joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a3993
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x8297f390
mov word [edi], bp
mov dword [esp + 4], 0x8d0ce79f
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a39e2
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a39eb
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
adc edi, 2
push 0x5291930a
jmp loc.1006229a

Function at 0x101a39fb
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
adc edi, 2
sal al, cl
mov word [edi], ax
jmp loc.1006221e

Function at 0x101a3a62
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a8fec
mov word [edx], ax
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101a3af2
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xcc0e1499
lea edx, [esp + edx + 0xc]
push 0x1b8d9237
mov byte [edx], cl
lea esp, [esp + 0x10]
jnp fcn.101a9e3e

Function at 0x101a3bb5
Capabilities:
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime
Terminate process

Disassembly:
call fcn.1006261a
push 0x39079f0e
xor al, bl
rol byte [esp], 0xa7
jae 0x1006914a
jae 0x101a80fe
not al
call fcn.101a95fa
call fcn.101a7150
not ax
push 0x7ca13e9e
jne 0x101a4592

Function at 0x101a3c21
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
xor bl, cl
call fcn.101a2ffa
sar dword [esp], 0xc6
dec dword [esp]
shld dx, ax, cl
jmp loc.101a3559
mov dword [esp], 0x7bae3f1a
neg ax
sar dword [esp], 0x81
or byte [esp], 0x25
jp 0x10063a06
dec ax
ror ax, 1
call fcn.101a4e56

Function at 0x101a3d46
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
not dword [esp + 0x14]
lea edx, [esp + edx + 0x1c]
not byte [esp + 0x11]
mov byte [edx], al
push 0x5c246134
lea esp, [esp + 0x20]
jnp fcn.101a9e3e

Function at 0x101a3e45
Capabilities:
Terminate process

Disassembly:
jmp 0x101a6881
not ax
mov dword [esp], 0x7e30ea92
push 0xc5afe5a6
not cx
call fcn.101a9774

Function at 0x101a3e98
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov dx, word [edi]
mov dword [esp + 4], ebp
sal word [esp + 5], 5
mov bp, word [edi + 2]
mov cl, byte [edi + 4]
inc dword [esp + 4]
shr dword [esp + 4], 0xb0
adc edi, 3
ror byte [esp + 2], 0xc5
neg word [esp + 6]
dec dword [esp]
shld dx, bp, cl
mov word [edi], dx
jmp 0x101a549d

Function at 0x101a3fa2
Capabilities:
Terminate process

Disassembly:
push 0x3d3fb33a
push 0xe933f135
lea esp, [esp + 0x1c]
jmp fcn.101a8301

Function at 0x101a3fc4
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp + 0x18], 0xddb33f36
push 0x7b290b1e
xor bl, dl
jmp 0x101a6633
call fcn.101a4653

Function at 0x101a4184
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a41c8
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e
Function at 0x101a427a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x1299a018
jmp 0x101a5548
mov word [edi], ax
call fcn.101a5576

Function at 0x101a4298
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a4395
Capabilities:
Terminate process

Disassembly:
push 0x332c64be
mov dword [edi], ecx
jmp 0x101a69d8
lea esp, [esp + 0xc]
jmp fcn.101a8301

Function at 0x101a43d9
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
add cl, dl
call fcn.101a9b63
add edi, 2
sal ebp, cl
jmp 0x101a84d6
call fcn.101a34f6
mov dword [edi], ebp
call fcn.101a7d85
mov edx, 0xe8a3e11a
lea ecx, [edx*2 - 0x5b4ccf6d]
push ecx
movzx cx, byte [edi + ecx - 0x75faf2c7]
lea edx, [edx + edx*2 - 0x784f0849]
ror dx, 0xea
sal dword [esp + edx - 0x419cc166], 0x49
mov dl, byte [edi + edx - 0x419cc164]
shl dword [esp], 0x52
adc edi, 2
shl word [esp], 0xed
adc cl, dl
mov word [esp + 1], 0xeab7
jmp 0x101a6ebe

Function at 0x101a43f2
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov ebp, dword [edi + ebp - 0x128038af]
neg cl
mov edx, dword [edi + 4]
adc cx, 0xf798
mov dword [esp], 0x11a2c785
mov cl, byte [edi + 8]
adc edi, 5
shld ebp, edx, cl
push 0xa22f8020
mov dword [edi], ebp
jmp 0x101a24e9

Function at 0x101a4521
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a4537
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp 0x101a4ef6
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a454e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x57a37eaf
add edi, 6
push 0x70859488
mov dword [esp + 8], 0xe80cf9a2
jmp 0x101a87a4
shld eax, edx, cl
mov dword [edi], eax
push 0xb71a94a3
jmp 0x101a8b0f
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a457f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a45e0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x8abe840b
not al
jmp 0x101a4b54
neg al
jmp 0x101a674b
ror dword [esp], 0xbc
jb 0x101a6f10
add eax, edx
call fcn.101a9d5f
xor bl, al
jmp loc.10064ed9

Function at 0x101a4653
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
sar byte [esp + 0x14], 0xa5
sbb edi, 2
jmp 0x101a8165
call fcn.101a6599
jmp 0x101a7a8d

Function at 0x101a477c
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
shr byte [esp + 0xb], 0x61
rol cl, 1
jmp loc.100639f7

Function at 0x101a4798
Capabilities:
Terminate process

Disassembly:
mov dword [esp], 0x9aa37db4
rol dword [esp], 0x8e
movzx bp, byte ss:[ecx]
setb byte [esp + 1]
not dword [esp]
adc edi, 2
push 0xf628b292
mov word [edi], bp
push 0x241ea98c
push 0x449a9720
call fcn.101a4ca1
lea esp, [esp + 0xc]
jmp fcn.101a8301
Function at 0x101a4818
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp 0x101a5300
lea esp, [esp + 0x14]
jmp fcn.101a9e3e
mov word [edi], cx
push 0xf91485b6
push 0xb014c713
jmp 0x101a4924

Function at 0x101a49bf
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0xa133a327
bswap ecx
jmp loc.10063512

Function at 0x101a4a32
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jge 0x101a2c3b
mov dl, cl
mov ecx, 0x99065183
mov dx, word [edi]
mov dword [esp], ecx
and word [esp], cx
mov cl, byte [edi + 2]
je 0x101a65d9
jno 0x101a3054

Function at 0x101a4abe
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov ax, word [edi]
mov edx, 0x9abaf282
movzx ecx, dl
mov dx, word [edi + ecx*2 - 0x102]
btr cx, cx
rol cx, cl
mov dword [esp + ecx*8 - 0x1040], 0x2d88ad84
mov cl, byte [edi + ecx*8 - 0x103c]
adc edi, 4
ror dword [esp], 0x55
not word [esp + 1]
shld ax, dx, cl
not dword [esp]
jmp 0x101a81ea
mov word [edi], ax
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101a4b67
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a77ae
mov dword [esp], 0xf48ba188
jmp 0x101a70e9
rol al, 1
dec dword [esp + 3]
xor bl, al
or dword [esp + 4], 0xa93da99
jge 0x101a4293

Function at 0x101a4bec
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0x38043a83
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a4bfd
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.101a9e3e

Function at 0x101a4c46
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], cx
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a4c64
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a2bd7
test edx, ebx
bt cx, cx
btr ecx, 0x2d
mov ecx, dword [ecx + edi - 0x7c9c3d]
jb 0x101a3e33

Function at 0x101a4c79
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
rol dword [esp], 0x86
xor al, bl
ror al, 1
inc al
push 0x91a7c08
not al
sar dword [esp + 3], 0xb5
dec dword [esp + 4]
mov dword [esp + 8], 0xc1349218
rol al, 1
push 0xd92b7e82
push 0x31d8904
neg dword [esp + 0xa]
xor bl, al
jmp 0x101a968f
mov eax, 0xa81566a5
add edi, 2
bswap eax
push eax
sub esi, 1
dec al
bts ax, 0x92
btr eax, eax
movzx eax, byte [esi]
jb 0x101a47de
mov word [eax], bp
push 0x570ae52c
jmp loc.10064ec0
not dword [esp + 5]
lea eax, [esp + eax + 0x14]
not word [esp + 0x12]
jmp 0x101a8008

Function at 0x101a4ca1
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e
Function at 0x101a4deb
Capabilities:
Terminate process

Disassembly:
shl dword [esp + 4], 0x41
sete byte [esp + 4]
adc cl, 0xbb
shl dword [esp + 3], 0x5e
sar dword [esp + 4], 0x70
rol cl, 1
push 0xd106488f
rol word [esp + 8], 0x4c
xor bl, cl
mov dword [esp + 2], 0xb2acf901
sub edi, 2
mov word [edi], cx
push 0xeb271896
push 0x4a3285b7
lea esp, [esp + 0x14]
jmp fcn.101a8301
jbe 0x10068de5
xor dl, bl
mov dword [esp], 0x8e853887
add dl, 8
xor dl, 0xac
ror dword [esp], 0x16
rol dl, 1
shr byte [esp + 3], 0x21
inc dl
xor bl, dl
inc byte [esp + 2]
call fcn.101a3af2

Function at 0x101a4e56
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
add ax, 0xe90a
xor ax, 0x9a0b
shr word [esp + 4], 0x89
xor bx, ax
jmp loc.10063686

Function at 0x101a4e83
Capabilities:
Terminate process

Disassembly:
sal byte [esp + 0xd], 0xc5
xor cx, 0x9a0b
xor bx, cx
add dword [esp + 0xc], 0x371c6c2f
sbb edi, 2
mov word [edi], cx
lea esp, [esp + 0x10]
jmp fcn.101a8301

Function at 0x101a4eaf
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [edi], ecx
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a4ef1
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp 0x101a801e
mov dword [edi], eax
mov dword [esp], 0x79bc56a8
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101a4f8f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x1c]
jmp fcn.101a9e3e

Function at 0x101a5003
Capabilities:
Terminate process

Disassembly:
mov word [edi], cx
jmp 0x101a2c36
call fcn.101a8602
adc edi, 2
call fcn.101a517d
call fcn.10067100
lea esp, [esp + 0xc]
movzx edx, al
test edx, edx
jne 0x101a7ae2
mov dword [ebp - 0x244], 1
jmp 0x101a5bd0
jmp 0x101a2c0a
mov dword [ebp - 0x244], 0

Function at 0x101a5088
Capabilities:
Get graphical window text

Disassembly:
not dl
mov dword [esp], 0xf28ee2a1
jmp 0x101a5d41

Function at 0x101a50d7
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp 0x101a7147
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a511e
Capabilities:
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime
Terminate process

Disassembly:
xor dl, bl
call fcn.101a5c92
rol cl, 1
jmp 0x1006391a
push edx
sub cl, 0x30
xor bl, cl
imul edx, edx
xchg word [esp + 0xd], dx
sbb edx, 0x73202311
lea ecx, [esp + ecx + 0x10]
xor dword [esp + edx*2 - 0x2c47319f], 0x2c1518bf
sbb dx, dx
jae 0x101a510b
add dx, word [edx + ecx - 0x16230000]
sub edi, 2
call fcn.101a7eea
mov ecx, 0xb4b75802
btc cx, cx
mov dx, word [edi]
xor cl, 0xac
movzx ebp, cx
mov bp, word [edi + ebp*2 - 0xb152]
jp 0x101a6357
mov cl, byte [edi + 4]
push 0xaa3afb35
jno 0x101a9525
mov edx, 0x560c753e
lea edi, [edi + edx - 0x560c753c]
or edx, edx
sbb dx, dx
lea esi, [edx + esi - 0x560c0001]
shr dx, 0x6e
movzx edx, byte [edx + esi - 0x560c0000]
jns 0x10025b2b
call dword [sym.imp.USER32.dll_SetPropW]
push edx
xor cl, bl
or edx, edx
mov dword [esp + edx - 0x43bbe54c], edx
setp dl
neg cl
rol edx, 0x61
not cl
push edx
jae 0x10063580
Function at 0x101a513f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a8e08
mov byte [eax], cl
jmp 0x101a3827

Function at 0x101a5146
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp 0x101a53d7
adc edi, 2
jmp 0x101a6acf
mov word [edi], cx
push 0x4c3ef180
jmp 0x101a99ed
jmp 0x101a5106
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a515d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0xf80d30aa
xor cl, bl
call fcn.100625e7
mov ecx, 0xd4a02d29
bts cx, cx
mov ecx, edi
jae 0x101a5e21

Function at 0x101a517d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
shr dx, cl
mov dword [esp], 0xa3cfe1f
mov word [edi], dx
push 0xe09abb9a
jmp loc.10063aaf

Function at 0x101a51e0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0xdd1e5d2f
push 0x2128c939
not bp
and dx, bp
call fcn.101a401f

Function at 0x101a51f8
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
adc edi, 3
mov dword [esp], 0x41a54d31
ror dword [esp], 0x29
shrd ax, dx, cl
jmp 0x101a65d5
not byte [esp + 3]
mov word [edi], ax
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101a5290
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x31fd9a9
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
mov dword ss:[ecx], ebp
jmp 0x101a5d46
jmp 0x101a3a21

Function at 0x101a5298
Capabilities:
Terminate process

Disassembly:
mov dword [esp], 0xbbaf67b6
adc edi, 1
mov dword [esp + 4], 0xd1df31c
shr eax, cl
push 0xfb3c9394
push 0xf62439b7
mov dword [edi], eax
call fcn.101a653c
call fcn.101a6ec3
and dl, ch
ror dx, 0x89
movzx edx, byte [esi]
inc ecx
rol ecx, 0xb9
xadd cl, ch
xor dl, bl
neg dl
ror cx, 0x4c
not dl
rol dl, 1
shl ecx, cl
sbb dl, 0x30
xor bl, dl
bswap ecx
add ecx, 0x38b558af
xor ecx, ecx
adc edx, esp
add cx, word [ecx + edx]
jmp 0x101a5665
push 0xc38027ab
sub edi, 2
push 0x751c4fab
mov word [edi], cx
push 0x87aa9cba
lea esp, [esp + 0xc]
jmp fcn.101a8301

Function at 0x101a5323
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xbc3f6224
mov word [edi], ax
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a5440
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x7510dd1c
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a5498
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.10063a3f
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x101a5576
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.101a9e3e

Function at 0x101a5596
Capabilities:
Terminate process

Disassembly:
call fcn.101a85a9
mov dword [esp + 0x20], 0x6b0a3119
lea esp, [esp + 0x28]
jmp fcn.101a8301

Function at 0x101a564b
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
Function at 0x101a56a8
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x340b8624
add edi, 4
push 0x1db96001
mov dword [esp + 8], edx
call fcn.101a8bbe

Function at 0x101a56c1
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xd2144cac
jae 0x101a55da
sub esi, 1
mov edx, 0x4f26b907
imul dx, dx
movzx edx, byte [esi + edx - 0x4f261e31]
jo 0x101a77f0
push eax
jmp 0x100636bf
call fcn.100f29f0
add esp, 0xc
jmp loc.101a2ac4
sbb edi, 2
mov word [edi], bp
call fcn.101a3893
push 0xb
push 0x1013029c
mov ecx, dword [ebp - 0x120]
jmp 0x101a6cb1
not cl
inc ebp
rol cl, 1
mov dword [esp + ebp*8 - 0x780008], ebp
sub cl, 0x30
bts bp, bp
rol word [esp + ebp*2 - 0x1e0004], 0x44
imul ebp, ebp
xor bl, cl
pop ebp
add ecx, esp
ror ebp, 0xd0
bswap ebp
mov bp, word [ecx]
jae 0x100623c7
mov byte [ebp - 4], 0
not cl
movzx cx, ch
lea ecx, [ebp - 0xd0]
jmp loc.10064e42
push ecx
jmp 0x101a7f01
xor dl, bl
rol dl, 1
call fcn.101a97f0
call fcn.101a99b4
push eax
invalid
call dword [sym.imp.USER32.dll_SetPropW]
jmp 0x101a6396

Function at 0x101a56f4
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a5710
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a5bd5
Capabilities:
Terminate process

Disassembly:
add edi, 2
call fcn.10062563
mov ebp, edi
sub edi, 2
push 0xeba4d58a
push 0xad233cbf
mov word [edi], bp
mov byte [esp + 7], 0x28
lea esp, [esp + 8]
jmp fcn.101a8301

Function at 0x101a5c92
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Terminate process

Disassembly:
rol dl, 1
dec word [esp + 1]
push 0x719e7c21
xor bl, dl
neg dword [esp + 3]
call fcn.101a9e12
mov dword [esp], 0xf13d2b7
dec byte [esp + 1]
ror dl, 1
shr dword [esp], 0x2d
inc dword [esp]
inc dl
not dl
inc word [esp + 1]
jns 0x100648d2
mov ebp, 0xb40e5bae
movsx ecx, bp
lea ecx, [ebp*2 + 0xf2f3a90]
mov ecx, dword [edi + ecx - 0x774bf1ec]
mov bp, word [ecx]
push 0xdb349811
add edi, 2
mov word [edi], bp
jmp 0x101a8ce2
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101a5cf7
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xd597bb08
lea esp, [esp + 0x1c]
jmp fcn.101a9e3e
mov word [edi], cx
jmp 0x101a2cf0
Function at 0x101a5cff
Capabilities:
Get graphical window text

Disassembly:
push 0x1019e258
jmp 0x101a6e83
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x14], eax
stc
cmp bp, di
clc
cmp dword [ebp - 0x14], 0
jmp 0x101a717d
cmp byte [ebp - 1], 0
jmp 0x101a5407
mov edx, dword [ebp + 8]
push edx
jmp 0x101a816a
jne 0x101a6e4f
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
jmp 0x101a5e3c
mov word [esp + 9], 0x9495
inc dl
sal byte [esp + 0x13], 0x82
xor bl, dl
inc dword [esp + 0xd]
call fcn.101a3d46
push 0x85a682a8
mov edx, 0xb327df12
mov edx, dword [edi]
mov eax, 0x542b7ba4
mov ax, word [edi + eax - 0x542b7ba0]
add edi, 6
not dword [esp]
call fcn.101a434b
jmp 0x101a6b67
mov dword [ebp - 0x10], edx
jne 0x101a8170
mov eax, dword [ebp + 8]
jmp 0x101a671f
push eax
jmp 0x101a2a89
and al, dl
call fcn.101a2585
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x101318e0
jmp 0x101a23f1
je 0x101a8170
mov dword [ebp - 8], 0x1019e658
shl cl, 0x17
adc cl, 0x30
mov edx, dword [ebp - 8]
lea edx, [edx + 1]
bts ax, dx
sbb ah, bl
mov dword [ebp - 0xc], edx
add cl, al
cwde
mov eax, dword [ebp - 8]
mov cl, byte [eax]
stc
mov byte [ebp - 1], cl
cmp esi, 0xb889ae90
add dword [ebp - 8], 1
jmp 0x101a43a4
call fcn.10069490
add esp, 8
test eax, eax
jmp 0x101a6e2a
jne 0x101a8170
push 0
cdq
setnp cl
mov ecx, dword [ebp + 0xc]
xchg edx, edx
cdq
setns dh
push ecx
movzx edx, ax
push 0x8b5d
jmp 0x101a4ebd
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x101a9c02
jmp 0x10069381

Function at 0x101a5da5
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
and cx, ax
push 0xc5130482
push 0x4dbd963a
push 0x4d2f8d25
not cx
mov word [edi], cx
not dword [esp + 2]
not byte [esp + 0xb]
push 0xb0861622
lea esp, [esp + 0x18]
jmp fcn.101a9e3e

Function at 0x101a5e09
Capabilities:
Execute anti-debugging instructions

Disassembly:
and cl, al
push 0xa6b5e38a
not cl
push 0x16a6b917
push 0xbe98cf8a
call fcn.10025a93
call fcn.101a62c2

Function at 0x101a5fa5
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xac3e84bf
add edi, 2
mov dword [esp + 4], 0xc83edd1d
ror byte [esp + 5], 0xa1
add dl, cl
mov word [edi], dx
push 0x28b3549a
call fcn.101a4521

Function at 0x101a5fd1
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a5ff6
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], ax
mov dword [esp], 0xbf92c71b
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a600a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a615a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [edi], eax
push 0xa8bbd43d
lea esp, [esp + 0x18]
jmp fcn.101a9e3e
push 0x201fd8a0
or eax, ebp
jmp 0x101a2d10

Function at 0x101a62a1
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a8301
Function at 0x101a62aa
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], ax
jmp 0x101a744d
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a62b2
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a62c2
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
sbb edi, 4
call fcn.101a4395
mov cl, byte [edi + ecx - 0xd19119b]
adc byte [esp + 3], 0xbd
sar dword [esp], 0x43
sar dword [esp], 0x77
adc edi, 1
jmp 0x101a7948
push 0x37000737
not dword [esp + 4]
shr edx, cl
push 0xa3becf34
push 0x902e3508
mov dword [edi], edx
jmp 0x101a9ca6
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a633b
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
adc edi, 5
mov dword [esp], 0x4ab35107
call fcn.1006705b

Function at 0x101a63f7
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0xf48e888b
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a648d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov eax, dword [ebp]
push 0xc69ce70b
mov dword [edi], eax
lea esp, [esp + 0xc]
jmp fcn.101a9e3e

Function at 0x101a64a9
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp 0x101a6716
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a64f1
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
not byte [esp + 5]
lea esp, [esp + 0xc]
jb fcn.101a9e3e
mov dword [edx], eax
jne 0x101a241f
lea edx, [esp + edx + 0xc]
jb 0x101a4f82
mov bp, word [edi]
mov cl, byte [edi + 2]
call fcn.10066fa7
xchg dh, dh

Function at 0x101a653c
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e
jmp 0x101a3954

Function at 0x101a675d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xae9c0923
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a67d6
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dx, word [edi + 4]
adc edi, 5
push 0x653a8fa0
push 0x301772bd
mov word [ebp], dx
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a6828
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0x18c74a8
mov dword [edi], eax
call fcn.101a6857

Function at 0x101a6838
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
add edi, 2
sar byte [esp + 1], 0x84
push 0xc52efea4
or cx, ax
push 0x89846f3f
not byte [esp + 0xf]
push 0x99ada605
not cx
mov word [edi], cx
call fcn.101a69fe
and eax, 0xee8ec7a7
sub ax, ax
movzx eax, byte [esi + eax*2 - 0x410c0000]
mov dword [esp], 0xda822ca2
xor al, bl
jmp 0x101a942b
mov dword [esp + 4], 0xed3499bd
inc word [esp + 2]
add al, 8
call fcn.101a92c3
push 0xf8310d9f
jns 0x101a3fea
mov ecx, 0xdb908d93
movzx eax, cx
shr cx, 0x67
movzx ax, byte [edi + eax*8 - 0x46c98]
mov cl, byte [edi + 2]
push 0x4f8a2e24
call fcn.101a39fb