0xf8
mov dword [ebp - 0x260], eax
jmp 0x100e09dc
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x100e0a15
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.imagehlp.dll_UnMapAndLoad]
mov eax, dword [ebp - 0x158]
cmp eax, ebx
je 0x100e0a40
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e0d00
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
push ebp
push esi
push edi
mov edi, dword [esp + 0x214]
test edi, edi
jne 0x100e0d21
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x204
ret
mov esi, dword [esp + 0x218]
test esi, esi
jg 0x100e0d3b
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
add esp, 0x204
ret
mov eax, dword [esp + 0x224]
test eax, eax
jne 0x100e0d55
pop edi
pop esi
mov eax, 0xfffffffd
pop ebp
add esp, 0x204
ret
mov eax, dword [esp + 0x220]
test eax, eax
jg 0x100e0d6f
pop edi
pop esi
mov eax, 0xfffffffc
pop ebp
add esp, 0x204
ret
mov ecx, dword [esp + 0x21c]
test ecx, ecx
jne 0x100e0d89
pop edi
pop esi
mov eax, 0xfffffffb
pop ebp
add esp, 0x204
ret
mov ebp, dword [esp + 0x228]
test ebp, ebp
jg 0x100e0da3
pop edi
pop esi
mov eax, 0xfffffffa
pop ebp
add esp, 0x204
ret
cmp eax, ebp
jge 0x100e0db6
pop edi
pop esi
mov eax, 0xfffffff9
pop ebp
add esp, 0x204
ret
xor edx, edx
xor ecx, ecx
mov al, byte [edx + edi]
mov byte [esp + ecx + 0x10], cl
mov byte [esp + ecx + 0x110], al
lea eax, [edx + 1]
cdq
idiv esi
inc ecx
cmp ecx, 0x100
jl 0x100e0dba
xor ecx, ecx
push ebx
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + eax + 0x114]
mov bl, byte [esp + eax + 0x14]
add ecx, edx
add ecx, ebx
and ecx, 0x800000ff
jns 0x100e0dff
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + eax + 0x14]
mov dl, byte [esp + ecx + 0x14]
mov byte [esp + ecx + 0x14], bl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x100
jl 0x100e0ddc
xor esi, esi
xor ecx, ecx
test ebp, ebp
jle 0x100e0e9d
mov eax, dword [esp + 0x220]
mov edi, dword [esp + 0x228]
sub edi, eax
inc ecx
and ecx, 0x800000ff
jns 0x100e0e40
dec ecx
or ecx, 0xffffff00
inc ecx
xor edx, edx
mov dl, byte [esp + ecx + 0x14]
add esi, edx
and esi, 0x800000ff
jns 0x100e0e58
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esp + esi + 0x14]
mov bl, byte [esp + ecx + 0x14]
mov byte [esp + 0x10], dl
mov byte [esp + esi + 0x14], bl
mov ebx, dword [esp + 0x10]
mov byte [esp + ecx + 0x14], dl
xor edx, edx
and ebx, 0xff
mov dl, byte [esp + esi + 0x14]
add edx, ebx
and edx, 0x800000ff
jns 0x100e0e8e
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [esp + edx + 0x14]
mov bl, byte [edi + eax]
xor dl, bl
mov byte [eax], dl
inc eax
dec ebp
jne 0x100e0e2f
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x204
ret
Function at 0x100e0eb0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
push ebp
push esi
push edi
mov edi, dword [esp + 0x214]
test edi, edi
jne 0x100e0ed1
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x204
ret
mov esi, dword [esp + 0x218]
test esi, esi
jg 0x100e0eeb
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
add esp, 0x204
ret
mov eax, dword [esp + 0x21c]
test eax, eax
jne 0x100e0f05
pop edi
pop esi
mov eax, 0xfffffffd
pop ebp
add esp, 0x204
ret
mov eax, dword [esp + 0x220]
test eax, eax
jg 0x100e0f1f
pop edi
pop esi
mov eax, 0xfffffffc
pop ebp
add esp, 0x204
ret
mov ecx, dword [esp + 0x224]
test ecx, ecx
jne 0x100e0f39
pop edi
pop esi
mov eax, 0xfffffffb
pop ebp
add esp, 0x204
ret
mov ebp, dword [esp + 0x228]
test ebp, ebp
jg 0x100e0f53
pop edi
pop esi
mov eax, 0xfffffffa
pop ebp
add esp, 0x204
ret
cmp eax, ebp
jge 0x100e0f66
pop edi
pop esi
mov eax, 0xfffffff9
pop ebp
add esp, 0x204
ret
xor edx, edx
xor ecx, ecx
mov al, byte [edx + edi]
mov byte [esp + ecx + 0x10], cl
mov byte [esp + ecx + 0x110], al
lea eax, [edx + 1]
cdq
idiv esi
inc ecx
cmp ecx, 0x100
jl 0x100e0f6a
xor ecx, ecx
push ebx
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + eax + 0x114]
mov bl, byte [esp + eax + 0x14]
add ecx, edx
add ecx, ebx
and ecx, 0x800000ff
jns 0x100e0faf
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + eax + 0x14]
mov dl, byte [esp + ecx + 0x14]
mov byte [esp + ecx + 0x14], bl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x100
jl 0x100e0f8c
xor esi, esi
xor ecx, ecx
test ebp, ebp
jle 0x100e104d
mov eax, dword [esp + 0x220]
mov edi, dword [esp + 0x228]
sub edi, eax
inc ecx
and ecx, 0x800000ff
jns 0x100e0ff0
dec ecx
or ecx, 0xffffff00
inc ecx
xor edx, edx
mov dl, byte [esp + ecx + 0x14]
add esi, edx
and esi, 0x800000ff
jns 0x100e1008
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esp + esi + 0x14]
mov bl, byte [esp + ecx + 0x14]
mov byte [esp + 0x10], dl
mov byte [esp + esi + 0x14], bl
mov ebx, dword [esp + 0x10]
mov byte [esp + ecx + 0x14], dl
xor edx, edx
and ebx, 0xff
mov dl, byte [esp + esi + 0x14]
add edx, ebx
and edx, 0x800000ff
jns 0x100e103e
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [esp + edx + 0x14]
mov bl, byte [edi + eax]
xor dl, bl
mov byte [eax], dl
inc eax
dec ebp
jne 0x100e0fdf
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x204
ret

Function at 0x1018294c
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx cx, al
not ecx
not cl
mov ecx, dword [ebp - 0x440]
call fcn.101c4b6f

Function at 0x1018295f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x10197201
and cl, 0x80
lea ecx, [ebp - 0x1f8]
cmp sp, 0xf330
test dl, 0x88
push ecx
sbb ch, cl
dec cx
mov ecx, dword [ebp - 0x20c]
cmp di, 0xa4d5
add ecx, 0x3c
call fcn.101b5068
pushfd
movsx edx, al
lea edx, [edi - 0x49bbd1f5]
mov dword [esp], eax
setb dh
setbe dh
movzx dx, cl
push str.TSLU_08x
mov dh, ch
movzx edx, al
pushfd
mov dword [esp], pe_nt_image_headers32
pushal
push eax
lea edx, [ebp - 0x214]
mov byte [esp + 4], 0xd4
mov dword [esp + 0x20], edx
pushfd
call fcn.1019264b
Function at 0x10184576
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x208], edx
lea esp, [esp + 0x30]

Function at 0x10185b7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
push 0x5142a668
mov word [esp], 0x83c5
lea esp, [esp + 4]
call sub.MSVCRT.dll_memset
xadd ch, al
cwde
add esp, 0xc
rdtsc
lea edx, [ebp*8 + 0x79347452]
movzx ax, cl
pushfd
lea ecx, [ebp - 0x228]
rdtsc
lea eax, [0x21f91dcd]
bswap dx
bswap dx
xchg dword [esp], ecx
push esp
movsx dx, bl
mov edx, dword [ebp - 0x28]
xchg cx, ax
pushal
bswap cx
mov dword [esp + 0x20], edx
movsx eax, al
pop ecx
xchg ah, cl
not ecx
mov dword [esp + 0x18], 0x1012f2a4
pushfd
setle ah
mov eax, dword [ebp - 0x220]
movzx cx, al
mov dword [esp + 0x18], eax
lea ecx, [eax - 0x48199323]
bswap cx
movsx cx, dl
pushfd
lea ecx, [ebp - 0x21c]
jmp 0x10196339
push dword [esp + 4]
mov byte [esp + 4], 0x7a
pushfd
mov dword [esp + 0x20], ecx
call fcn.101b10d0
xor byte [edx + 0x19], ch
sbb bl, ah
xchg esi, eax
mov cl, 0x70
pop es
push ds
int 0xc0
xor ch, byte [bx + di + 0x68]
mov ch, 0xf5
dec esi
outsb dx, byte [esi]
or ebx, dword [esi - 0x6d]
pop ebx
cld
inc ebp
cmp eax, 0xdcacd83d
hlt

Function at 0x1018658f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0xf20b
lea esp, [esp + 0xc]
je 0x101c8c6c
push 0x5cc96866
mov edx, dword [ebp - 8]
pushal
mov dword [ebp - 0x158], edx
call fcn.1018b52b
call fcn.101c88da

Function at 0x10186e52
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0x10188160
push ebx
mov byte [esp], dh
lea esp, [esp + 4]
jmp loc.101c8ee8

Function at 0x10187387
Capabilities:
Encode data using xor

Disassembly:
invalid
scasb al, byte es:[edi]
sub esp, esp
call fcn.101bb4b6
mov edi, 0x746dbabb
or esp, edx
in eax, dx
js 0x10187411
inc edx
aad 0x88
inc ebx
jp 0x10187325
inc edx
rol byte [0x74da17e1], cl
cmpsb byte [esi], byte es:[edi]
call [esi + 3]
xchg ebp, eax
inc ebp
jne 0x10187384
or ebp, dword [eax + 0x21be6fa0]
mov al, byte [0x7289075c]
leave
adc byte [edi + 0x5320c55a], dl
cld
pushfd
cmp dword [ecx], esp
clc
jo 0x1018742f
push 0xffffffffffffff94
xchg esp, eax
mov bh, byte [edx + 0x1f]
mov edi, 0x4cd3dfe0
cld
inc ecx
sub dword [edi + esi + 0x40], ebp
xor eax, 0x8386f7a4
jge 0x101873c4
invalid
stc
mov ebx, 0x839cf560
jge 0x1018740b
add byte [ecx - 0x16fbdb94], cl
lds eax, [ebx + eax - 0x6bbd1700]
add al, byte [eax]
je 0x10187455
and al, 0xc2
xor byte [eax], al
out 0xff, eax
pushfd
mov dword [ebp - 0x344], eax
jmp 0x10194fff
mov ecx, dword [ebp - 0x344]
jmp 0x101a7f03
Function at 0x10188173
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 8
pushal
call fcn.1019c390
loopne 0x10188108
test byte [edi - 0x1a], ah
fldenv [ebx + ebx*2 - 0x783322da]
xor al, 0x1d
inc edx
dec ebx
mov bh, 0xee
stc
pushfd
jg 0x10188111
adc eax, 0x9b70019a
jbe 0x10188160
out dx, al
out dx, eax
xchg ebx, eax
mul byte [ecx + 0x3cd14980]
mov esi, 0x8855d6fa
inc esp
mov eax, dword [0x2ea1c8a0]
wait
adc al, 0x93
mov eax, 0xbc3b504
test eax, 0x176eb368
lahf
pop ss
fcom qword [eax]
imul ebx, dword [edx + 0x228708f1], 0xffffffb9
or al, 0x4f
or bl, byte [ebp - 0x377726cc]
xor al, 0xd9
mov al, cl

Function at 0x1018a2d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
call fcn.10050be0
jmp loc.101c2937

Function at 0x1018e52f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edx
pushfd
push 0x45d860a2
push 0x69d43bba
pushal
lea esp, [esp + 0x34]
call sub.MSVCRT.dll_memcmp
jmp fcn.10024f1d

Function at 0x1018f898
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [edi + 0x3c250978]
mov ecx, dword [ebp - 4]
pushal
mov byte [esp], ah
mov dword [esp + 0x24], ecx
mov byte [esp], dh
lea esp, [esp + 0x24]
call fcn.10004d60
call fcn.101c3426
jmp 0x10183ccd

Function at 0x10193e92
Capabilities:
Encode data using xor

Disassembly:
cmp byte [eax + 0x26d8ee8], bl
add bh, bh
push dword [esp]
push dword [esp]
pushfd
mov dword [esp + 0x48], 0
push 0x4fcb1adb
mov byte [esp], dl
mov dword [esp + 0x48], 0x101aaa70
call fcn.1018e214
adc al, 0x4e
push ecx
add al, 0xfb
mov edx, 0xf60b6859
lds eax, [eax + 0x54513687]
and esp, dword [ebp*2 - 0x60a72af1]
push esp
sub dword [edi - 0x25], esp
and al, 0xda
popfd
adc dl, dh
add dl, ch
dec edx
loopne 0x10193e8a
sbb dword [ebp + ebp*4 - 0x2c], esi
stosd dword es:[edi], eax
dec eax
wait
dec esp
dec ebp
cmp eax, 0x7cf0e
dec edx
mov ebx, eax
in al, dx
or byte [eax - 0x50836e27], dl
and ch, byte [ebp - 0xa61e49c]
inc esp
mov edi, 0xe5da6866
invalid

Function at 0x101a1e2d
Capabilities:
Packed with generic packer

Disassembly:
pushfd
test ch, ah
push dword [esp]
xchg dword [esp + 4], edi
ror di, 7
sub di, 0x422f
mov dword [ebp - 0x208], ecx
pushal
or cl, 0xc3
sar cx, cl
mov byte [ebp - 0x204], 0
call fcn.101be95b
pushfd
pushfd
clc
test dl, bh
cmp dword [ebp - 0x14], eax
jmp 0x101a8627
pushal
jmp loc.1004e7c3
cmp ebp, 0x22bce371
pushal
push esp
mov dword [esp + 0x20], ebp
bt si, si
add bp, 0x46b4
lea ebp, [esp + 0x20]
test di, ax
mov byte [esp + 8], 0xf5
clc
bt di, 1
sub esp, 0x1e8
jmp 0x101a1e01
Function at 0x101a3a2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], eax
pushfd
push dword [esp + 0x18]
pushal
mov byte [esp], dl
lea esp, [esp + 0x44]
call sub.MSVCRT.dll_memset
test cl, ah
test sp, 0x6b7b
and ax, bp
rol ah, 3
add esp, 0xc
rdtsc
setle cl
rdtsc
push ebx
lea ecx, [ebp - 0x228]
mov al, byte [esp]
lea edx, [ecx*4 - 0xfbfcdc2]
xchg dx, ax
mov dword [esp], ecx
cwde
xchg dl, cl
mov edx, dword [ebp - 0x28]
movsx ax, bl
movzx ax, al
push edx
seto ah
push 0x1012f2a4
sets ah
pushal
mov eax, dword [ebp - 0x220]
movzx ecx, bl
jmp loc.10184bce
mov eax, dword [ebp - 0x28]
jmp 0x1019f6c9

Function at 0x101a4ae2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushal
lea esp, [esp + 0x44]
jne 0x101cac86
pushfd
push 0x906a62f2
mov byte [esp + 4], ah
lea esp, [esp + 8]
jmp fcn.10190c89

Function at 0x101a4ff6
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
neg cx
mov ecx, dword [ebp + 8]
push 0x9ca37485
add ecx, 0x10
pushfd
lea esp, [esp + 8]
call fcn.1001bd73
stc
pushal
pushal
cmc
test eax, eax
call fcn.101ad3d1
sbb ebx, esp
mov edi, 0xc32c6596
salc
popal
push eax
adc eax, dword [esi + 0x17]
test eax, esp
inc ebx
or al, 0x1d
ficomp dword [esi + 0x71]
add ch, byte [edi + 0x7c]
inc ebx
dec ebx
hlt

Function at 0x101a5471
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jne 0x10188160
pushal
lea esp, [esp + 0x20]
jmp loc.101c8ee8

Function at 0x101a6f85
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
call fcn.1000c790
stc
add esp, 0xc
push edx
pushal
push 0x43faaffb
push dword [esp]
mov dword [esp + 0x28], 1
push edi
mov word [esp], di
mov dword [esp + 0x28], 0x1017f270
pushfd
mov dword [esp + 0x28], 0x100f915c
jmp loc.10183cb0

Function at 0x101a708d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x1003ebfd
pushal
pushfd
lea esp, [esp + 0x24]
jmp fcn.101b63be

Function at 0x101a8457
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
jae 0x101c1373
ror ax, 0xc
push 0x200
not cl
bts dx, bx
lea ecx, [ebp - 0x204]
rcl dh, 7
bt bx, 7
push ecx
stc
rcr ah, 5
rol dh, cl
ror dl, cl
mov edx, dword [ebp - 0x414]
btc ax, bp
clc
imul edx, edx, 0x21c
mov ax, ax
not ax
mov eax, dword [ebp + 8]
movsx ecx, al
lea ecx, [eax + edx + 0x24]
jmp loc.1018b56c
lea esp, [esp + 0x44]
jnp 0x101a5c72
jae 0x101c1373
pushfd
cmc
mov dword [esp], 0x200
lea edx, [ecx*2 + 0x2725b402]
setg cl
lea ecx, [ebp - 0x204]
movsx dx, al
push ecx
mov ch, bh
btr cx, si
btr cx, 0xd
cdq
mov edx, dword [ebp - 0x414]
bts eax, esi
imul edx, edx, 0x21c
mov ax, 0x6b6b
mov eax, dword [ebp + 8]
push 0xee08ae0d
movzx cx, bl
lea ecx, [eax + edx + 0x24]
push dword [esp]
mov byte [esp + 4], 0xe
mov dword [esp + 4], ecx
movzx ecx, cl
pop ecx
mov ecx, dword [ebp - 0x420]
call fcn.10041dd2
pushal
pushal
pushfd
mov byte [esp], dh
lea esp, [esp + 0x44]
call fcn.1000612d
bswap ecx
lea ecx, [ecx*2 + 0x3dabd67c]
lea ecx, [ebp - 0x48]
jmp fcn.1001a388
mov al, cl
cwde
movzx ax, dl
mov dword [ebp - 0x418], 1
Function at 0x101a8925
Capabilities:
Resolve dns

Disassembly:
call fcn.10187ba5
movsd dword es:[edi], dword [esi]
jmp 0x101b76e0
lea esp, [esp + 8]
call sub.WS2_32.dll_gethostbyname
jg 0x1004b2ec
push 0x19b0a836
pushal
mov dword [ebp - 0x28], eax
mov byte [esp + 8], al
jmp 0x101b90dc
mov byte [esp + 8], 0xc6
push dword [esp]
cmp dword [ebp - 0x28], 0
jmp 0x101a514a

Function at 0x101aa06f
Capabilities:
Execute anti-debugging instructions

Disassembly:
test eax, eax
pushal
mov dword [esp], 0x914d7b91
jmp fcn.1018f67c

Function at 0x101aab5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
lea esp, [esp + 0x2c]
jne 0x101884c8
pushfd
mov byte [esp], dh
pushal
pushal
lea esp, [esp + 0x44]
jmp fcn.1005ed3f

Function at 0x101ae703
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
sar cl, 5
bt esp, ebx
neg ch
mov ecx, dword [ebp - 0x20c]
test ch, dh
jmp loc.101ab9d4
push eax
mov byte [esp], 0x94
pushfd
lea esp, [esp + 8]
jmp fcn.10184580
pushfd
pushfd
mov word [esp], ax
lea esp, [esp + 8]
je 0x1003f0eb
test al, cl
mov edx, dword [ebp - 0x204]
btc ax, 1
cmp dl, al
mov eax, dword [edx]
cmp bl, 0xa2
pushfd
cmp eax, dword [ebp - 0x1f8]
pushfd
pushal
lea esp, [esp + 0x28]
jne 0x101c1c6b
pushfd
pushfd
push edx
lea esp, [esp + 0xc]
jmp 0x1003f0eb
pushfd
lea esp, [esp + 0x2c]
jne 0x10197201
add cl, al
inc cl
shld cx, di, 0xe
mov ecx, dword [ebp - 0x20c]
cmc
add ecx, 0x3c
pushfd
lea esp, [esp + 4]
call fcn.10050be0
jo 0x101bf0aa
pushal
push dword [esp]
mov byte [esp + 4], dl
mov dword [ebp - 0x204], eax
pushal
push ecx
mov byte [esp], 0x21
lea esp, [esp + 0x48]
jmp 0x101c4289
lea esp, [esp + 0x24]
call fcn.10050c00
cmp bx, si
test ax, cx
cmp dword [ebp - 0x204], eax
push ebp
pushfd
lea esp, [esp + 8]
jns 0x1019be07
je 0x1003f0eb
aaa
ror eax, 0x11
mov edx, dword [ebp - 0x204]
sbb ah, cl
aas
or ah, 0xb5
mov eax, dword [edx]
cmp bx, 0x4629
pushal
test di, si
cmp eax, dword [ebp - 0x1f8]
pushal
lea esp, [esp + 0x40]
jne 0x101c1c6b
push esi
push edi
mov byte [esp + 4], 0x41
pushal
lea esp, [esp + 0x28]
jmp 0x1003f0eb
pushfd
pushfd
mov dword [ebp - 0x204], eax
pushfd
push 0x1b26f31b
pushfd
push 0x438a6513
lea esp, [esp + 0x18]
jmp 0x101c4289
pushal
lea esp, [esp + 0x20]
jmp 0x101c425d
rcr ch, cl
push esi
cmp al, ch
mov ecx, dword [ebp - 0x204]
bt bx, 0xa
mov word [esp], 0x970
bt cx, sp
add ecx, 0x1e0
pushal
stc
clc
mov dword [ebp - 0x204], ecx
add esp, 0x24
cmc
mov ecx, dword [ebp - 0x20c]
cmc
push ebp
mov byte [esp], 6
add ecx, 0x3c
pushal
jmp 0x101af3bd