joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e5209
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
movzx ebp, ax
mov ebp, esp
cmc
cmp si, sp
sub esp, 0x23c
test ah, 0x99
cmp dword [ebp + 8], 0
jmp loc.10026190

Function at 0x100e560a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ecx
mov ecx, 0x25393b25
pushfd
cmp cx, 0x249d
jb 0x100e5616
lea ecx, [ecx*2 + 0x1418472f]
call fcn.1006787c

Function at 0x100ede24
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x20]
call fcn.10004bf3
call fcn.100aa885
lea ecx, [ebp - 0x2150]
call fcn.100aa885
lea ecx, [ebp - 0x2154]
jmp 0x1013425b
call fcn.100aa885
lea ecx, [ebp - 0x2158]
jmp loc.1007060c

Function at 0x100f868a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
mov esi, 0x329a6282
push edx
mov esi, dword [esp + esi - 0x329a6276]
mov dword [esp + 0xc], 0xc3161395
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10004bf3
mov edx, 0x4a2bb83d
mov cx, word [edx + ebp - 0x4a2bb83d]
lea ebp, [ebp + edx - 0x4a2bb83b]
add edx, edx
imul edx, edx
not edx
movzx edx, byte [edx + edi - 0x4ba905db]
call fcn.1014adeb

Function at 0x100fa6fa
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], 0xc3870338
push 0x72bf65ae
lea esp, [esp + 0x24]
js loc.1009876b
jmp loc.1003e906

Function at 0x100fe074
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ecx
mov ecx, 0x608b3808
not cx
mov dword [esp + 4], 0xe313d0ba
mov ecx, dword [esp + ecx - 0x608bc7f7]
call fcn.1013f847

Function at 0x10105466
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.101b36a9
mov dl, byte [eax]
mov byte [ebp - 0x94c], dl
push 0xe681af6f
movzx ecx, bx
mov ch, 0xa5
lea ecx, [ebp - 0x1534]
jmp loc.1000b735
mov byte [eax], cl
push 0xf2b14eb6
jb 0x10144d33
lea esp, [esp + 0x1c]
jae loc.1009876b
mov byte [ecx], dl
lea esp, [esp + 0xc]
ja loc.1009876b
call fcn.101b36a9
mov cl, byte [eax]
jmp 0x101afdde
movzx edx, byte [edi + edx - 0x4a763618]
call fcn.1006a12a
ljmp 0xd720
mov byte [ebp - 0x94d], cl
xchg cx, cx
mov cx, sp
push 0xe681af7b
bswap ecx
seta cl
lea ecx, [ebp - 0x1538]
jmp 0x100f9d75

Function at 0x1010f97e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1015ef9c
bts cx, sp
mov dword [ebp - 0xdc], edx
and cl, dh
mov ecx, dword [ebp + 0x6c]
cmc
cmp ecx, dword [ebp - 0xdc]
jmp 0x101b196e
mov dword [ebp - 0x24c], 0
neg cx
jge 0x101248fa
mov dword [ebp - 0x24c], 1
jmp loc.100484b0

Function at 0x10114f71
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0xe314b87e
lea esp, [esp + 8]
call fcn.10004bf3
call fcn.100aa885
lea ecx, [ebp - 0x28e4]
call fcn.100aa885
lea ecx, [ebp - 0x28e8]
call fcn.100aa885
lea ecx, [ebp - 0x28ec]
jmp loc.1004e5a6
Function at 0x1012494c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0xc8a36299
jb 0x10198894
adc ebp, 3
neg dword [esp]
add ecx, eax
call fcn.101a25c3

Function at 0x1012499f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
not byte [esp + 4]
pushfd
cmp dword [esp + 8], 0x81a4993c
setns byte [esp + 8]
mov dword [esp + 0xc], 0xe31549a6
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.10004bf3
push 0xe681afda
xchg ecx, ecx
lea ecx, [ebp - 0x1a80]
call fcn.101b36a9
mov cl, byte [eax]
jmp loc.1005acc6

Function at 0x10132afe
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
je 0x10047f23
cmovno cx, sp

Function at 0x10135f74
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd52111a4
push 0xe21fcf83
mov dword [esp + 0x10], 0xe313d0ba
lea esp, [esp + 0x10]
call fcn.10004bf3

Function at 0x10137501
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
adc edi, 1
mov dword [esp], 0x771bc2a9
xor cl, bl
rol word [esp], 0x8a
dec word [esp + 1]
inc cl
neg dword [esp]
push 0x66b6ff1a
rol cl, 1
call fcn.1006f15d
Function at 0x1013965f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call 0x1003b340
movsx cx, bl

Function at 0x1013b1a3
Capabilities:
Check os version
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
inc edx
sal word [esp + 3], 6
rol dword [esp + 4], 0xeb
not dword [esp + 1]
ror edx, 2
call fcn.100c534e
xor dword [esp + 4], 0xbb71b1c
mov dword [esp], 0xfeac0fa9
dec edx
bswap edx
jmp 0x100ab4ff

Function at 0x1013c634
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0x36
not dword [esp + 1]
mov dword [ebp], esi
jmp loc.1006f10b
mov dword [esp], esi
and si, si
ror cl, 1
shr si, 0x4f
sbb cl, 0xaf
bswap esi
xor cl, 0xaf
xor bl, cl
and si, si
push esi
lea ecx, [esp + ecx + 8]
and word [esp + esi - 0xe6ec], si
push esi
sal dword [esp + esi*8 - 0x73782], 0x37
mov esi, dword [ecx + esi*2 - 0x1cde2]
jb 0x1016d9ee
jb 0x1001d1ea
inc dword [esp + 8]
sbb ebp, 4
jmp 0x100961d8

Function at 0x101429aa
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
test bp, 0x4e35
mov ebp, dword [esp + 8]
mov dword [esp + 8], 0xe313d0ba
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10004bf3

Function at 0x10146971
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push edi
pushfd
mov edi, 0x3498621c
add edi, 0xaf049686
mov dword [esp + 8], 0xe312dd5e
mov edi, dword [esp + 4]
jge 0x10146999
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10004bf3
call fcn.101a3f50
call fcn.101b36a9
mov dl, byte [eax]
mov cl, ch
mov byte [ebp - 0xd5d], dl
xchg ch, ch
seta ch
mov cx, 0x9227
push 0xe681af80
mov ecx, 0xacbd5f25
lea ecx, [ebp - 0x20c8]
call fcn.101b36a9
mov al, byte [eax]
mov ecx, 0x2192f3f
movzx cx, dl
mov byte [ebp - 0xd5c], al
push 0xe681afff
cmovge cx, cx
mov cx, sp
lea ecx, [ebp - 0x20c4]
jmp 0x1018257e
mov byte [ebp - 0xd5b], cl
jmp 0x1005adde
call fcn.101b36a9
mov cl, byte [eax]
jmp 0x10167019

Function at 0x10146a19
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
not dx
btr ecx, 0x36

Function at 0x10146db7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edx, 0xf7a1fc90
lea edx, [edx + edx + 0x69ab0d21]
mov dword [esp + 0xc], 0xe313d0ba
mov edx, dword [esp + 4]
call fcn.10020da4
bswap cx
movsx ecx, bx
Function at 0x1014ce17
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
add ebp, 2
call fcn.100b66bf
mov ecx, 4
rdtsc
sar dh, 0x8e
shl ecx, 0
rol edx, 0x1a
not edx
mov edx, dword [ecx + section..rdata]
movzx eax, bx
not edx
or cl, 0x80
cmp dx, bp
xchg ah, cl
xor edx, 0x67354ed2
rcr ax, 0xbe
sar ecx, cl
mov eax, 4
btc ecx, 0xb
neg ch
imul ecx, eax, 3
xadd eax, eax
mov eax, dword [ecx + section..rdata]
dec ecx
rcl cx, 0xa6
bswap cx
not eax
not ch
xor edx, eax
sar cx, 0xbb
mov dword [ebp - 0x28], edx
sar eax, 0x8f
xadd dx, dx
mov ecx, dword [ebp - 0x24]
ror dl, 0xbc
lea ecx, [ecx + 1]
cmc
rcr dh, 0xb9
imul ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x290]
seto al
mov ax, si
movsx eax, di
push edx
setnp ch
mov cx, di
mov eax, dword [ebp + 0x14]
not ecx
movsx ecx, bx
cwd
push eax
push 0
lea ecx, [ebp - 0x88]
cmovo dx, di
not dx
push ecx
mov edx, dword [ebp + 8]
jmp 0x10189027
not ecx
mov ax, word [ebp]
mov cx, word [ebp + 2]
mov dword [esp], 0xb184e624
inc byte [esp]
jg 0x10012b0c
lahf
xlatb
invalid

Function at 0x1015129f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
add dword [esp + 4], 0xeffd872d
push edi
call fcn.1015fa5d
adc edx, esp

Function at 0x101544e1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
and edi, 0x4bb87d9a
mov edi, dword [esp + 0xc]
jb fcn.1015b279
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.10004bf3
Function at 0x1015cd39
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0xde4], ecx
bswap dx
movzx dx, cl
not dl
lea edx, [ebp - 0x10d8]
jmp 0x101010c6
jmp 0x1013a6df
mov dword [ebp - 0xde0], edx
jmp 0x10193053
mov eax, dword [ebp - 0x8e8]
xadd cl, cl
add eax, 1
mov dword [ebp - 0x8e8], eax
sbb ch, 0x23
mov ecx, dword [ebp - 0x8e8]
cmc
stc
cmp ecx, dword [ebp - 0xddc]
jge 0x10145da6
mov edx, dword [ebp - 0xde0]
add edx, dword [ebp - 0x8e8]
mov al, al
mov al, byte [ebp - 0xde4]
mov byte [edx], al
jmp 0x10175372
mov dword [ebp - 0xddc], eax
mov ecx, dword [ebp - 0x8ec]
jmp 0x100dac9e
mov ecx, dword [ebp - 0x8ec]
sar dl, cl
rcl ah, 0xaa
xor ecx, dword [ebp - 0x8ec]
mov dword [ebp - 0x8ec], ecx
shrd dx, bp, 0xa3
xor edx, esi
mov edx, dword [ebp - 0x8f0]
xor edx, dword [ebp - 0x8f0]
cwde
mov dword [ebp - 0x8f0], edx
rdtsc
rcr ecx, cl
movsx ax, bl
mov eax, 4
or dl, ch
ror edx, cl
bt edx, ebp
shl eax, 0
inc cl
mov ecx, dword [eax + section..rdata]
not ecx
xor ecx, 0x67354fd4
mov edx, 4
adc ax, 0x800e
btc ax, bx
imul eax, edx, 3
and dx, 0xe937
mov edx, dword [eax + section..rdata]
shl ax, 0
not edx
sub al, 0x98
xor ecx, edx
lahf
mov dword [ebp - 0x8fc], ecx
rol cl, cl
mov ch, 0x39
mov eax, 4
movsx ecx, bx
btc ecx, 0x23
sbb cx, bx
shl eax, 0
bswap ecx
mov ecx, dword [eax + section..rdata]
not ecx
sar eax, cl
test edi, ebp
cwd
xor ecx, 0x67354ed0
test esp, 0x16187413
mov edx, 4
shrd eax, ecx, 0x2d
imul eax, edx, 3
test al, bl
mov edx, dword [eax + section..rdata]
cwde
rcr ah, 0xa0
not edx
shr al, 0x8f
xor ecx, edx
setb dh
mov dword [ebp - 0x8f8], ecx
mov eax, dword [ebp - 0x8fc]
not ch
mov dword [ebp - 0xde8], eax
jmp 0x10030360
call fcn.10135f74
mov edx, dword [ebp - 0x8e4]
xor edx, dword [ebp - 0x8e4]
inc ch
shld ecx, esp, 0xa9
mov dword [ebp - 0x8e4], edx
mov eax, 4
bt dx, 0x94
shl eax, 0
mov ecx, dword [eax + section..rdata]
not ecx
bts ax, bp
or dx, 0xfb20
rcr dl, 0x1e
xor ecx, 0x67354fd4
cmp ch, 0x20
mov edx, 4
imul eax, edx, 3
sbb edx, 0x2c3b2c00
mov edx, dword [eax + section..rdata]
lahf
nop
mov eax, ebx
not edx
xor ah, al
sar eax, 0xaf
xor ecx, edx
cbw
xadd ah, dh
bsr eax, eax
mov dword [ebp - 0x8f0], ecx
or edx, edi
mov eax, 4
movsx ecx, bx
cmp si, 0xc9a4
shr cx, 0
shl eax, 0
or cl, 0x9b
btr edx, esp
mov ecx, dword [eax + section..rdata]
cmp esp, 0x91a95f1d
shr dh, 0xa0
sbb dh, ah
not ecx
xor ecx, 0x67354ed0
sar eax, cl
mov edx, 4
imul eax, edx, 3
xor edx, ebp
rol dh, cl
movzx dx, ah
mov edx, dword [eax + section..rdata]
bt ax, 0x8b
not edx
xor ecx, edx
mov dx, 0x5187
cmovae eax, ebp
movsx edx, sp
mov dword [ebp - 0x8ec], ecx
lahf
cmovp dx, bp
mov eax, dword [ebp - 0x8f0]
jmp 0x1014373e
jmp 0x1013a6ca
mov dword [ebp - 0x8e8], 0
jmp 0x100e5665

Function at 0x1015eaae
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xc31637ab
call fcn.10004bf3
Function at 0x1015eabb
Capabilities:
Encrypt data using des
Execute anti-debugging instructions

Disassembly:
mov edx, 4
sar cl, 0x9e
shrd cx, sp, 0x3b
setns al
shl edx, 0
rol ax, 0x3e
cmp bx, 0x603
mov eax, dword [edx + section..rdata]
rol edx, 4
not eax
neg dx
movsx dx, al
xor eax, 0x672e56a7
mov ecx, 4
cmc
not dh
bts edx, edx
imul edx, ecx, 3
bts cx, dx
ror cl, 0x1f
cmp sp, 0xb792
mov ecx, dword [edx + section..rdata]
cdq
add dh, 0xad
not ecx
movzx edx, di
xor eax, ecx
mov dword [ebp + 0x14], eax
rdtsc
dec cx
mov edx, dword [ebp + 0x70]
xor cl, 0x85
btr ecx, esi
inc ecx
add edx, dword [ebp + 0x14]
setae ah
and al, 0x9a
xchg ah, cl
mov eax, dword [ebp + 0x74]
btr cx, di
jmp loc.1005cbe4
xor edx, eax
cmp cl, 6
cmc
bsr ecx, edi
mov dword [ebp + 0x18], edx
rcl dx, cl
btc ax, dx
bts ax, bp
mov ecx, dword [ebp + 0x70]
btr eax, 0xa0
ror dl, cl
add ecx, dword [ebp + 0x18]
movsx eax, dx
cwd
bsf eax, esp
mov edx, dword [ebp + 0x74]
bsf ax, bp
mov dword [edx*4 + 0x1007d7f0], ecx
mov eax, dword [ebp + 0x74]
rol cl, cl
bsf ecx, eax
add eax, 1
test ebx, ecx
sbb dl, bh
neg dx
mov dword [ebp + 0x74], eax
shl cx, cl
cmp si, sp
mov ecx, dword [ebp + 0x18]
dec dx
xor ecx, dword [ebp + 0x18]
mov dword [ebp + 0x18], ecx
jmp 0x1009614c
pushfd
add dword [esp + 4], 0xefe95cdc
call fcn.10177d66
rcr ecx, cl
xor eax, dword [ebp + 0x1c]
mov dword [ebp + 0x1c], eax
bts eax, esi
ror dl, cl
rcl al, 0x10
mov ecx, 4
bts eax, edx
btc ax, si
shl ecx, 0
movsx eax, ax
mov edx, dword [ecx + section..rdata]
not edx
bsr ecx, esp
sar cl, cl
xor edx, 0x672c9f35
mov eax, 4
imul ecx, eax, 3
bt eax, 5
xor eax, ecx
mov eax, dword [ecx + section..rdata]
not eax
jmp 0x100e4d2d

Function at 0x1015ef9c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xe313d0ba
call fcn.10004bf3
mov byte [ebp - 0x7d2], cl
movsx ecx, di
setns cl
push 0xe681af5a
cmovge cx, di
lea ecx, [ebp - 0x12e8]
call fcn.101b36a9
mov dl, byte [eax]
bswap cx
seta ch
mov byte [ebp - 0x7d1], dl
push 0xe681af46
mov cl, cl
lea ecx, [ebp - 0x12e4]
call fcn.101b36a9
mov al, byte [eax]
mov ecx, 0x21116635
movsx ecx, dx
mov byte [ebp - 0x7d0], al
not cl
mov ecx, ebp
push 0xe681af24
jmp loc.1006cc26

Function at 0x1015fa5d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], 0xe313d0ba
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.10004bf3
Function at 0x1015fc2a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sal dword [esp], 0x1f
sbb ebp, 2
call fcn.1003238a
jae 0x1000f3bd
jne 0x1010c358
xor eax, eax
jmp loc.101425a4
btc dx, dx
not al
or dx, dx
imul edx, edx
shr dx, 0xc1
inc al
push edx
ror al, 1
xor bl, al
xor byte [esp + 3], 1
lea eax, [esp + eax + 4]
mov dl, byte [eax]
js 0x10057cc5
xor eax, eax
add ax, ax
mov eax, dword [0x1007ed88]
cmp di, ax
stc
xor eax, dword [0x1007e800]
jmp eax
jb 0x10085d08
sbb ebp, 2
push 0x121b6da3
mov word [ebp], ax
lea esp, [esp + 8]
jmp fcn.10190f55

Function at 0x1016472b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, 4
shr cl, 1
shl eax, 0
mov ecx, dword [eax + section..rdata]
xor dx, dx
bsr ax, bp
dec dl
not ecx
and al, 0x14
xor ecx, 0x67354ad0
btc eax, 0xb7
mov edx, 4
nop
cbw
imul eax, edx, 3
xchg dl, dh
btc dx, 0xb7
mov edx, dword [eax + section..rdata]
not edx
movzx eax, bp
xor ecx, edx
mov dword [ebp + 0x48], ecx
sbb cx, dx
sbb dl, 0xa4
and cx, dx
mov eax, 4
rcr cx, 0x9d
shl eax, 0
xchg ch, dh
shr dl, 0xbb
and dh, 0x84
mov ecx, dword [eax + section..rdata]
bts dx, bp
or edx, 0x5f832b3e
sub al, 0x2a
not ecx
xor ecx, 0x67354ed0
mov edx, 4
imul eax, edx, 3
movzx dx, ah
mov edx, dword [eax + section..rdata]
cmc
not edx
xadd eax, eax
shld ax, bp, 0xb3
xor ecx, edx
cbw
setnp ah
cmovs ax, di
mov dword [ebp + 0x4c], ecx
mov eax, dword [ebp + 0x48]
mov cx, 0xf39c
movzx cx, bl
xchg ecx, ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x4c]
jmp 0x1006f9d5
mov dword [ebp - 0x24], ecx
jmp loc.100abdc5
push edx
jmp 0x101556e2
jne 0x1004d021
sub eax, eax
jmp 0x1016d47b
call fcn.100408ac
lea esp, [esp + 0xc]
cmp bp, di
cmc
mov dword [ebp + 0x58], eax
clc
test si, 0xd424
cmp dword [ebp + 0x58], 0
jmp 0x10143fe0
push ebp
bt ax, dx
cwd
lea ebp, [esp - 0x6c]
sub esp, 0xb4
cdq
not cl
xchg dx, ax
mov dword [ebp + 0x68], 0
cbw
seto dh
mov eax, dword [ebp + 0x7c]
movsx cx, ah
push eax
mov cx, 0x4d38
cwd
mov ecx, dword [ebp + 0x78]
movsx edx, si
push ecx
mov edx, dword [ebp + 0x74]
jmp 0x100dd5b3
jmp fcn.101b084f

Function at 0x1016afbf
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push 0
call fcn.100c3295
lea esp, [esp + 4]
test dh, 0xb5
cmp ebx, edi
test dx, di
mov dword [ebp + 0x74], eax
clc
jmp fcn.101a4b8d
mov dword [ebp + 0x70], 0
jmp 0x100b7223
push 0xd0917a3f
mov dword [ecx], esi
jb 0x100b66e2
mov ah, al
lea ebp, [esp - 0x78]
mov eax, 0x3884
jmp 0x10122a04
call fcn.101463fb
push esi
jmp 0x101b673d
add cl, 0xbe
mov dword [esp + 8], 0x7a001d2a
ror cl, 1
xor bl, cl
shl word [esp + 8], 0x2e
sal dword [esp + 8], 0x27
lea ecx, [esp + ecx + 0x14]
jp 0x1011bf81
push edi
jmp 0x100e448b

Function at 0x10173705
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push edi
push esi
pushfd
mov edi, 0xb704c78a
mov esi, edi
not di
sub di, 0x553a
mov edi, dword [esp + edi + 0x48fb1ccd]
mov dword [esp + 8], 0xe313d0ba
mov esi, dword [esp + esi + 0x48fb387a]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10004bf3
Function at 0x10177d66
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0xc31637ab
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10004bf3

Function at 0x101791c8
Capabilities:
Encode data using base64

Disassembly:
push ebp
pushfd
mov ebp, 0x6b1d6020
call fcn.100f41f7
sbb cx, dx

Function at 0x1017be11
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shl ecx, cl
call fcn.10198c2b
push edi
pushfd
mov edi, 0x74a8f1ac
push edx
push ebx
push ecx
call fcn.1013d07c
push ecx
mov ecx, 0xe5277ba4
pushfd
test ch, cl
jns 0x1015959d
mov eax, dword [ebp - 0x20]
neg ch
sal ecx, 0xad
add eax, 1
btc edx, 0x20
mov dword [ebp - 0x20], eax
rcr cx, 0x2a
mov eax, esp
sar cl, 0x9d

Function at 0x1017c142
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp + 4], 0xc31637ab
lea esp, [esp + 4]
call fcn.10004bf3

Function at 0x1017e6d6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
add bp, sp
sub bp, 0xd9ae
cmp bp, 0xd806
lea ebp, [esp - 0x78]
cmc
cmp bp, bx
sub esp, 0x2dc
cmp dword [0x1007e87c], 0
jmp loc.1004fe44

Function at 0x10186927
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
lea ebp, [esp - 0x74]
lea esp, [esp - 0xb4]
ror edx, cl
bsr dx, bp
sub cx, dx
mov eax, 4
or ecx, esp
rol cx, cl
xor dx, 0x1838
shl eax, 0
mov ecx, dword [eax + section..rdata]
ror eax, 0x82
cmovb eax, ebx
not ecx
xor ecx, 0x67354ec0
shrd edx, esp, 0x82
not edx
mov edx, 4
imul eax, edx, 3
mov edx, dword [eax + section..rdata]
setae al
not edx
movsx eax, bx
or eax, ebp
xor ecx, edx
rcr edx, 0x1c
sbb dl, dh
mov dword [ebp + 0x68], ecx
inc cl
mov eax, 4
sbb cl, 0xb1
bt dx, bx
cmp bh, ch
shl eax, 0
shld edx, edi, 0x21
xor ch, 0x88
mov ecx, dword [eax + section..rdata]
btc eax, 0x80
jmp loc.1003ef7b

Function at 0x1018ef83
Capabilities:
Check for peb beingdebugged flag
Check os version
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
mov ebx, dword [esp + edi*2 - 0x3035b3ec]
mov edx, 0x7dbf0ca2
call fcn.101b81cd
movsx cx, dl
Function at 0x10198c2b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor eax, ecx
dec ch
mov dword [ebp - 0x460], eax
dec ch
xadd cl, ch
mov ecx, dword [ebp - 0x120]
test edx, edi
cmp ebx, ebx
stc
mov eax, dword [ebp - 0x464]
add eax, dword [ebp + 0x58]
cmp ah, ch
cmp ax, 0x1810
test ebx, 0x18b285b4
sub edx, edx
stc
div dword [ebp - 0x460]
mov eax, dword [ebp + 0x58]
jmp loc.10021479
add dword [esp], 0xefea6a5c
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0xe313d0ba
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10004bf3
mov dword [ebp - 0x464], eax
cwd
ror ah, cl
mov edx, 4
shl edx, 0
movzx ax, ah
sub eax, esp
mov eax, dword [edx + section..rdata]
rcl ecx, 0x9e
not dx
sar ecx, 0x17
not eax
sub ecx, edi
and ecx, esp
rcr edx, cl
xor eax, 0x67354fd0
shl dh, cl
mov ecx, 4
shl edx, 0x9f
imul edx, ecx, 3
xadd ch, cl
shld ecx, eax, 0x18
shr cl, cl
mov ecx, dword [edx + section..rdata]
stc
test edx, ecx
not ecx
clc
jmp 0x100fa637

Function at 0x1019b926
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add edi, 4
mov dword [esp], 0xda1cbd9f
xor edx, ebx
call fcn.1013b1a3
Function at 0x1019cb8d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
bt ax, di
mov ch, 0x8c
mov dword [ebp - 8], 0
add cl, 0xa3
not ah
xchg dx, cx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmovns eax, ecx
mov ecx, dword [ebp - 0xc]
cwde
btc dx, 0xb7
cmovns ax, di
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x3c]
sar ch, 0x39
sal ecx, 0x87
mov dword [ebp - 0x54], edx
btc eax, esi
rcl cx, 0x39
mov eax, 4
sub dx, bp
shl eax, 0
bsf dx, si
test edx, 0x7a1c3916
mov ecx, dword [eax + section..rdata]
clc
not ecx
xadd al, al
xor ecx, 0x67354ed0
mov ax, sp
cwd
mov edx, 4
imul eax, edx, 3
bswap edx
rcr dl, 0x27
mov edx, dword [eax + section..rdata]
xor ax, ax
not edx
xor ecx, edx
xchg dh, ah
movsx eax, bx
btr ax, 0x36
mov dword [ebp - 0x28], ecx
xor cx, bp
mov eax, dword [ebp - 0x28]
shr ch, cl
mov ecx, dword [ebp - 0x54]
cdq
rcl dx, 0x14
adc dx, bp
lea edx, [ecx + eax*8 + 0x78]
clc
mov eax, esp
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x28]
shld cx, dx, 0xf
xor eax, dword [ebp - 0x28]
rcr ecx, 0xbf
clc
mov dword [ebp - 0x28], eax
rcl ecx, cl
mov ecx, dword [ebp - 0x5c]
cmovns eax, esi
bt eax, ebp
mov edx, dword [ebp - 0xc]
add ax, bx
test esp, esi
neg eax
add edx, dword [ecx]
inc cx
xor ax, 0x7a1d
mov dword [ebp - 0x2c], edx
rol al, 0x95
cdq
mov eax, dword [ebp - 0x2c]
rcr ch, 0x27
cmovns ecx, ecx
cmp esp, edx
mov ecx, dword [ebp - 0xc]
or dx, 0x5787
dec dh
add ecx, dword [eax + 0x1c]
shld ax, sp, 0x1a
mov dword [ebp - 0x1c], ecx
not ecx
movzx edx, bx
mov edx, dword [ebp - 0x2c]
lahf
rcr ch, 0xa
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x10], eax
cmp esi, 0x1938630b
cmc
and dl, 0x27
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
movzx eax, di
add edx, dword [ecx + 0x20]
not ax
rol ah, 0x26
add eax, eax
mov dword [ebp - 0x14], edx
lahf
mov eax, dword [ebp - 0x2c]
bswap edx
sal dh, cl
ror cl, cl
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
sub dh, 0x95
shld dx, bx, 0x2e
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x50]
shr cl, 0x81
mov dword [ebp - 0x50], eax

Function at 0x101a1cab
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push edi
pushfd
mov edi, 0xf2bd03aa
or di, di
mov dword [esp + 8], 0x631386ea
mov edi, dword [esp + edi*4 + 0x350bf15c]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10004bf3
cmovo ecx, ecx
not cx

Function at 0x101a3f50
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
add dword [esp + 4], 0xefeb965d
mov dword [esp + 4], 0x83142259
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10004bf3

Function at 0x101a4066
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xba8caa0f
pushfd
shr ecx, cl
mov ebp, ecx
call fcn.101a4066
out dx, al
ljmp 0x999
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10004bf3
jbe 0x10068623
mov ebp, dword [esp + 0xc]
mov dword [esp + 0xc], 0xe313d0ba
mov ecx, dword [esp + 8]
jb 0x101a4078
js 0x100d3203
ja 0x100d3203