joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a686b
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a8301

Function at 0x101a6954
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [edi], edx
mov dword [esp], 0x4a9ea720
jmp loc.10063e4f

Function at 0x101a6b1a
Capabilities:
Terminate process

Disassembly:
mov edx, 0x2b09dc01
xor cl, bl
add cl, dl
sub edx, 0x2a9a729c
ror dword [esp + edx*2 - 0xded2ca], 0xd8
neg cl
not byte [esp + edx*2 - 0xded2ca]
sub edx, edx
setns dl
adc cl, dl
shr edx, 0xde
jp 0x101a5f27
lea esp, [esp + 4]
cbw
bswap ax
mov eax, dword [ebp - 4]
cmovnp ecx, ebx
mov edx, 0x89bcd2a2
sete ch
mov ecx, dword [eax + 0xf8]
bswap ax
cdq
jmp 0x101a6c1a
push 1
mov ecx, 0xe3202980
push str._2_N01p07G0RG1t0680Q01m07G0TG1Y02u0P01i06m0
setg cl
lea ecx, [ebp - 0x2ac]
jmp 0x101a8768
sub esi, 1
mov dword [esp], 0x362f24bf
dec byte [esp + 3]
movzx ecx, byte [esi]
sar word [esp + 1], 0x4d
jae 0x101a25c9
cmp dl, 0x8a
cmc
mov dword [ebp - 0x240], eax
cmp si, 0x75a7
cmp dword [ebp - 0x240], 0x214
jae 0x101a70d7
jmp 0x101a70dc
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
bswap cx
cwde
cmovp eax, esi
mov eax, dword [edx + 0xf4]
cmovg ecx, ebp
movzx dx, bl
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, esp
push ecx
not dl
mov edx, dword [ebp - 0xc]
push edx
jmp 0x101a8610
call fcn.1006bf41
sub ecx, ecx
mov edx, dword [ebp - 0x240]
jmp 0x101a7a97
mov word [ebp + edx - 0x224], cx
jmp 0x101a4e2b
mov eax, dword [0x1019e0ac]
mov dword [ebp - 0x14], eax
cmovb ecx, edi
movzx cx, bh
mov ecx, dword [ebp + 8]
bswap edx
xchg edx, edx
push ecx
jmp 0x101a8434
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
jmp 0x101a8e16
call fcn.10064690
add esp, 8
jmp 0x101a8036
call fcn.100258b0
mov dword [ebp - 0x294], eax
sets ah
movsx eax, sp
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x298], eax
mov dword [ebp - 4], 5
mov ecx, ebp
mov ecx, dword [ebp - 0x298]
jmp 0x100633aa

Function at 0x101a6b9e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a6d0e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xe4343580
add edi, 2
add word [esp + 1], 0xfa20
not cl
mov dword [esp + 4], 0x3f1ee7b9
not al
and cl, al
push 0xb520371d
call fcn.101a7a92

Function at 0x101a6d38
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], dx
mov dword [esp], 0x286b400
mov byte [esp + 9], 0x89
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a6d97
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.10064c55
mov eax, 0xf917bab8
mov ax, word [edi]
mov ecx, 0x2192ca37
mov cx, word [edi + ecx*2 - 0x4325946c]
add edi, 2
call fcn.101a3e45
mov dword [edi], ebp
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101a6e0e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a6ec3
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], dx
lea esp, [esp + 4]
jmp fcn.101a9e3e
adc edi, 1
jmp 0x101a5151
Function at 0x101a6eff
Capabilities:
Terminate process

Disassembly:
mov word [edi], bp
push 0x52be1134
lea esp, [esp + 8]
jmp fcn.101a8301

Function at 0x101a6f17
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x91865223
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a6f25
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea edx, [esp + 0xb4]
push 0x80ac65be
mov dword [esp + 4], 0x943c6306
push 0xf2b03398
cmp edi, edx
push 0xbd0cfc82
push 0xfd2a18ac
lea esp, [esp + 0x14]
ja fcn.101a9e3e
mov eax, esp
mov ecx, 0x2d9a1784
lea ecx, [ecx - 0x2d9a1714]
mov edx, 0xc40874a1
rol dl, 0x21
lea edx, [edi - 0x80]
and edx, 0xfffffffc
jmp loc.10069452

Function at 0x101a7034
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x4296240c
push 0xfe1d58a0
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a7060
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 4]
jmp fcn.101a9e3e
mov dword [esp], 0xd90c7903
neg al
call fcn.101a45e0
adc edi, 8
mov dword [ecx], eax
jmp 0x101a68e3

Function at 0x101a70ff
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], dx
jmp 0x101a8e3f
jmp 0x101a34a3
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a7150
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push eax
jmp loc.10064d26
not bp
setp byte [esp + 9]
jne 0x101a7029
cdq
cwde
push ecx
mov edx, dword [ebp - 0x5e8]
cbw
cmovns eax, edx
push edx
cbw
cmova eax, ecx
mov eax, dword [ebp - 0x5ec]
jmp 0x101a242d

Function at 0x101a71de
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a7226
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
sbb bl, 0xa1
movsx esi, di
mov esi, dword [esp + esi*2 - 0xa89e]
bswap esi
movzx eax, bl
sar bx, 3
lea eax, [edi + ebx*2 + 0x3f0ecb33]
ror esi, 1
inc ebx
mov dword [esp + edi - 0x3d005461], eax
bswap esi
mov dword [esp + eax - 0x277d1f6a], edi
xadd ax, di
xadd eax, ebx
not esi
cwde
xadd byte [esp + ebx - 0x277d73ca], ah
adc edi, dword [esp + ebx*2 - 0x4efae796]
bswap esi
sub byte [esp + ebx*2 - 0x4efae796], bl
xchg dword [esp + ebx - 0x277d73cb], eax
dec esi
neg esi
shr bx, 0xa7
adc eax, dword [esp + ebx - 0x277d00e7]
setge bl
adc esi, ebp
bts di, 0x97
mov dword [esp + eax - 0x3d011c2a], edx
mov ebp, edi
add edi, dword [esp + eax - 0x3d011c4e]
seta byte [esp + edi - 0x7a013b80]
lea edi, [esp + ebx - 0x277cfffd]
sub dword [esp + ebx - 0x277d0001], 0x7c0baf03
sub word [esp + ebx - 0x277cffff], bp
setp bl
lea eax, [ebx + edi - 0x277d00f0]
mov esp, eax
mov ebx, esi
jmp 0x101a9e37

Function at 0x101a72e9
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xe41496b4
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a730f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.101a9e3e
Function at 0x101a7318
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
sal bp, cl
mov word [edi], bp
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a73e9
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], dx
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a7461
Capabilities:
Terminate process

Disassembly:
mov ax, word [ecx + eax - 0x42de0392]
push 0xf3aed4b5
or word [esp + 2], 0xa83b
call fcn.10063946
jmp 0x101a7aec
call fcn.10064c7c
mov ecx, 0x3010dd81
lea eax, [ecx*4 - 0x50f7e779]
or al, ah
mov ecx, dword [edi + ecx - 0x3010dd81]
lea eax, [eax*8 - 0x377e70e6]
ja 0x101a5bb7
mov al, byte [ebp - 0x244]
xchg ecx, ecx
cmovp ecx, esi
jmp 0x10025be2

Function at 0x101a75e1
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov edx, dword [edi + 4]
mov dword [esp], 0xe3b994be
add edi, 4
inc dword [esp]
not word [esp]
not ebp
not edx
add word [esp], 0xe482
neg dword [esp]
shr byte [esp], 5
or ebp, edx
push 0xe3a8a205
call fcn.101a3d63

Function at 0x101a761c
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
shl dword [esp], 0x69
sal word [esp + 2], 0xe9
adc edi, 1
add dword [esp], 0x88ae6a39
shl dword [esp], 0xb4
shl al, cl
mov word [edi], ax
call fcn.101a849d
call fcn.101a457f
and ecx, ebp
not ecx
mov dword [edi], ecx
push 0xc6982703
call fcn.10067056
mov ebp, dword [edi + 4]
push 0xc791128b
adc edi, 3
sar byte [esp + 3], 5
jnp 0x101a4a54
mov ebx, 0x712e1d8b
shl bl, 0xe4
mov esp, edi
lea ebp, [ebx*4 - 0x6040c9fa]
jb 0x101a49f3
pop esi
movzx edx, bl
mov ecx, ebp
pop eax
lea edi, [ebx + edx - 0x49f1f452]
cmovns ebp, edx
pop ebx
push ebp
sbb di, cx
btc ebp, 0x34
mov ebp, dword [esp + edx*2 - 0x15c]
push dword [esp + 8]
popfd
not edi
jmp loc.10068fef

Function at 0x101a76c0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], cx
call fcn.10068eb4
jmp 0x101a2044

Function at 0x101a775f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
xor dl, bl
rol ecx, cl
adc cx, cx
neg dl
neg cx
call fcn.101a3a8a

Function at 0x101a7778
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
movzx cx, byte [edi]
mov eax, 0xdd85da8c
mov al, byte [edi + 2]
call fcn.101a77a9
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
pop ecx
pop edi
call fcn.101a3a3e
mov esp, edi
mov ebp, esi
movsx edx, si
movsx ecx, si
pop esi
pop eax
imul edx, ebp
movsx edi, bp
adc cl, cl
pop ebx
pop ebp
jge 0x101a9cc6
or ax, bp
mov word [edi], ax
jmp 0x101a634e
call fcn.10063a9e
mov edx, 0x47993423
call fcn.101a3ddc
mov esi, 0xe3a85021
jmp 0x101a700d
mov dword [esp], 0xb235a199
not eax
shl word [esp + 1], 0x6a
je 0x101a2566
not edx
dec dword [esp + 4]
jp fcn.101a62c2
or eax, edx
jmp 0x101a7047
sar cx, cl
imul edi, ecx
popfd
bswap ecx
pop ecx
pop edi
push edx
mov edx, dword [esp + 4]
push 0xaa9cbd9b
call fcn.101a491f
jmp 0x101a6bd3

Function at 0x101a77ae
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], ax
call fcn.101a5596
call fcn.101a299d
push 0x8c0e99a8
jmp 0x101a2d83
sbb edi, 2
jmp 0x101a65cb
Function at 0x101a77b9
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a793a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
not dword [esp + 8]
call fcn.10067062

Function at 0x101a7a74
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
sub edi, 4
call fcn.101a21b4

Function at 0x101a7a84
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 8]
jmp fcn.101a8301

Function at 0x101a7a92
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], cx
lea esp, [esp + 0x10]
jmp fcn.101a9e3e
jmp 0x101a678d

Function at 0x101a7b01
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a7b17
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.101a9e3e

Function at 0x101a7c7d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a87bb
sub edi, 2
call fcn.101a87b3

Function at 0x101a7ca9
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc edi, 6
call fcn.101a8e37

Function at 0x101a7d61
Capabilities:
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime
Terminate process

Disassembly:
xor dl, bl
call fcn.101a5c92
rol cl, 1
jmp 0x1006391a
push edx
sub cl, 0x30
xor bl, cl
imul edx, edx
xchg word [esp + 0xd], dx
sbb edx, 0x73202311
lea ecx, [esp + ecx + 0x10]
xor dword [esp + edx*2 - 0x2c47319f], 0x2c1518bf
sbb dx, dx
jae 0x101a510b
add dx, word [edx + ecx - 0x16230000]
sub edi, 2
call fcn.101a7eea
mov ecx, 0xb4b75802
btc cx, cx
mov dx, word [edi]
xor cl, 0xac
movzx ebp, cx
mov bp, word [edi + ebp*2 - 0xb152]
jp 0x101a6357
mov cl, byte [edi + 4]
push 0xaa3afb35
jno 0x101a9525
mov edx, 0x560c753e
lea edi, [edi + edx - 0x560c753c]
or edx, edx
sbb dx, dx
lea esi, [edx + esi - 0x560c0001]
shr dx, 0x6e
movzx edx, byte [edx + esi - 0x560c0000]
jns 0x10025b2b
call dword [sym.imp.USER32.dll_SetPropW]
push edx
xor cl, bl
or edx, edx
mov dword [esp + edx - 0x43bbe54c], edx
setp dl
neg cl
rol edx, 0x61
not cl
push edx
jae 0x10063580

Function at 0x101a7d85
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 8]
jmp fcn.101a9e3e
push 0x9e99230e
jmp 0x101a2018

Function at 0x101a7de6
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
pop edx
add cl, 0x31
neg cl
mov edx, dword [esp]
mov word [esp + edx - 0x1bfc9], dx
rol cl, 1
btc dx, dx
btr edx, edx
ror word [esp + edx - 0x1bbca], 0x4c
xor bl, cl
call fcn.101a94fa

Function at 0x101a7e11
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xbfadd60e
lea esp, [esp + 0x18]
jmp fcn.101a9e3e
mov word [edi], dx
push 0xb180f13e
jmp 0x101a5551

Function at 0x101a7eea
Capabilities:
Terminate process

Disassembly:
not dword [esp + 9]
mov word [edi], dx
lea esp, [esp + 0x14]
jmp fcn.101a8301
Function at 0x101a7f48
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [edi], cx
mov dword [esp], 0x7e26f801
call fcn.101a77b9

Function at 0x101a8015
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a8301

Function at 0x101a80ce
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.101a9e3e

Function at 0x101a80d7
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov ax, word [edi + ebp*2 - 0x530b172c]
mov bp, word [edi + ebp*2 - 0x530b172a]
mov dword [esp], 0xa8216026
neg dword [esp]
adc edi, 1
shr byte [esp + 3], 0x41

Function at 0x101a810c
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a82a7
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edx], bp
jmp 0x101a8fff
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a82bc
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a837d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
sar dl, 1
call fcn.101a67d6
mov ecx, 0xbf03f036
mov eax, dword [edi]
inc cl
sar ecx, cl
mov cl, byte [edi + 4]
adc edi, 6
push 0xcab68ebd
mov byte [eax], cl
mov byte [esp], 0xb
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101a843f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov edx, dword [edi + 4]
mov cl, byte [edi + 8]
push 0xd1132329
adc edi, 6
sar dword [esp], 0x84
shrd ebp, edx, cl
mov dword [edi], ebp
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a849d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
push 0x20a9f406
jmp 0x101a4b97

Function at 0x101a852d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a85a9
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.101a8301
jmp 0x101a3d23

Function at 0x101a85b7
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
movzx ecx, byte [eax + esi - 0x5a10ad8a]
and eax, 0x6c10c720
xor cl, bl
bswap eax
mov dword [esp + eax - 0x851048], eax
add cl, 0x20
call fcn.10069015

Function at 0x101a8602
Capabilities:
Terminate process

Disassembly:
push 0x9a210f17
lea esp, [esp + 0x20]
jmp fcn.101a8301

Function at 0x101a861d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.101a9e3e

Function at 0x101a8626
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a86d2
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a633b
mov ebp, dword [edi + ebp*4 - 0x643728d4]
neg ecx
push ecx
mov cl, byte [edi + 8]
jb 0x10069170
Function at 0x101a87b3
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a2ef2
mov word [edi], ax
jmp 0x101a24a9

Function at 0x101a87bb
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov eax, dword [edi + 4]
mov cl, byte [edi + 8]
mov dword [esp + 4], 0xfe1a1a9d
push 0xed08d6b3
add edi, 6
shld ebp, eax, cl
push 0xb230b9a6
mov dword [edi], ebp
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a87e9
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
add edi, 2
not al
jmp 0x101a9e32
call fcn.101a5088
mov ebp, 0
sub ebx, ebp

Function at 0x101a8812
Capabilities:
Terminate process

Disassembly:
push 0xf40290a8
lea esp, [esp + 0xc]
jmp fcn.101a8301
jmp 0x101a95dd
mov dword [edi], edx
jmp 0x101a4e1a

Function at 0x101a8817
Capabilities:
Terminate process

Disassembly:
mov word [esp + 0x10], 0xf39a
lea esp, [esp + 0x14]
jmp fcn.101a8301

Function at 0x101a885d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0x28b383ae
and dword [esp], 0xef9b473e
xor al, bl
sar dword [esp], 0x11
adc al, 7
add dword [esp], 0xef3b4307
js 0x101a98a1
mov ecx, 0x45929ea0
bswap ecx
neg cl
movzx dx, byte [edi]
push ecx
sar cl, 0xc1
mov cl, byte [edi + 2]
adc edi, 1
sal dl, cl
push 0x619ee91a
call fcn.101a2351
dec byte [esp + 3]
xor al, 0xac
jmp loc.10066f89

Function at 0x101a88ac
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a88be
Capabilities:
Terminate process

Disassembly:
mov dword [edi], edx
push 0x559c2b17
jmp 0x101a88b5
lea esp, [esp + 0x10]
jmp fcn.101a8301
jmp 0x101a6d5e

Function at 0x101a8939
Capabilities:
Terminate process

Disassembly:
sal word [esp + 6], 0xef
xor bx, ax
call fcn.101a3f22
mov word [edi], ax
call fcn.100625b2
neg ax
push 0xe3ade929
ror word [esp], 0xef
dec ax
sub dword [esp + 1], 0xa001b831
ror ax, 1
ror byte [esp], 0x47
push 0xb9b1bcb1
sbb dword [esp], 0xc3813829
adc ax, 0xe909
rol byte [esp], 0x82
setb byte [esp + 6]
xor ax, 0x9a0b
sar word [esp + 6], 0x4f
jne 0x101a6899

Function at 0x101a8b30
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.101a9e3e

Function at 0x101a8b39
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
sub edi, 2
call fcn.101a2ea2
mov dword [edi], ecx
jmp loc.10062290

Function at 0x101a8b5e
Capabilities:
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime

Disassembly:
mov dword [esp], 0x1ea2ca0e
and cx, bp
jmp loc.100647d0
add edi, 2
jmp 0x101a21f6

Function at 0x101a8b69
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [edi], eax
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
jmp 0x101a859e

Function at 0x101a8bea
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 2
push 0xb3a17a6
sal dl, cl
not dword [esp]
call fcn.101a73e9

Function at 0x101a8c00
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dl, al
call fcn.101a2896
rdtsc
Function at 0x101a8ceb
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 4]
jmp fcn.101a9e3e
jmp 0x101a43b6

Function at 0x101a8db4
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x18295496
jmp 0x101a2e19

Function at 0x101a8dcf
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a8dd8
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x9794ddb8
lea esp, [esp + 8]
jmp fcn.101a9e3e
jmp 0x101a7c96

Function at 0x101a8e08
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a8e48
Capabilities:
Terminate process

Disassembly:
call fcn.1006267e
lea ecx, [ecx + ecx*4 - 0x5cc75be6]
mov eax, dword [edi + ecx - 0x2b338646]
mov ecx, dword [eax + ecx - 0x2b338646]
jmp 0x101a6efa

Function at 0x101a8e67
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime
Terminate process

Disassembly:
rol dword [esp], 0xfb
adc al, 0xbc
call fcn.101a4b67
lea esi, [esi + eax - 0x2e7e2e38]
sal ax, 0x66
btr eax, eax
movzx eax, byte [eax + esi - 0x2e7e8dc0]
xor al, bl
rol al, 1
mov dword [esp], 0xecb7e084
dec dword [esp]
not al
js 0x101a240e
mov edx, 0x1270d2d
movsx ecx, dx
movzx cx, byte [edi + edx*8 - 0x9386968]
btc edx, edx
mov dl, byte [edi + edx*2 - 0x24e5a58]
push 0x378faf10
setb byte [esp + 2]
push 0xb9b69526
adc edi, 2
push 0x125620
call fcn.10064cda

Function at 0x101a8ecf
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov ecx, 0x7231995
mov cl, byte [edi + ecx*2 - 0xe463326]
mov dword [esp], 0x94a1fb1d
push 0x906a95
sar word [esp], 0xe5
adc edi, 5
mov dword [esp + 4], 0x429e9f39
call fcn.101a95d1

Function at 0x101a8f01
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
jmp 0x101a5f90

Function at 0x101a8f6e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x862a4e0c
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a8fec
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov cl, byte [edi + ecx*8 - 0xd3567ec]
jb 0x101a68f1
mov dword [esp + 4], 0x270d412a
setbe byte [esp + 5]
adc edi, 4
push 0xbf2ff72c
shrd bp, ax, cl
mov word [edi], bp
call fcn.101a7943
mov ax, word [edi + ecx - 0x1a6acae]
shr cl, 0x47
not cl
jns 0x101a258a

Function at 0x101a91ba
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xf6a5239d
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a9297
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
neg byte [esp + 4]
inc cl
mov dword [esp], 0xb3888f0e
not word [esp + 4]
not cl
call fcn.101a4d2a
ror cl, 1
jmp 0x101a2056