joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100df3a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x100df3c0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x10178c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10178d8c
test eax, eax
je 0x10178d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10193ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10178d73
lea edi, [eax + 4]
jmp 0x10178cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10178cec
mov dword [ebp - 4], 2
jmp 0x10178d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10178d03
mov dword [ebp - 4], 1
jmp 0x10178d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10178d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10178d46
mov byte [ecx], 0x3d
jmp 0x10178d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10178d5d
mov byte [ecx], 0x3d
jmp 0x10178d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10178cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10178cd2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10178d8c
test eax, eax
je 0x10178d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10193ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10178d73
lea edi, [eax + 4]
jmp 0x10178cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10178cec
mov dword [ebp - 4], 2
jmp 0x10178d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10178d03
mov dword [ebp - 4], 1
jmp 0x10178d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10178d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10178d46
mov byte [ecx], 0x3d
jmp 0x10178d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10178d5d
mov byte [ecx], 0x3d
jmp 0x10178d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10178cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101e7811
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push ebp
shld ebp, ecx, 0xe1
xor ax, cx
mov ebp, esp
rol al, cl
test ah, cl
sub eax, esp
push 0xffffffffffffffff
rcl al, 0x2c
push 0x100e9207
ror al, cl
sal ax, 7
mov eax, dword fs:[0]
clc
push eax
rol eax, cl
cmc
movsx eax, bp
lea esp, [esp - 0x114]
lahf
shld ax, cx, 0xc3
clc
mov eax, dword [0x1014ade0]
jmp 0x10381eef
push edi
push eax
cmovl edi, edi
lea eax, [ebp - 0xc]
bswap di
mov edi, eax
mov dword fs:[0], eax
jmp loc.100278f7
push esi
jmp 0x1032025f
xor eax, ebp
jmp 0x1040c458
mov dword [ebp - 0x10], eax
push ebx
jmp 0x1036cb6f
Function at 0x1020c699
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb ecx, 0xffffffff
clc
cmp bx, dx
test ecx, ecx
jmp 0x102a1db2
mov ecx, dword [ebp - 4]
btr di, sp
adc esi, ecx
pop edi
clc
xchg bx, si
pop esi
shr bl, 0xd4
inc bx
xor ecx, ebp
sub eax, eax
bswap bx
cmovo bx, si
pop ebx
call fcn.10072162
mov esp, ebp
jmp 0x10350c9b
cmp ebx, ecx
jmp 0x102a751a
push ebp
rol eax, cl
sal dx, 0xc7
mov ebp, esp
xor al, 0xb3
lea esp, [esp - 0xe8]
mov eax, dword [0x1014ade0]
sal edx, 0x7d
xor eax, ebp
cmp di, 0x30e3
movsx dx, ch
bts dx, cx
mov dword [ebp - 4], eax
cmp esi, 0x1be371e
mov eax, dword [ebp + 8]
neg dl
clc
mov cl, 0x6c
btr dx, bp
mov byte [ebp - 0xa], cl
mov byte [ebp - 9], cl
mov ecx, dword [eax + 0x3c]
bswap dx
sar dl, cl
add dh, ch
push ebx
dec bl
cmc
mov ebx, dword [ebp + 0xc]
sar dx, 0xfb
rol dx, 0x5a
lea ecx, [ecx + eax]
push esi
mov byte [ebp - 0xc], 0x2e
sbb si, bp
mov byte [ebp - 0xb], 0x64
sal dx, 0x29
bsf si, di
sar esi, 0xce
mov byte [ebp - 8], 0
setnp dh
push edi
sub si, 0x2a6d
bswap si
mov di, bp
mov edi, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
not esi
cwd
mov dx, 0x3ea5
mov esi, dword [edi + eax + 0x1c]
sar dl, 0x53
add dx, bp
cmp esp, esi
mov edx, dword [edi + eax + 0x24]
mov dword [ebp - 0xe4], ecx
mov ecx, dword [edi + eax + 0x20]
test esp, 0x4f275039
lea esi, [esi + eax]
cmp dh, 0x82
cmp eax, esp
lea ecx, [ecx + eax]
test ebp, edi
cmc
add edx, eax
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xe8], ecx
clc
mov dword [ebp - 0xe0], edx
test ebx, 0xffff0000
jmp 0x103e63e0
sbb ecx, ecx
jmp 0x101741cc
mov edx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xe0]
movzx ecx, word [ecx + edx*2]
cmove si, si
mov edx, dword [ebp - 0xdc]
mov esi, dword [edx + ecx*4]
jmp 0x1001457a
je 0x1027be4c
mov ecx, dword [ebp - 0xd8]
jmp 0x10005112
jb 0x101b97d7
mov edx, dword [edi + eax + 0x14]
lea edx, [edx + ecx - 1]
cmp dx, dx
cmp ebx, edx
jmp 0x1001455f
jg 0x103d2bd9
mov ecx, dword [edi + eax + 0x10]
test si, 0x2ef
jmp 0x101dc52d
jne 0x10257101
lea ecx, [ecx + 2]
clc
test ebx, edi
lea esi, [esi + 2]
stc
test edi, 0x5f9d2f2d
test dl, dl
jmp 0x103a6f47
jne 0x10257101
test dl, dl
jmp 0x1035bee9
pop ebp
ret
je 0x103a6f4d
mov dl, byte [ecx + 1]
test bp, 0x39dc
cmc
cmp dl, byte [esi + 1]
jmp 0x1032c3f0
jne 0x103d2bf0
xor ecx, ecx
jmp 0x104cd085
mov edx, dword [ebp - 0xd8]
cmovp si, dx
mov ecx, dword [ecx + edx*4]
mov esi, ebx
xor dl, 0x5a
add ecx, eax
or dl, 0xb
mov dl, byte [ecx]
clc
cmp bx, si
cmp dl, byte [esi]
jmp 0x1034ed13
je 0x102e6228
cmp dword [edi + eax + 0x18], 0
mov dword [ebp - 0xd8], 0
jmp 0x102e6222
jmp 0x101741d3
Function at 0x1020f8f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [0x10169b44], 0
je 0x10447b7e
push 0x1003af00
jmp 0x10221ff4
mov byte [esp + 0x12e], 0x77
mov byte [esp + 0x12f], 0x61
jmp 0x1035e762
mov dword [esp + 0x24], edi
call fcn.10026ed4
mov edi, eax
jmp 0x10405ab9
call eax
cmp dword [0x1014d144], 0
jmp 0x1045d52e
call esi
xor edi, eax
jmp 0x103b786d
call fcn.1042d18a
call 0x10449cca
mov edi, eax
jmp 0x104235a4
jne 0x1038f44b
mov byte [0x10169e3d], 1
jmp 0x1038f44b
push 0x640f8482
call fcn.1022401a
mov byte [esp + 0x127], bl
jmp 0x10366742
call esi
xor ebx, eax
rol esi, 0x3b
btc esi, 0x88
mov esi, dword [ebx + 4]
cmc
xor esi, dword [ebx]
cmc
jmp 0x100197ec
mov byte [esp + 0x136], 0
jmp 0x1040990f
call 0x10438656
mov eax, dword [esp + 0x2c]
bt cx, ax
mov ecx, dword [esp + 0x30]
test sp, di
cmp sp, sp
push 0
test ax, bp
cmp ebp, edx
add eax, 0x2ac18000
jmp 0x10043b08
je 0x103a6cdc
push 0x1003b320
jmp 0x103ad2b6
jne 0x104c46e2
mov byte [0x10169e3c], 1
jmp 0x104c46e2
call fcn.100dc5f0
push 0x100255e0
movzx edx, bx
movsx edx, bx
lea edx, [esp + 0x38]
push edx
jmp 0x1034b4df
call fcn.1046c6be
cmp byte [eax + 0x34], 1
jne 0x103fd1e1
mov byte [0x10169df3], 1
jmp 0x103fd1e1
call fcn.10353ae8
mov ebx, eax
jmp 0x10224f76
mov dword [esp + 0x3c], 0x4cde42
jmp 0x10039477
mov byte [esp + 0x135], 0x73
jmp 0x10242d31
mov eax, dword [0x10168d4c]
push eax
push 0x10168d48
jmp 0x103b1f6e
mov byte [esp + 0x130], 0x72
jmp 0x10366dd6
mov byte [esp + 0x128], 0x73
jmp 0x103c46f1
mov byte [esp + 0x131], bl
jmp 0x10370872
mov byte [esp + 0x132], 0x6e
jmp 0x10436060
mov byte [esp + 0x17], 0
jmp 0x102e63c7
call 0x10049330
test eax, eax
jmp 0x102652bf
mov byte [esp + 0x134], 0x73
jmp 0x1034ee8c
call 0x1036d031
lea eax, [esp + 0x2c]
setge ch
not ch
mov cx, bx
push eax
movzx ecx, sp
movsx ecx, cx
lea ecx, [esp + 0x4c]
push ecx
jmp 0x102499ee
call fcn.100dc5f0
mov byte [esp + 0x17], 1
bswap cx
mov ecx, dword [0x1016a408]
call fcn.10431499
call 0x10224d5f
mov edi, eax
jmp 0x101dd8bb
mov byte [esp + 0x12c], 0x69
mov byte [esp + 0x12d], 0x41
jmp 0x101b4525
push 0x101696f4
jmp 0x103a6ccf
call fcn.100dc5f0
push 0x1003fb30
jmp 0x103d9de6
je 0x10357946
mov ecx, dword [0x1016a404]
jmp 0x103444b7
mov byte [esp + 0x129], 0x73
mov byte [esp + 0x12a], 0x44
jmp 0x10464cd8
push 0x10169e58
jmp 0x10445ab4
push ecx
jmp 0x1045b99a
call fcn.10474e45
cmp byte [eax + 0x35], 1
jmp 0x10283989
call esi
xor edi, eax
movsx esi, sp
mov esi, dword [edi + 4]
and edx, 0x7a127119
rcr edx, 0xa0
ror dh, 0x87
xor esi, dword [edi]
lea edx, [esp + 0x48]
stc
cmc
push edx
stc
clc
cmc
rol esi, 3
jmp 0x1039b321
call fcn.100da690
test eax, eax
je 0x101d40b4
push 2
jmp 0x101d40b2
call esi
mov ecx, dword [0x1016a404]
cmc
clc
xor edi, eax
jmp 0x101c0c3b
mov byte [esp + 0x133], bl
jmp 0x10398501
mov dword [0x10169e58], 0x5814b0
call fcn.100dc5f0
push 0x100255c0
lea ecx, [esp + 0x44]
jmp 0x103eb6fa
mov ecx, dword [0x1016a400]
jmp 0x10379f99
mov dword [esp + 0x48], 0x4cde14
jmp 0x102ae7d8
jle 0x10054f21
mov ecx, dword [0x1016a408]
jmp 0x101fc3c0
mov byte [esp + 0x12b], 0x70
jmp 0x103a8aa4
call fcn.1040e457
cmp byte [eax + 0x36], 1
jmp 0x101fdd73
Function at 0x1025dda7
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1007acb0
mov eax, dword [0x1014ade0]
ror dh, 0xb1
adc edx, edi
xor eax, ebp
mov dword [ebp - 4], eax
cwd
cmc
push esi
rcr dh, 0x37
bsf edx, eax
setns dh
push edi
rdtsc
sal dh, 0xec
rol dh, cl
mov eax, 0x2e
and dh, 0xbb
movzx cx, dh
shl dx, cl
mov word [ebp - 0x28], ax
ror ah, 0xd1
mov ecx, 0x74
mov eax, ecx
add dh, 0xf8
mov word [ebp - 0x26], cx
cdq
sal dx, 0x49
clc
xor ecx, ecx
bt dx, sp
ror dx, cl
mov word [ebp - 0x22], ax
mov ax, 0x30eb
cmovns eax, ebx
rol al, 0xbc
mov word [ebp - 0x20], cx
sal ecx, 0x88
mov edx, 0x78
cmp bp, si
mov word [ebp - 0x24], dx
xadd dh, dl
lahf
mov edx, 0x53
sbb eax, edx
rcr ch, 0x7f
and ah, bl
mov word [ebp - 0x44], dx
add eax, esp
rcl ah, 0xff
mov ah, 0x97
mov eax, 0x65
sar ch, cl
adc dh, 0xc7
mov word [ebp - 0x42], ax
mov ecx, 0x74
mov edx, ecx
jmp loc.1001753c
Function at 0x102bcfc8
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [ebp - 0x874], esi
jmp loc.1001d1d7
push ebp
mov ebp, esp
bt ax, 0x9a
movsx ax, dl
push 0xffffffffffffffff
shld eax, edx, 0xef
neg ax
shr ax, 0xba
push 0x100e78b8
mov eax, dword fs:[0]
push eax
dec ax
clc
test eax, 0x31ae6ee7
lea esp, [esp - 0x8e0]
rol ah, cl
mov eax, dword [0x1014ade0]
xor eax, ebp
cmp bx, 0x1f0c
mov dword [ebp - 0x14], eax
cmc
push ebx
btc ebx, 0x1b
push esi
test bp, 0x40cb
push edi
rol bh, cl
and ebx, 0x56453d90
push eax
neg bh
lea eax, [ebp - 0xc]
xor bh, 0xb3
mov dword fs:[0], eax
add ebx, esi
ror bx, cl
mov eax, dword [ebp + 8]
sbb bh, 0x67
mov dword [ebp - 0x888], eax
dec al
shr eax, cl
lea eax, [ebp - 0x38]
clc
sar bx, 0x64
mov bx, sp
mov dword [ebp - 0x898], ecx
rol ecx, cl
sar bh, 0xae
push eax
cmp dl, 0x18
mov cl, dh
shrd bx, cx, 0xac
lea ecx, [ebp - 0x24]
and bl, 0x2e
adc bh, bl
xchg ebx, ebx
xor esi, esi
movsx bx, bh
mov ebx, 0x69
push ecx
jmp 0x10399d8b
mov dword [ebp - 0x890], edx
jmp 0x10233b98
Function at 0x103771f1
Capabilities:
Hash data with crc32

Disassembly:
je 0x1025086a
jmp 0x102cc035
push eax
lea ecx, [esp + 0x432]
jmp 0x103a4d5e
push eax
mov word [esp + 0x22c], dx
jmp 0x103f1df4
push ebp
rcl cl, cl
cmc
mov ebp, esp
mov ch, bh
rcr ah, 0xac
and esp, 0xfffffff8
movsx ecx, ax
and ax, 0x4cb8
sub esp, 0x62c
movzx ecx, bx
bsr ax, dx
btr ecx, esp
mov eax, dword [0x1014ade0]
or ch, dl
xor eax, esp
sal cl, 0xa1
mov dword [esp + 0x628], eax
push ebx
push esi
xor ch, 0x72
bts cx, cx
bsf ecx, ebp
push edi
xor eax, eax
mov ch, 0xd2
push 0x206
jmp 0x1020beec
push ecx
mov word [esp + 0x434], ax
call fcn.10078c00
lea esp, [esp + 0xc]
sub edx, edx
lahf
push 0x206
push edx
mov ax, 0x75ae
lea eax, [esp + 0x22a]
jmp 0x1034eeec
call fcn.10078c00
add esp, 0xc
push 0
call fcn.100daab0
mov ebx, eax
mov dword [esp + 0x10], ebx
test al, 0x1f
test ebx, ebx
jmp 0x10208253

Function at 0x10379bc3
Capabilities:
Check for software breakpoints

Disassembly:
pop edi
xchg bx, bx
not esi
bswap bx
pop esi
not bx
pop ebx
jmp 0x1039645f
je 0x101d7466
mov ecx, dword [0xa35b14]
jmp loc.100194a9
test eax, eax
jmp 0x1022785d
je 0x101d7466
cmp byte [0x10169e3f], 0
jmp 0x103df299
push ebp
mov ebp, esp
bsr ax, bx
and esp, 0xfffffff8
inc ah
mov eax, dword [0x10169b84]
lea esp, [esp - 0x2c]
push ebx
jmp 0x1046c041
mov esp, ebp
pop ebp
jmp 0x104c5402
je 0x101d7466
mov eax, dword [eax + 0x20]
push eax
jmp 0x104362a3
push edi
test eax, eax
jmp 0x103cf834
je 0x101d7466
call fcn.103c5999
test al, al
je 0x101d7466
cmp dword [ebp + 8], 0
jmp 0x103e7da9
je 0x101d7466
mov eax, dword [ebp + 0xc]
jmp 0x1032b072
call 0x103bd83f
test eax, eax
jmp 0x10352e20
push esi
stc
jmp 0x103cf954
ret 8
Function at 0x1037db28
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp - 0x520]
jmp 0x1030f282
call fcn.1038d72f
add esp, 0x1c
push ebx
mov esi, 0x10114a6c
lea eax, [ebp - 0x520]
call fcn.100281e0
add esp, 4
jmp 0x10182f38
je 0x103e069c
push ebx
cmovge dx, dx
cdq
cwd
push 1
mov dx, di
setl dh
push ecx
cdq
bswap edx
jmp 0x1000159a
call fcn.104a3a78
mov edi, eax
add esp, 4
jmp 0x103d5175
call fcn.10028230
test al, al
jmp 0x1040eb54
call fcn.1004b710
mov esi, dword [ebp - 0x117c]
cmc
test al, al
jmp 0x10434f66
mov eax, dword [eax]
jmp 0x1043feba
call fcn.1004a480
mov esi, eax
lea edi, [ebp - 0x11a4]
jmp 0x1033a20a
push 0x4d
jmp 0x1040f30c
push 0xb8623f56
call fcn.1045ab22
push 0x4d
push ecx
jmp 0x101f4793
mov dword [ebp - 0x11a4], ecx
jmp 0x103cce03
mov dword [ebp - 0x1180], eax
call fcn.1004a460
lea ecx, [ebp - 0x1178]
not dl
cdq
movzx edx, bx
push ecx
movsx ecx, bx
mov ecx, dword [ebp - 0x1180]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
jmp 0x104c4b2e
mov dword [ebp - 0x11a0], edx
jmp 0x1036e4b9
cmp edi, ebx
jmp 0x1020eda2
call fcn.10052000
mov ecx, dword [eax]
bts si, bp
shrd esi, esp, 0xd2
and si, bp
mov edx, dword [eax + 4]
bsr esi, edi
add esp, 0x14
bswap si
lea esi, [ebp - 0x138c]
jmp 0x103969ac
call fcn.10003790
test eax, eax
jmp 0x10455687
mov edi, 0x1016b93c
call fcn.1004a4c0
lea ecx, [ebp - 0xa58]
not di
push ecx
bswap edi
mov edi, 0x1d100586
mov edi, esi
jmp 0x10258d0a
je 0x10433cf7
mov edx, dword [ebp - 0x1178]
cbw
lahf
push edx
cbw
mov cx, bx
lea eax, [ebp - 0x520]
cdq
xchg cx, cx
push eax
lea ecx, [ebp - 0x950]
cwd
cbw
movzx dx, dh
push ecx
not al
lea edx, [ebp - 0x788]
movsx eax, di
nop
setne al
push edx
movsx eax, si
push 3
movsx eax, sp
lea eax, [ebp - 0x18]
jmp 0x1036fc23
push eax
jmp 0x10433cef
call fcn.1045cdaf
add esp, 0x1c
lea esi, [ebp - 0x13f4]
cmovs di, sp
mov edi, 0x1016b93c
jmp 0x1047336b
je 0x103e069c
mov edx, esi
jmp 0x103eecf3
push ecx
push edx
push eax
cbw
lahf
lea eax, [ebp - 0x13cc]
jmp 0x103d720c
jne 0x103e069c
call 0x104cc05e
cmp dword [ebp - 0x1178], eax
je 0x103e069c
lea eax, [ebp - 0x1178]
movsx edi, di
xchg di, di
push eax
jmp 0x103fda4f
call fcn.1004a480
lea esi, [ebp - 0x137c]
jmp 0x103c9f49
push edx
mov edx, dword [eax + 4]
jmp 0x10362540
Function at 0x10395fc8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push ebx
jmp 0x104dec02
call fcn.1020c52f
add esp, 0x1c
jmp 0x104e250d
push 0x4d
jmp 0x103fe488
call fcn.10073dfd
add esp, 8
test eax, eax
jmp 0x1004a13e
push ebx
jmp 0x1035b845
push ebx
push 0x10028190
jmp 0x10172a32
push 0x640f8482
call fcn.1022401a
call fcn.10073160
add esp, 8
stc
test eax, eax
je 0x103e424d
mov eax, dword [ebp - 0x1178]
seta dh
xchg dx, dx
push eax
lea ecx, [ebp - 0x520]
cdq
bswap ax
xchg dh, dh
push ecx
cbw
lea edx, [ebp - 0x950]
setg ah
mov cl, 0xb8
bswap ax
push edx
lahf
movzx ecx, sp
lea eax, [ebp - 0x788]
movzx ecx, dx
push eax
cmovbe ecx, eax
xchg cx, cx
push 6
mov ecx, edx
movsx ecx, bx
not ecx
lea ecx, [ebp - 0x18]
jmp 0x10253e5a
call esi
lea edx, [ebp - 0x3d0]
xchg ah, al
movsx eax, si
movzx ax, ch
push edx
movzx eax, dx
movsx eax, bx
mov ax, cx
lea eax, [ebp - 0x950]
push eax
jmp 0x1025710c
push ecx
jmp 0x101d7539
call dword [0x100ec410]
push eax
jmp 0x103e424b
push ebx
jmp 0x1029fcd7
Function at 0x103a90e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e7936
mov eax, dword fs:[0]
cmc
stc
test ebx, esp
push eax
cmp sp, 0xe08
sub esp, 0xe4
mov eax, dword [0x1014ade0]
xor eax, ebp
stc
cmp bx, bp
mov dword [ebp - 0x10], eax
cmc
push ebx
adc bx, dx
ror bl, 0x8f
push esi
movzx ebx, dx
rol ebx, 0x71
push edi
sal bh, cl
shr bl, 0xb2
push eax
test sp, 0x352a
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
rol edi, 0x8e
test bp, 0x5c3c
cmc
mov edi, dword [ebp + 8]
jmp loc.1000137e

Function at 0x103bf96a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
call fcn.1017bfd7
push 0x100
cwde
movsx ax, dh
lea eax, [ebp - 0x950]
push eax
jmp 0x103755cb
call edi
push 0xffffffffffffffec
jmp 0x103cbd81
push esi
jmp 0x102664db
push esi
jmp 0x103c8178
push 0x54734d8b
call fcn.102582df
call fcn.1004b460
mov esi, dword [ebp - 0x1194]
cmova edx, esi
push 0x100
seta dl
mov dh, cl
xchg dx, dx
lea edx, [ebp - 0x788]
jmp 0x104a53ba
call edi
push 0xfffffffffffffff0
push esi
jmp loc.10040329
call fcn.1031e52a
mov edi, dword [0x100ec590]
push 0xfffffffffffffff4
jmp 0x1036d374
push esi
mov dword [ebp - 0x1180], eax
jmp 0x103c5929
push edx
jmp 0x1020cb6b
Function at 0x103c841f
Capabilities:
Authenticate hmac

Disassembly:
push ebx
jmp 0x10337b7e
push esi
jmp loc.100028bf
push ebp
ror ecx, cl
test sp, 0x751
adc bp, cx
mov ebp, esp
movsx cx, ah
and esp, 0xfffffff8
test ax, 0x3e85
sub esp, 0x34
not cl
mov ecx, dword [0x1016a408]
jmp 0x10316d35

Function at 0x103ccff7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
movzx cx, cl
rcl ch, cl
rol cl, cl
and esp, 0xfffffff8
sub esp, 0x44
mov ecx, edi
movzx ecx, bp
setl ch
mov ecx, dword [0x1016a408]
jmp 0x1045220f
push ebx
jmp loc.100532ef

Function at 0x103d54eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.10075026
add esp, 0xc
bswap edx
lea ecx, [ebp - 0x230]
push ecx
movsx dx, dl
not dl
lea edx, [ebp - 0xa58]
jmp 0x10314c86
jne 0x103c47c2
lea eax, [ebp - 0x218]
push eax
setnp cl
lea ecx, [ebp - 0xa58]
jmp loc.1004955b
push edx
call fcn.10073160
lea esp, [esp + 8]
test eax, eax
jmp 0x102dbf6c
push eax
call fcn.104195e2
add esp, 0x1c
jmp fcn.10413d27
mov edx, dword [ebp - 0x1178]
not al
movzx ecx, ax
push edx
lea eax, [ebp - 0x520]
cdq
mov dx, 0x7f55
push eax
bswap eax
setne al
mov dl, al
lea ecx, [ebp - 0x950]
push ecx
mov dx, 0x1fa
mov dx, di
lea edx, [ebp - 0x788]
bswap ax
movsx ax, bl
cbw
push edx
push 0x33
movzx eax, dx
mov ax, si
lea eax, [ebp - 0x18]
jmp 0x104032eb
push 0x640f8482
call fcn.1022401a
push eax
jmp 0x101c8bfb
push 0x4d
jmp 0x1036ae3a