joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101d816f
Capabilities:
Read file on windows

Disassembly:
push 0x83db820f
call fcn.103dbcab

Function at 0x101ecbfd
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 0x83], 0x3f
jmp 0x102710c1
push 0x83db820f
call fcn.103dbcab
mov byte [esp + 0x73], 0x5b
mov byte [esp + 0x74], 0x68
jmp 0x1029c776
mov byte [esp + 0x88], 0x60
jmp 0x10303ead
mov byte [esp + 0x7a], 0x38
jmp 0x10456b7c
mov byte [esp + 0x84], 0x61
jmp 0x102fa7b7
mov byte [esp + 0x75], 0x31
jmp 0x103a4717
mov byte [esp + 0x85], 0x2b
jmp 0x1041c842
mov byte [esp + 0x89], 0xe9
jmp 0x10448bee
mov byte [esp + 0x7d], al
mov byte [esp + 0x7e], 0x7f
jmp 0x103f84ad
mov byte [esp + 0x76], 0x52
jmp 0x104623e8
mov byte [esp + 0x8b], 0x51
jmp loc.10044cc3
mov byte [esp + 0x87], bl
jmp 0x1021bcbd
mov byte [esp + 0x80], 0x63
mov byte [esp + 0x81], 0x6d
jmp 0x103f32ec
mov byte [esp + 0x7c], 0x62
jmp 0x10352c46
mov byte [esp + 0x82], 0x15
jmp 0x101e46ac
mov byte [esp + 0x7f], 8
jmp 0x103b33df
mov byte [esp + 0x86], 0xab
jmp 0x103b0b4f
mov byte [esp + 0x8a], 0xc1
jmp 0x103b04a3
mov byte [esp + 0x7b], 0x35
jmp 0x103ea9b7
mov byte [esp + 0x77], 2
mov byte [esp + 0x78], 0x69
jmp 0x104853a4
mov byte [esp + 0x79], 0xf3
jmp 0x102214cb
Function at 0x1021bdf9
Capabilities:
Hash data with crc32

Disassembly:
push 0x83db820f
call fcn.103dbcab

Function at 0x1021dc7f
Capabilities:
Read file on windows

Disassembly:
lea ecx, [ebp - 0x1c]
jmp 0x103d91de
push esi
cmp bh, 0xa8
not si
push edi
bts eax, ebp
mov eax, dword [0x10149de0]
rol si, 0xfa
neg esi
xor dword [ebp - 8], eax
xor eax, ebp
push eax
sub esi, eax
rcl esi, 0x9a
test esi, edi
lea eax, [ebp - 0x10]
bts si, sp
cmovae si, cx
mov dword fs:[0], eax
add esi, ebp
neg si
mov dword [ebp - 0x18], esp
rcr eax, cl
mov esi, ecx
xchg ah, ah
bsf eax, ecx
xadd ah, ah
xor edi, edi
jmp 0x10405f99
call fcn.10071ea3
mov edx, dword [ebp - 0x1c]
jmp loc.1004053d
push ebp
mov ebp, esp
bt ax, 0xf2
add al, 0x69
ror eax, cl
push 0xfffffffffffffffe
push 0x1043d0a8
ror ax, cl
test esp, 0x56d3255f
push 0x10078230
bt eax, 0x50
sbb eax, edi
sal ax, cl
mov eax, dword fs:[0]
test dh, 0x6d
push eax
sub esp, 0x14
rol ax, cl
rcr ax, 0x70
cmovle ax, bp
push ebx
lahf
jmp 0x1021dc7f
mov dword [ebp - 0x20], edi
cbw
not al
movsx ax, bh
mov dword [ebp - 4], edi
cbw
lahf
push 0x10111c90
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.10071bb0
lea esp, [esp + 0xc]
sub ax, cx
xadd ah, al
bts ax, di
mov eax, dword [ebp - 0x1c]
cmp ax, sp
cmp eax, edi
jmp 0x104b50ac
lea ecx, [ebp - 0x20]
push ecx
jmp 0x10285800
push ecx
jmp loc.100449c2
mov dword [ebp - 0x1c], edi
jmp 0x10368592
push 0x10111c94
xchg ch, cl
bswap cx
push esi
jmp 0x101cfb79
je 0x10436d8f
push eax
push 1
push 2
jmp 0x103cfcb2

Function at 0x1024adbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb059c7dd
call fcn.104aea3b
mov byte [ebp - 0x30], 0
jmp 0x103cc10f
mov dword [ebp - 0xb60], ebx
jmp 0x103f9500
mov dword [ebp - 0xb64], eax
jmp 0x1024ae43
jle 0x1039c304
mov dword [ebp - 0xb58], ebx
xadd ax, si
Function at 0x102a74db
Capabilities:
Hash data with crc32

Disassembly:
call fcn.10078150
lea esp, [esp + 0xc]
bt ax, 0x8d
shr eax, cl
xor edx, edx
mov ax, sp
push 0x206
push edx
movsx eax, si
setle al
lea eax, [esp + 0x22a]
jmp 0x10296a75
call fcn.10078150
add esp, 0xc
push 0
call fcn.100da110
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jmp 0x103dc1d7
push eax
jmp 0x10446c93
push ebp
cmp sp, 0x2723
mov ebp, esp
sal al, cl
or eax, 0x660a0ffe
sub ecx, 0x66cd7edb
and esp, 0xfffffff8
or eax, ecx
sal cl, 0x4b
lea esp, [esp - 0x62c]
and eax, 0x7e58a8
mov eax, dword [0x10149de0]
xor ecx, ebp
xor eax, esp
rcr ch, cl
rcr cl, 0xc0
not ecx
mov dword [esp + 0x628], eax
push ebx
xor ecx, 0x1eaf44af
movsx ecx, sp
btc ecx, 0xf9
push esi
test si, 0x1597
sal cl, cl
push edi
mov ch, 0x19
mov cl, dl
bts cx, bp
sub eax, eax
cmovae cx, sp
push 0x206
not cl
cmovs cx, dx
movsx ecx, bx
push eax
mov cx, 0x2a85
lea ecx, [esp + 0x432]
jmp 0x103bae7b
push ecx
mov word [esp + 0x434], ax
jmp 0x1023ee48
je 0x1031471d
jmp 0x101c48ab
mov word [esp + 0x22c], dx
jmp 0x10289e67

Function at 0x102cca3e
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0xb059c7dd
call fcn.104aea3b

Function at 0x10304e6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
adc bp, cx
adc bp, 0x1bab
mov ebp, esp
sub esp, 0xe8
xor eax, 0x46717bcc
mov eax, dword [0x10149de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov cl, 0x6c
jmp 0x103edbc9
mov byte [ebp - 0xa], cl
xor dx, 0x7ff8
test dx, 0x3419
mov byte [ebp - 9], cl
mov ecx, dword [eax + 0x3c]
stc
xor dx, 0x325e
shr edx, 0x17
push ebx
sar edx, 0x74
inc dl
mov ebx, dword [ebp + 0xc]
add ecx, eax
push esi
mov byte [ebp - 0xc], 0x2e
jmp loc.10036b5b
Function at 0x103275a5
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, dword [0x100eb2f8]
xadd al, al
shld ecx, ebx, 0x72
bsf edx, esp
push edi
cbw
test ebp, 0x7d3a3e76
bt cx, 0x99
mov eax, 0x4c
rcl dx, cl
mov word [esp + 0x1b4], ax
push edi
sub cx, 0x1fd0
btc ax, bx
mov eax, 0x4d
btc dx, 0xbc
cmc
ror edx, cl
push edi
sbb dx, bp
shl dx, 0x7c
test bx, dx
mov word [esp + 0x1c2], ax
sar ah, cl
and ecx, 0x569037b4
shrd ecx, edx, 3
mov eax, 0x65
xor dl, 0x46
push edi
test esp, 0x7df6457e
mov word [esp + 0x1cc], ax
rol ch, 0x27
lea eax, [esp + 0x24]
or dx, 0xef5
sub dh, cl
push eax
test eax, edi
mov ecx, 0x48
btr edx, esi
mov edx, 0x32
clc
cmc
cmp dx, 0x75a8
mov word [esp + 0x1c6], cx
mov ecx, eax
rcr ecx, cl
mov word [esp + 0x1c8], dx
rcr edx, cl
rol dl, cl
push edi
shr ecx, 0xae
mov ecx, 0x75
clc
or dx, 0x487a
cdq
mov edx, 0x74
test dl, 0x29
jmp 0x103be14d
push edi
push eax
jmp 0x10418bb7
sub eax, dword [0x1016a860]
sar eax, 7
clc
cmp esp, edx
cmp esi, eax
jmp 0x10450178
sub eax, dword [0x1016a848]
clc
sar eax, 6
clc
test esp, 0x5ecd286f
cmp dword [esp + 0x18], eax
jb 0x101c5cbd
call fcn.10073483
mov ecx, dword [esp + 0x14]
bswap edi
cdq
mov edx, dword [0x1016a848]
movsx esi, bx
lea esi, [ecx + edx]
jmp 0x10334eb6
mov dword [esp + 0x20], edi
jmp 0x104840dc
mov dword [esp + 0x18], esi
jle 0x1003fefa
mov dword [esp + 0x14], edi
jmp 0x10181890
cmp ebx, edi
jmp 0x10296e79
cmp ebx, edi
jmp 0x10266431
push eax
or al, ch
btc ax, 0x65
sub esp, 0x4e8
mov eax, dword [0x10149de0]
cmp esi, 0x11560d2b
xor eax, esp
cmc
cmp si, 0x45a6
mov dword [esp + 0x4e0], eax
cmc
bsf ax, ax
push ebx
push esi
sbb ax, 0xc71
shl al, 0x67
push edi
rol eax, 0xd2
btr ax, 0x75
mov eax, dword [0x10149de0]
xor eax, esp
stc
cmc
push eax
not eax
lea eax, [esp + 0x4f8]
cmc
clc
mov dword fs:[0], eax
stc
push 0x103
rol ax, 3
shrd ax, si, 0xa9
sub edi, edi
bswap ax
not eax
mov ax, bx
lea eax, [esp + 0x1e1]
jmp 0x101760d9
mov ecx, 0x10
lea edi, [esp + 0x2c]
jmp 0x100467d3
jmp 0x101c5c9d
jle 0x103dd310
mov dword [esp + 0x14], edi
jmp 0x103607a2
push ebp
mov ebp, esp
rcr eax, cl
lahf
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e8b2b
neg al
sbb eax, edi
mov eax, dword fs:[0]
clc
jmp 0x103275a5
mov eax, dword [0x1016a864]
clc
sbb bh, bh
mov ebx, eax
cmp cx, 0x36de
stc
sub ebx, dword [0x1016a860]
sub esi, esi
sar ebx, 7
jmp 0x102c734a
mov byte [esp + 0x1e8], 0
call fcn.10078150
mov eax, dword [0x1016a84c]
movzx ebx, sp
mov ebx, eax
stc
sub ebx, dword [0x1016a848]
clc
add esp, 0xc
stc
cmp bp, dx
sar ebx, 6
cmp si, bp
jmp 0x102f7ff2
jb 0x10450183
call fcn.10073483
mov edx, dword [esp + 0x14]
mov eax, dword [0x1016a860]
lea esi, [edx + eax]
mov ecx, 0x20
xchg edi, edi
mov di, 0x2442
cmovns edi, ebp
lea edi, [esp + 0x12c]
jmp 0x10006097
mov dword [esp + 0x18], edi
jmp 0x1037db99
mov dword [esp + 0x1c], edi
jmp 0x1047b462
Function at 0x103444b2
Capabilities:
Read file on windows

Disassembly:
lea ecx, [ebp - 0x1c]
jmp 0x103d91de
push esi
cmp bh, 0xa8
not si
push edi
bts eax, ebp
mov eax, dword [0x10149de0]
rol si, 0xfa
neg esi
xor dword [ebp - 8], eax
xor eax, ebp
push eax
sub esi, eax
rcl esi, 0x9a
test esi, edi
lea eax, [ebp - 0x10]
bts si, sp
cmovae si, cx
mov dword fs:[0], eax
add esi, ebp
neg si
mov dword [ebp - 0x18], esp
rcr eax, cl
mov esi, ecx
xchg ah, ah
bsf eax, ecx
xadd ah, ah
xor edi, edi
jmp 0x10405f99
call fcn.10071ea3
mov edx, dword [ebp - 0x1c]
jmp loc.1004053d
push ebp
mov ebp, esp
bt ax, 0xf2
add al, 0x69
ror eax, cl
push 0xfffffffffffffffe
push 0x1043d0a8
ror ax, cl
test esp, 0x56d3255f
push 0x10078230
bt eax, 0x50
sbb eax, edi
sal ax, cl
mov eax, dword fs:[0]
test dh, 0x6d
push eax
sub esp, 0x14
rol ax, cl
rcr ax, 0x70
cmovle ax, bp
push ebx
lahf
jmp 0x1021dc7f
mov dword [ebp - 0x20], edi
cbw
not al
movsx ax, bh
mov dword [ebp - 4], edi
cbw
lahf
push 0x10111c90
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.10071bb0
lea esp, [esp + 0xc]
sub ax, cx
xadd ah, al
bts ax, di
mov eax, dword [ebp - 0x1c]
cmp ax, sp
cmp eax, edi
jmp 0x104b50ac
lea ecx, [ebp - 0x20]
push ecx
jmp 0x10285800
push ecx
jmp loc.100449c2
mov dword [ebp - 0x1c], edi
jmp 0x10368592
push 0x10111c94
xchg ch, cl
bswap cx
push esi
jmp 0x101cfb79
je 0x10436d8f
push eax
push 1
push 2
jmp 0x103cfcb2
Function at 0x1034909e
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push eax
rcl al, 0x73
lea eax, [esp + 0x2d8]
clc
cmc
mov dword fs:[0], eax
xadd ax, ax
cmc
mov eax, dword [ebp + 8]
cmp esp, 0x581a6923
xor esi, esi
test esi, 0x95d1366
cmp ecx, 0x62ff34cd
cmp dword [ebp + 0xc], esi
jmp 0x1048ca73
mov byte [esp + 0x141], 0xc4
jmp 0x1033c530
mov byte [esp + 0x173], bl
xchg bl, bl
mov bl, 0xd1
jmp 0x1026ad09
mov byte [esp + 0x143], 0xe4
mov byte [esp + 0x144], 0x6d
jmp 0x10392ecb
mov byte [esp + 0x14e], 0xa6
jmp 0x1002d4ec
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x2e0], esi
mov cl, 0xbe
mov bl, 0x37
not al
mov al, al
mov al, 0xaf
jmp 0x10401b01
mov byte [esp + 0x13d], cl
jmp 0x1049a817
mov byte [esp + 0x149], 0x97
mov byte [esp + 0x14a], 0x62
mov byte [esp + 0x14b], 0x12
jmp 0x104ba0e8
mov byte [esp + 0x13c], 0xb
jmp 0x1023ec9f
mov byte [esp + 0x142], 0xb9
jmp 0x101ed6ff
push ebp
bsf bp, ax
xor bp, si
bt ebp, 0xb3
mov ebp, esp
and eax, edi
btr ax, ax
and esp, 0xfffffff8
xor ah, 0xde
btc ax, dx
cmp edi, ebp
push 0xffffffffffffffff
rol eax, cl
push 0x100e706b
mov eax, dword fs:[0]
cmp bh, al
push eax
rcl al, 0x3b
cmc
shl eax, 0xd
lea esp, [esp - 0x2c8]
bt eax, 0x34
mov eax, dword [0x10149de0]
stc
test esp, esi
xor eax, esp
jmp 0x10424951
call fcn.10007210
mov edx, dword [eax]
not cl
mov ecx, 0x48ac56a3
mov ecx, eax
jmp 0x104b78cd
mov byte [esp + 0x147], 0x24
jmp 0x104854f5
mov byte [esp + 0x145], 0x50
jmp 0x103c159f
mov byte [esp + 0x140], 0xc8
jmp 0x101cc917
mov byte [esp + 0x13f], 0xba
jmp 0x10399945
mov byte [esp + 0x146], 0x62
jmp 0x1038a1ca
jne 0x10378471
push 0x80004005
jmp 0x1037846c
mov dword [esp + 0x1c], edx
jle 0x103a4f28
call fcn.10062dcf
sub ecx, ecx
cmp eax, esi
not cl
setne cl
cmp ecx, esi
jmp 0x103c771d
mov dword [esp + 0x24], ecx
jmp 0x103c8de3
mov dl, 0xac
mov cl, 0x53
mov byte [esp + 0x172], bl
jmp 0x101dbb1e
mov dword [esp + 0x2c0], eax
push ebx
push esi
push edi
not ah
rol al, 0xf8
mov eax, dword [0x10149de0]
cmc
xor eax, esp
jmp 0x10179401
mov byte [esp + 0x148], al
jmp 0x102424dd
mov dword [esp + 0x28], eax
jmp 0x103e44d9
mov byte [esp + 0x13e], 0x1a
jmp 0x103bce77
mov eax, dword [edx + 0xc]
jmp 0x1021dbbf
mov byte [esp + 0x14c], 0x7d
mov byte [esp + 0x14d], 0xe8
jmp 0x101f8c78
Function at 0x1034ed4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
movzx ebp, dx
cwde
mov ebp, esp
mov al, 0x97
movzx ax, dh
bswap ax
mov eax, 0x1900
jmp 0x1043343b
mov word [ebp - 0x58], cx
mov edx, 0x61
and ax, sp
sub eax, 0x51232e7c
sar cx, 0x74
mov word [ebp - 0x56], dx
rdtsc
bsf ax, si
cbw
mov eax, 0x67
mov word [ebp - 0x54], ax
cwde
mov ecx, 0x69
adc dl, 7
ror edx, 0x41
and dh, 0xb4
mov word [ebp - 0x52], cx
xor dl, 0
mov edx, 0x63
sbb ecx, esi
xadd ah, al
rcr cl, 0x38
mov eax, 0x2e
sub cl, 1
movsx ecx, cx
sar cx, 0xdf
mov ecx, 0x74
cmp cx, cx
cmp dh, 0
mov word [ebp - 0x50], dx
btr dx, 0x40
mov word [ebp - 0x4e], ax
mov eax, ecx
rol dx, cl
cwd
mov edx, 0x78
mov word [ebp - 0x4c], cx
jmp loc.10046b86
call fcn.10079fe0
mov eax, dword [0x10149de0]
bt ecx, edi
add dx, 0x58c1
neg dh
xor eax, ebp
cmc
shr dh, 0x2b
btr edx, edx
mov dword [ebp - 4], eax
sbb cl, 0xee
shld ecx, edi, 0x68
push esi
rol ah, cl
push edi
mov al, al
test ax, di
mov eax, 0x2e
btr ecx, edx
sub cl, ah
sal edx, 0xe5
mov word [ebp - 0x28], ax
shr ch, cl
ror dx, 0x95
cmovge eax, edx
mov ecx, 0x74
rdtsc
sar ax, cl
mov eax, ecx
sal dx, 0x5f
mov word [ebp - 0x26], cx
xor ecx, ecx
sbb edx, 0x7b956190
shl dx, cl
ror dh, cl
mov word [ebp - 0x22], ax
lahf
mov word [ebp - 0x20], cx
cdq
shld eax, ecx, 0xfc
mov edx, 0x78
adc ah, bh
rcr ecx, 0xb2
btc eax, esp
mov word [ebp - 0x24], dx
mov ch, 2
shld cx, dx, 0x31
sal ch, cl
mov edx, 0x53
ror cl, 2
movzx eax, ax
mov word [ebp - 0x44], dx
not ecx
mov eax, 0x65
mov word [ebp - 0x42], ax
sal eax, cl
add cx, si
shrd cx, bx, 0xfc
mov ecx, 0x74
sar ah, cl
mov edx, ecx
ror ah, cl
shl eax, 0x91
adc ah, dl
mov word [ebp - 0x40], cx
setl ah
mov word [ebp - 0x3e], dx
shl dx, 0xc0
mov eax, 0x69
sbb cx, 0x3f6d
mov word [ebp - 0x3c], ax
shrd dx, si, 0x4d
bts dx, cx
xor eax, eax
rcr dl, 0x61
shl dx, 0x76
mov word [ebp - 0x36], ax
bts edx, eax
mov ecx, 0x6e
mov word [ebp - 0x3a], cx
sal ch, cl
mov ecx, 0x76
bts dx, cx
mov word [ebp - 0x7c], cx
mov edx, 0x67
mov word [ebp - 0x38], dx
mov eax, 0x72
mov word [ebp - 0x78], ax
mov ecx, 0x31
clc
mov word [ebp - 0x76], cx
stc
btc edx, 0x24
sub al, 0x75
mov edx, 0x65
mov word [ebp - 0x7a], dx
mov eax, 0x30
cwd
mov word [ebp - 0x72], ax
bts edx, ecx
mov ecx, 0x39
shl al, cl
btr eax, esp
mov word [ebp - 0x70], cx
cmp esi, ebp
btr cx, 0x88
mov edx, 0x32
mov word [ebp - 0x74], dx
neg ecx
mov word [ebp - 0x6e], dx
mov eax, 0x37
mov word [ebp - 0x6c], ax
cmp dx, ax
rcl dh, cl
sub eax, eax
bswap edx
mov ecx, 0x30
mov word [ebp - 0x6a], cx
or dx, bp
adc dx, 0x2a4
ror dl, cl
mov word [ebp - 0x66], ax
adc edx, edi
rcr cx, 0x18
setb ch
mov edx, 0x31
shr cx, cl
rcl cx, 0x2d
mov word [ebp - 0x68], dx
btr ecx, 0xa9
mov ecx, 0x6d
cwd
sar al, cl
jmp 0x1038c3e0
Function at 0x10358319
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 4], 6
jmp 0x103f5ebb
push eax
jmp 0x1022ed5f
push edx
jmp 0x10281c81
call fcn.103974dd
add esp, 0x1c
lea eax, [ebp - 0x1178]
mov cx, bp
push eax
lea ecx, [ebp - 0x11e4]
jmp 0x103f2a1c
mov dword [ebp - 0x1214], edx
jmp 0x103b2c2f
call fcn.1024adbc
add esp, 0x1c
setp ah
lahf
push ebx
lea esi, [ebp - 0x9c]
lea eax, [ebp - 0x520]
jmp 0x103fc409
call fcn.10027d30
test al, al
jmp 0x103ae392
call fcn.10342fa3
add esp, 0x1c
mov ax, cx
push ebx
cwde
lea esi, [ebp - 0x28]
bswap eax
lea eax, [ebp - 0x520]
jmp 0x10033185
lea eax, [ebp - 0x520]
movzx dx, ah
not ch
mov dx, di
push eax
lea ecx, [ebp - 0x950]
push ecx
cbw
lea edx, [ebp - 0x788]
push edx
movsx eax, ax
push 3
mov eax, ebx
lahf
cbw
lea eax, [ebp - 0x18]
jmp 0x10486642
push edx
jmp 0x101e64a2
jle 0x104655a2
mov ecx, dword [ebp - 0x1178]
not dx
lahf
cbw
mov edx, dword [ebp - 0x11c0]
push ecx
push edx
movsx ax, cl
xchg edx, eax
lea eax, [ebp - 0x950]
movsx ecx, sp
push eax
jmp 0x104319d1
call fcn.10027d50
add esp, 4
cmp ebp, esp
cmp di, 0x6488
cmp dword [ebp - 0x1188], ebx
jmp 0x102c46ba
push 0x4d
jmp 0x10291969
je 0x1022ed6b
mov edx, dword [ebp - 0x1178]
jmp 0x103e75b2
push 0xb059c7dd
call fcn.104aea3b
call fcn.103f6a45
add esp, 0x1c
xchg di, ax
lea edx, [ebp - 0x1178]
push edx
jmp 0x10455ac2
call fcn.10027ce0
add esp, 4
mov ax, sp
lea eax, [ebp - 0x520]
jmp 0x1047230c
mov dword [ebp - 0x1210], ecx
jmp 0x102010d2
je 0x10281c8c
mov ecx, dword [ebp - 0x1178]
movsx eax, cx
push ecx
movzx eax, si
mov al, 0xe5
rdtsc
lea edx, [ebp - 0x520]
push edx
lea eax, [ebp - 0x950]
cwd
push eax
lea ecx, [ebp - 0x788]
jmp 0x10406603
call fcn.1004b1d0
test al, al
je 0x103f5ec0
lea esi, [ebp - 0x11c0]
jmp 0x103b7128
call fcn.10019690
mov byte [ebp - 4], 0xc
xchg esi, eax
lahf
push 1
bswap esi
cmovg esi, ecx
mov esi, 0x10111d96
cwde
mov ax, cx
movzx eax, bp
lea eax, [ebp - 0x520]
jmp 0x1041ce5b
push edx
jmp 0x1028e3d3
call fcn.1004b140
mov ecx, dword [ebp - 0x11cc]
mov di, 0x28ee
movsx edx, bx
mov edx, dword [ebp - 0x11e4]
xchg edi, esi
lea esi, [ebp - 0x1214]
bswap edi
lea edi, [ebp - 0x12bc]
jmp 0x103abb66
push ecx
jmp 0x1046558f
push 0x4d
jmp 0x101bc145
call fcn.10006c80
push ebx
lea esi, [ebp - 0xac]
lea eax, [ebp - 0x520]
jmp 0x1037e12b
call fcn.10027ce0
add esp, 4
lahf
mov ah, ch
lea eax, [ebp - 0x520]
jmp 0x102373f4
push ecx
push 3
not dl
cwd
bswap dx
lea edx, [ebp - 0x18]
jmp 0x103f3d11
push 0x1e
mov edx, 0x374176a3
lea edx, [ebp - 0x18]
jmp 0x102f5798
mov dword [ebp - 0x1188], ebx
jmp 0x1046a8bf
lea ecx, [ebp - 0x520]
movsx edx, dx
push ecx
jmp 0x1040d326
lea eax, [ebp - 0x12bc]
push eax
xchg edi, edi
lea edi, [ebp - 0x11e4]
jmp 0x103ea97d
call fcn.1004b0a0
mov dword [eax], 1
mov cl, 0x9d
movsx ecx, di
not cx
lea ecx, [ebp - 0x11c0]
jmp 0x10178867
call fcn.10027ce0
lea eax, [ebp - 0x1188]
bts di, bx
add esp, 4
push eax
cmovle di, sp
lea edi, [ebp - 0x11c0]
lea ecx, [ebp - 0x520]
jmp 0x102cd5ea
call fcn.10027d30
test al, al
jmp 0x1030db90
push 0x4d
jmp 0x101a4d58
Function at 0x10379d3f
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push 0x83db820f
call fcn.103dbcab
test ch, 0x39

Function at 0x1037e689
Capabilities:
Get number of processors

Disassembly:
mov byte [esp + 0x15], 0x61
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], dl
jmp 0x102efd03
inc esi
jmp 0x1042ec44
mov byte [esp + 0x25], 0x38
mov byte [esp + 0x26], 0x58
jmp 0x10453631
mov byte [esp + 0x24], 0x30
jmp 0x10244bba
mov byte [esp + 0x18], cl
jmp 0x103a3c71
mov byte [esp + 0x20], bl
jmp 0x103b957e
mov byte [esp + 0x14], 0x42
jmp 0x101a3512
call eax
add eax, 0x10
setno bh
not dl
mov dword [esp + 0x10], eax
mov cl, 0x20
setb dl
mov dword [esp + 0x38], 0
mov dl, dl
setp al
mov dl, 0x20
xchg al, al
seto al
mov cl, 0x63
not bx
mov al, 0x65
movzx ebx, dx
mov ebx, 0x64
jmp 0x1031da30
push ebp
cbw
mov ebp, esp
xor ax, 0x6cf4
test bx, 0x3f6f
sar ax, 0x6b
and esp, 0xfffffff8
shr ah, 7
push 0xffffffffffffffff
xadd ax, ax
stc
push 0x100e8178
adc eax, ebx
mov eax, dword fs:[0]
test di, cx
push eax
adc ax, 0x1225
sub esp, 0x20
mov eax, dword [0x10149de0]
cmp edi, esi
cmp cx, 0x274
xor eax, esp
cmc
cmp eax, esi
mov dword [esp + 0x18], eax
inc eax
clc
xchg ah, al
push ebx
add ax, di
xadd ax, ax
bt eax, 0x9b
push esi
cmc
push edi
mov eax, dword [0x10149de0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
test ax, 0x19f3
movsx edi, sp
mov edi, ecx
cmp dword [0x10168b5c], 0
jmp 0x104840fd
call fcn.10007210
mov edx, dword [eax]
setbe ch
mov ecx, eax
bswap eax
cwde
mov eax, dword [edx + 0xc]
jmp 0x10375300
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x6f
jmp 0x103155ed
mov byte [esp + 0x19], 0x68
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0x61
jmp 0x1045406f
mov byte [esp + 0x21], al
jmp 0x1040ac6d
jne 0x1038c8c2
push 0x80004005
jmp 0x1038c8bd
mov byte [esp + 0x22], 0x3a
mov byte [esp + 0x23], 0x25
jmp 0x102557e9
call fcn.10021490
push eax
jmp 0x104a502b
mov byte [esp + 0x27], 0
jmp 0x1043708f
mov byte [esp + 0x1c], 0x74
jmp 0x1038d518
je 0x103973b4
call fcn.10062dcf
sub ecx, ecx
rol cl, cl
test eax, eax
setne cl
test ecx, ecx
jmp 0x103dfa08
call fcn.10071778
add esp, 4
call fcn.1007178a
cdq
idiv ebx
mov esi, edx
jmp 0x101d7fc4

Function at 0x1038bff9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x840971d4
call fcn.101c42f5
push 0x33df5494
call fcn.10180fe0

Function at 0x1039b542
Capabilities:
Read file on windows

Disassembly:
push edx
jmp 0x102ea764
push esi
call fcn.10072af0
lea esp, [esp + 8]
test eax, eax
jne 0x10049268
push 0x83db820f
call fcn.103dbcab
jne 0x10049268
lea edx, [ebp - 0x10]
jmp 0x102a07df

Function at 0x103ad18c
Capabilities:
Read file on windows

Disassembly:
push 0xb059c7dd
call fcn.104aea3b
Function at 0x103ae295
Capabilities:
Authenticate hmac

Disassembly:
push esi
jmp 0x1041f82c
call fcn.10078150
add esp, 0xc
add cl, 0xab
sar cx, 0x44
push 0x206
clc
bts cx, cx
lea ecx, [ebp - 0x48e]
stc
cmc
test dx, di
xor eax, eax
jmp 0x10492098
call fcn.10078150
add esp, 0xc
push 0x1ff
lea edx, [ebp - 0x287]
jmp 0x10367793
mov byte [ebp - 0xee8], 0
jmp 0x1034722c
push esi
jmp 0x103b89ed
call fcn.10078150
lea esp, [esp + 0xc]
push 0x206
clc
lea eax, [ebp - 0xc9e]
sub edx, edx
jmp 0x103d3e4e
mov word [ebp - 0x490], ax
jmp 0x103a25b1
push ebp
setl dl
mov ebp, esp
push 0xffffffffffffffff
push 0x100e84d1
sar ah, cl
cmp edi, 0x5fae4d01
mov eax, dword fs:[0]
push eax
sub esp, 0xefc
bswap ax
mov eax, dword [0x10149de0]
test ebp, esp
xor eax, ebp
sar edx, cl
mov dword [ebp - 0x10], eax
shrd dx, di, 0x4f
push ebx
or dh, dh
push esi
shrd edx, esi, 0xdc
add dx, 0x663a
push edi
adc dx, si
push eax
sal dx, cl
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp si, cx
sub dh, cl
push 0x206
sal dl, cl
movsx edx, bx
sub esi, esi
dec edx
not edx
cdq
lea edx, [ebp - 0xa96]
cmc
test dh, 0x76
clc
sub ecx, ecx
push esi
push edx
mov dword [ebp - 0xef8], eax
mov word [ebp - 0xa98], cx
jmp 0x1029785e
push edx
jmp loc.1003a64c
push esi
push eax
jmp 0x104465fd
push ecx
mov dword [ebp - 0xf00], esi
jmp 0x10363ff6
mov word [ebp - 0xca0], dx
jmp 0x1047c87b
call fcn.10078150
add esp, 0xc
push 0x3f
lea ecx, [ebp - 0xee7]
jmp 0x1022990d
push esi
jmp 0x104ac40a
push ecx
jmp 0x103a8e3d
Function at 0x103b724f
Capabilities:
Reference processor manufacturer constants

Disassembly:
mov byte [ebp - 0x48], 0x56
jmp 0x104174a1
push ebx
push esi
jmp 0x104a1401
mov byte [ebp - 0x45], 0x78
jmp 0x1045bb78
push ebp
cmovg bp, bx
sbb ebp, 0x5c7447de
mov ebp, esp
xor ax, 0x4431
cmc
bts ax, si
lea esp, [esp - 0xac]
dec eax
mov eax, dword [0x10149de0]
clc
stc
test edx, 0x73733f4a
xor eax, ebp
jmp 0x104c7ce5
mov byte [ebp - 0x47], 0x42
jmp 0x104a65cf
mov byte [ebp - 0x44], 0x54
jmp loc.10039625
push edi
jmp 0x101f1303
mov byte [ebp - 0x46], 0x6f
jmp 0x103254fe
mov dword [ebp - 4], eax
jmp 0x10291587