joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014e231
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea edx, [ebp - 0x350]
jmp 0x10161eb1
jmp 0x1013fd74
mov dword [ebp - 0x2d4], eax
movsx edx, cx
bswap edx
cwd
mov ecx, dword [ebp - 0x5c]
movzx edx, bx
mov edx, ecx
movsx dx, bh
mov dword [ebp - 0x2dc], ecx
cdq
jmp 0x100a10d0
mov dword [ebp - 0x214], 0
jmp 0x100bfcac
mov ecx, dword [ebp - 0x214]
clc
cmp ecx, dword [ebp - 0x2d4]
jmp loc.10080349
push ebp
bswap ax
add ax, 0x2527
lea ebp, [esp - 0x70]
cmp edi, 0x13ad02aa
add ch, 0x3c
sal dh, 0x85
lea esp, [esp - 0x6cc]
btc eax, 0x8f
mov eax, 4
shl eax, 0
cdq
shl ch, cl
mov ecx, dword [eax + 0x10081004]
jmp 0x1015ffec
not ecx
xor ecx, 0x9b113eb8
cmp bp, cx
shr dh, 0x9c
mov edx, 4
imul eax, edx, 3
ror dl, cl
adc dx, ax
mov edx, dword [eax + 0x10081004]
not edx
shld ax, bx, 0xba
not eax
xor ecx, edx
mov dword [ebp - 0x60], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [eax + 0x10081004]
movzx edx, ax
not ecx
bsr edx, edx
and dl, ch
xchg dl, dl
xor ecx, 0x9b113e98
lahf
movzx eax, sp
add dx, 0xe0e
mov edx, 4
imul eax, edx, 3
test dl, 0xa1
mov edx, dword [eax + 0x10081004]
not edx
shl ax, cl
sbb al, 0x34
xor ecx, edx
movsx edx, ax
mov dword [ebp - 0x5c], ecx
cmovp ax, bx
movzx ax, ah
cdq
mov eax, dword [ebp - 0x60]
cdq
jmp 0x100ee1ad
mov dword [ebp - 0x2d8], edx
jmp 0x101044b6

Function at 0x1014e34d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1018ca0c
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x1014ec07
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword es:[ecx], ebp
mov dword [esp + 4], 0x7a033b0c
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x1014ed35
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x561a948c
shl dword [esp], 0x24
not edx
sar word [esp], 0xb
jae 0x1010780a
not ebp
setnp byte [esp]
rol dword [esp], 0x9b
and edx, ebp
jmp 0x100303bf
adc esi, 3
jmp 0x100c6e10

Function at 0x101502ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x101509fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x101544d7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add dword [esp], 0xeff9d593
call fcn.101bd1e6

Function at 0x1015502b
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec word [esp + 5]
not al
neg al
dec al
xor bl, al
shr byte [esp + 6], 0x63
lea eax, [esp + eax + 8]
mov dword [eax], ebp
lea esp, [esp + 8]
jae fcn.1014ffcc
call int.1010ff2a
not ecx

Function at 0x10155097
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, 0x11232e3b
mov dword [esp + 8], 0x89759865
mov ebp, dword [esp + ebp - 0x11232e3b]
lea esp, [esp + 8]
call fcn.100a4b25

Function at 0x10157c56
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.10009b06
lea ecx, [ebp - 0x1dec]
jmp loc.1003e0ac
call fcn.100fb1c5
call fcn.10009b06
lea ecx, [ebp - 0x1de4]
call fcn.10009b06
lea ecx, [ebp - 0x1de8]
jmp 0x100b1f63
Function at 0x1015852f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
neg al
shl dword [esp], 5
rol al, 1
dec word [esp + 2]
dec al
neg dword [esp]
jns 0x100eb9b1
sub byte [esp + 3], dl
sbb edx, 0xaa883590
lea edi, [edx + edi - 0x3fadd029]
dec edx
movzx edx, byte [edi + edx*2 - 0x7f5ba04e]
jb 0x100ee971
call fcn.101bd945
add byte [esp + 2], 0x16
mov dword [esp], ebp
call fcn.1013761f
rol al, 1
not al
rol dword [esp], 0x75
shr word [esp + 2], 0x23
ja 0x100cd415
xor bl, al
jmp 0x101659ff
add esi, 4
push 0x7d3e3fac
jmp 0x100df75f
xor al, bl
mov dword [esp], 0x768455b5
jmp 0x100aba37
dec word [esp + 2]
call fcn.10160151

Function at 0x101593af
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, 4
mov dword [esp], 0xe31eb114
push 0x8835d894
shrd ax, bp, cl
not dword [esp + 4]
jmp loc.10037fc9

Function at 0x101596d8
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, 0x9327008a
pushfd
neg bp
mov ebp, dword [esp + ebp + 0x6cd8008e]
mov dword [esp + 4], 0x89759865
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.100a4b25

Function at 0x1015a661
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25

Function at 0x1015ad5b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x89759865
lea esp, [esp + 4]
call fcn.100a4b25

Function at 0x1015b332
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [esp], 0xc830643b
mov dword [esi], edx
push 0x3abf4201
lea esp, [esp + 8]
jmp fcn.1014ffcc
Function at 0x10160103
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], edx
lea esp, [esp + 4]
jmp fcn.1014ffcc

Function at 0x10162081
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 4]
mov dword [esp + 4], 0xc3499c65
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.100a4b25
push ebp
mov ebp, 0xcfa8eb3e
lea ebp, [ebp + ebp - 0x7be60f5b]
pushfd
cmp bp, 0x221a
jno 0x1014e26a

Function at 0x10164991
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ecx
pushfd
mov ecx, 0x1cb94480
call fcn.1006cc06

Function at 0x1016656b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x10166574
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0x600bb7bf
push 0x89098002
add esi, 4
mov dword [esp + 8], 0xa910ba91
jmp fcn.10010721

Function at 0x101667c4
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc esi, 5
push 0x16b6bc
push 0xe11219a4
neg dword [esp + 2]
shld eax, edx, cl
mov dword [esi], eax
call fcn.1000d8c2
jmp 0x100a61b1
mov dword [esp], 0x3a98b4a6
jbe 0x1002ecc3

Function at 0x1016692b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x5910c808
mov word [esi], cx
push 0xf8b23322
lea esp, [esp + 0x1c]
jmp fcn.1014ffcc

Function at 0x1016a8e4
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.100a4b25
ja 0x10015120
call fcn.100c0e65

Function at 0x1016b1c9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ecx
mov ebp, dword [esp + ebp - 0x981e778]
mov dword [esp + 0xc], 0xc3499c65
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.100a4b25
call fcn.101ce530

Function at 0x1016faab
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Inspect section memory permissions

Disassembly:
lea esp, [esp + 0xc]
call fcn.100a4b25
mov al, cl

Function at 0x101714dd
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push edi
mov edi, 0xdf973614
and ebp, 0xb026ed89
add dword [esp + 4], 0xeffbe90b
mov ebp, dword [esp + edi + 0x2068c9f8]
mov dword [esp + 0xc], 0x81acf665
mov edi, dword [esp + edi + 0x2068c9ec]
call fcn.10107148

Function at 0x1017229a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x3f899a3c
lea esp, [esp + 0x20]
jmp fcn.1014ffcc

Function at 0x10172e1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc
mov word [ecx], dx
push 0x82334f3f
jmp 0x10145d22

Function at 0x101737e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.1014ffcc
mov dword [esi + 4], eax
push 0xcda4029d
jmp 0x10168fd1

Function at 0x1017458a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.101bba03
jl 0x100ce415
Function at 0x101784cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cl
push 0x9dad8c96
mov dword [esp + 8], 0x749c5c23
neg byte [esp]
ror cl, 1
xor bl, cl
push 0x90894900
mov dword [esp + 8], 0xdeaf3516
lea ecx, [esp + ecx + 0x14]
push 0x17b4618e

Function at 0x10179cb1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x1017a1dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0xf1aa
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x1017d38d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], ebp
jmp 0x1018d03a
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x1017d5af
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], bp
push 0x35090b0c
jmp 0x101aa234
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x10180f22
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100ca768
push 0x878ad9a4
mov word [esi], ax
jmp fcn.10001104
mov dword [esp], 0x4b29a885
add al, dl
jmp 0x100b06ab

Function at 0x1018142f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
add dword [esp + 5], 0x4a1434ae
ror dl, 1
call fcn.101de001

Function at 0x101816c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc
mov dword [esi], edx
jmp 0x100a994b

Function at 0x1018197b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x89759865
call fcn.100a4b25
cmp cx, 0xe71e
cmc

Function at 0x10181cf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x101830fb
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec word [esp + 9]
xor al, 0x8b
jmp 0x100c1ed8
ror al, 1
push 0xe90decbf
push 0xba85a7ba
mov dword [esp + 8], 0xe13df20a
add al, 0x8e
rol dword [esp + 0xf], 0xb2
jae 0x10028f08

Function at 0x10183329
Capabilities:
Execute anti-debugging instructions

Disassembly:
and ax, dx
jmp 0x101b2ece
push 0x91185831
not ax
mov word [esi], ax
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x1018350d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x10183b73
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x42893ead
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x10183f44
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc esi, 1
mov word [esi], ax
mov byte [esp + 6], 0x85
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x101852e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc
mov dword es:[ecx], ebp
jmp 0x10166130

Function at 0x10187a8c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edx, 0xce2cb71b
pushfd
shl edx, 0x59
mov dword [esp + 0x14], 0x33419a65
mov edx, dword [esp + 8]
call fcn.100de065
Function at 0x10188b12
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
sal word [esp + 7], 2
neg al
dec dword [esp + 8]
ror al, 1
jmp fcn.1003eaee

Function at 0x10188b36
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
mov ecx, 0x34b67caf
not cx
call fcn.100de738
je 0x10111cc9
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25

Function at 0x1018a21c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x6b273e14
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x1018aa25
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], dx
lea esp, [esp + 4]
jmp fcn.1014ffcc

Function at 0x1018bd69
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
js 0x1019733b
shl dword [esp + 8], 0x61
sub dword [esp + 8], 0x9caa7fb0
mov dword [esp + 8], 0x89759865
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.100a4b25
or al, 0x34
std
mov bh, 0xb6
pop ecx
adc byte [edi + 0x6a], ch
push es
sbb al, 0xa6
rol byte [ebx + 0x6b725c1e], 1
test eax, 0x44e17c6f
xchg dword ds:[0x8cebf2ac], ebx
xor eax, 0x27065f7a
rcl dword [ecx], 0x72
rol cl, 1
sbb byte [esi], ah
and byte [ecx + 0x7d], dh
adc byte [esi], 0x9f
push ebx
mov bh, 0x3f
int3
push 0x6690f986
mov word [esp], 0x3003
pushfd
test dword [esp + 4], 0xd01c033e
call fcn.1018bd69

Function at 0x1018c8b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp + 0x74], 0
jmp loc.10076872
lea esp, [esp + 8]
call fcn.100a4b25
mov ecx, dword [ebp + 0x54]
xor ecx, dword [ebp + 0x54]
sal dx, cl
sub dx, bp
mov al, 0x90
mov dword [ebp + 0x54], ecx
mov edx, dword [ebp + 0x50]
bsr ecx, ebp
xchg cx, ax
xor edx, dword [ebp + 0x50]
mov dword [ebp + 0x50], edx
bt edx, 0x28
cdq
mov eax, 4
bts cx, bx
imul ecx, eax, 3
mov dx, bx
shl al, 0xd
mov edx, 0xe47f6890
xor edx, dword [ecx + 0x10081004]
shr al, 0
mov dword [ebp + 0x28], edx
ror cl, cl
rcr dl, cl
mov al, byte [ebp + 0x28]
mov byte [ebp + 0x4c], al
mov ecx, 4
btr eax, 0x89
ror ax, 0x37
imul edx, ecx, 3
rcl al, cl
mov eax, ebx
rol ax, 0x1c
mov eax, 0xe47f68ee
xor eax, dword [edx + 0x10081004]
mov dword [ebp + 0x2c], eax
ror cl, cl
xor al, bl
mov cl, byte [ebp + 0x2c]
cmc
mov byte [ebp + 0x4d], cl
mov edx, 4
test sp, di
imul eax, edx, 3
rcl dl, cl
mov ecx, 0xe47f6889
sar dl, cl
xor ecx, dword [eax + 0x10081004]
sbb dl, 0x3f
mov dword [ebp + 0x30], ecx
add cx, sp
mov dl, byte [ebp + 0x30]
shld ecx, ebx, 0xb1
mov byte [ebp + 0x4e], dl
sal dh, cl
adc cx, di
add edx, edi
xor eax, eax
mov byte [ebp + 0x4f], al
cmovnp dx, si
movsx ecx, si
mov ecx, dword [ebp + 0x4c]
bswap edx
movzx edx, cx
mov dword [ebp - 0x3c], ecx
cdq
bswap edx
lea edx, [ebp - 0x3c]
mov dword [ebp + 0x64], edx
jmp 0x100e05ae

Function at 0x1018c9b1
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
lea esp, [esp + 8]
ja fcn.1014ffcc
mov eax, 0xb9b7321a
mov eax, esp
mov ecx, 0x5c
mov ebp, 0x1eabb39f
lea ebp, [esi + ebp*4 - 0x7aaecefc]
jmp 0x101c5703
and ebp, 0xfffffffc
sub ebp, ecx
call fcn.10032ef5
Function at 0x1018ee1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xc42e5434
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
jmp 0x100edc2a

Function at 0x101914a7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sbb esi, 3
mov dword [esi], ecx
jmp 0x101b609e
jbe 0x10175a0a
lea esp, [esp + 0x10]
jmp fcn.1016169c

Function at 0x101938e1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x1c]
call fcn.100a4b25

Function at 0x10196bfb
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, 0x26079e13
pushfd
shr ebp, 0x62
call fcn.1016b1c9
lea ecx, [ebp - 0x27b8]
jmp loc.10028204

Function at 0x1019733b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
js 0x1019733b
shl dword [esp + 8], 0x61
sub dword [esp + 8], 0x9caa7fb0
mov dword [esp + 8], 0x89759865
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.100a4b25
or al, 0x34
std
mov bh, 0xb6
pop ecx
adc byte [edi + 0x6a], ch
push es
sbb al, 0xa6
rol byte [ebx + 0x6b725c1e], 1
test eax, 0x44e17c6f
xchg dword ds:[0x8cebf2ac], ebx
xor eax, 0x27065f7a
rcl dword [ecx], 0x72
rol cl, 1
sbb byte [esi], ah
and byte [ecx + 0x7d], dh
adc byte [esi], 0x9f
push ebx
mov bh, 0x3f
int3
push 0x6690f986
mov word [esp], 0x3003
pushfd
test dword [esp + 4], 0xd01c033e
call fcn.1018bd69
Function at 0x10198b4d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebx
pushfd
mov ebx, 0x172cb033
call int.101ab399
jmp 0x101d36ca
mov eax, 4
shl eax, 0
add edx, 0x54301a8f
stc
mov ecx, dword [eax + 0x10081004]
not ecx
xchg dl, ah
or ah, 0xbb
xor ecx, 0x9b113e88
rol al, cl
mov edx, 4
shr eax, 0x2e
inc ax
cmc
imul eax, edx, 3
rcr dh, 0x92
bts edx, esp
mov edx, dword [eax + 0x10081004]
not edx
neg ah
sbb al, 0xaa
movsx eax, cx
xor ecx, edx
mov dword [ebp - 0xf0], ecx
sbb ax, 0x3625
bswap eax
mov eax, dword [ebp + 0x4c]
jmp loc.1003e8f2
mov dword [ebp + 0x4c], 0
jmp 0x1019eade

Function at 0x1019eb60
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xd0238009
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x1019ef91
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi + 4], eax
not dword [esp + 4]
lea esp, [esp + 8]
jmp fcn.1014ffcc
jmp 0x10109740

Function at 0x101a3598
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebx
pushfd
mov ebx, 0x961b7e10
xor bx, bx
sub ebx, 0xd91b724
or ebx, 0xa8260abc
mov dword [esp + 8], 0x89759865
mov ebx, dword [esp + ebx + 0x5750b508]
je fcn.101a3598
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.100a4b25

Function at 0x101a4258
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
jmp 0x100b08ae

Function at 0x101a42bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc
jmp 0x100a56f6
mov dword [esi], edx
jmp 0x10104b09
jmp 0x1018e177
jmp 0x101a02d7
Function at 0x101a5f18
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi + 4], eax
push 0x83006a0c
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x101a80f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], cx
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x101a8b24
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.1014ffcc

Function at 0x101aa1cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x101aa2c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, 6
mov word [ecx], ax
jmp loc.1004f460

Function at 0x101ac0b3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, 0x83b29a86
mov dword [esp + 0xc], 0x8b858065
mov esi, dword [esp + esi + 0x7c4d657a]
call fcn.100226f6

Function at 0x101ac84f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.1014ffcc

Function at 0x101ac8b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf27221a
mov byte ss:[edx], cl
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x101ad832
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], eax
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x101aec3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], eax
push 0xb6248c34
lea esp, [esp + 0x20]
jmp fcn.1014ffcc

Function at 0x101af247
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.1014ffcc

Function at 0x101b1d83
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x101b6170
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], ax
push 0x1282c726
lea esp, [esp + 0x18]
jmp fcn.1014ffcc

Function at 0x101b998d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4b956408
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x101bab09
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xa89d2505
mov dword [esi + 4], eax
push 0xb9b6393d
mov word [esp + 3], 0x14ac
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x101bba03
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x20]
call fcn.100a4b25

Function at 0x101bce99
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x101036f3
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
jmp 0x1010015c
Function at 0x101bd142
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add dword [esp + 8], 0xeff40c45
call fcn.10141b30
mov dword [ebp - 0xac8], edx
jmp 0x100695f0
js 0x101bd148
mov esi, dword [esp + esi*4 - 0xb18]
jbe 0x100f1488
sub edx, edx
test esi, 0xc70080a3
div dword [ebp - 0xac4]
mov eax, dword [ebp - 0x50]
cmp bx, di
movsx ecx, byte [ecx + eax]
shr ah, 0x26
movzx eax, ax
rcr eax, 0x19
xor ecx, edx
stc
sal ax, cl
dec ax
mov edx, dword [ebp - 0xd8]
bsr ax, cx
sal eax, cl
mov eax, dword [ebp - 0x50]
test ax, di
test ebp, 0x90afb387
mov byte [edx + eax], cl
add ecx, edi
mov ecx, dword [ebp - 0xac4]
dec edx
movzx dx, cl
xor ecx, dword [ebp - 0xac4]
add edx, 0x98926f3f
mov dword [ebp - 0xac4], ecx
bt edx, 0x3b
xor dx, si
bsf edx, edi
mov edx, dword [ebp - 0xac8]
test ebx, ebx
xor edx, dword [ebp - 0xac8]
jmp 0x101310ce

Function at 0x101bd2f3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, 4
bts dx, sp
rol ecx, 0xba
shl eax, 0
sal dl, cl
sbb cl, al
mov ecx, dword [eax + 0x10081004]
bt dx, 1
not ecx
xor ecx, 0x9b113e9c
shr dl, 0x92
mov edx, 4
sar al, 0xbc
imul eax, edx, 3
mov edx, dword [eax + 0x10081004]
adc ax, 0xe022
sar ah, 0x1d
shr ah, 0xa8
not edx
shl ax, 0x27
xor ecx, edx
adc dx, 0x79aa
movsx dx, bl
mov dword [ebp + 4], ecx
mov cl, 0x8d
shr dh, 0x3f
mov eax, 4
sub dx, ax
shl eax, 0
mov ecx, dword [eax + 0x10081004]
not ecx
cmovb ax, di
and ah, 0x39
xor ecx, 0x9b113e87
cwde
shrd dx, bx, 0x10
mov ax, sp
mov edx, 4
bts ax, sp
lahf
rol eax, 0xb5
imul eax, edx, 3
rcr dl, 0xa9
mov edx, dword [eax + 0x10081004]
cmc
not edx
cmp esi, ebp
xor ecx, edx
mov dword [ebp + 8], ecx
rdtsc
jmp 0x1014fee3
lea eax, [ebp + 0x5c]
push eax
cdq
bswap ecx
mov ecx, dword [ebp + 4]
bswap ax
lahf
cbw
push ecx
movzx ax, bh
mov ah, 0x25
lea edx, [ebp + 0x68]
setnp al
push edx
nop
mov eax, dword [ebp + 8]
jmp 0x101ba671
push eax
jmp loc.10069a5d
push ecx
mov ecx, 0x41a86533
mov dword [esp + 4], 0x89759865
mov ecx, dword [esp + ecx - 0x41a86533]
call fcn.101c4b7d
jl 0x1009bb9d
cmp dword [ebp + 0x68], 0xffffffff
jmp loc.10003b3e