joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000da3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
lea eax, [ebp - 0x130]
mov dword [esi + 4], edi
mov dword [esi], edi
sub eax, ecx
mov ebx, 0x12c
mov dl, byte [ecx]
test dl, dl
je 0x1000da70
mov byte [eax + ecx], dl
inc edi
inc ecx
cmp edi, ebx
jb 0x1000da61
and byte [ebp + edi - 0x130], 0
lea eax, [ebp - 0x130]
push eax
call fcn.1000d878
mov edi, eax
pop ecx
test edi, edi
je 0x1000db21
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x1000dad5
mov byte [ebp + edi - 0x130], 0x2a
inc edi
cmp edi, ebx
mov eax, edi
jae 0x1000dabd
mov ecx, eax
sub ecx, edi
mov cl, byte [ecx + edx]
test cl, cl
je 0x1000dabd
mov byte [ebp + eax - 0x130], cl
inc eax
cmp eax, ebx
jb 0x1000daa6
and byte [ebp + eax - 0x130], 0
lea eax, [ebp + edi - 0x130]
push eax
call fcn.1000d878
pop ecx
add edi, eax
mov eax, edi
push 8
cdq
pop ebx
mov ecx, ebx
idiv ecx
test edx, edx
je 0x1000daf1
and byte [ebp + edi - 0x130], 0
inc edi
mov eax, edi
cdq
jmp 0x1000dadb
mov eax, edi
mov ecx, ebx
cdq
idiv ecx
test eax, eax
jle 0x1000db21
lea edi, [ebp - 0x130]
mov dword [ebp + 0x10], eax
mov eax, dword [edi]
push dword [ebp + 0x14]
xor dword [esi], eax
mov eax, dword [edi + 4]
xor dword [esi + 4], eax
push esi
call fcn.1000db28
pop ecx
add edi, ebx
dec dword [ebp + 0x10]
pop ecx
jne 0x1000db05
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000dba4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax + 4]
and dword [ebp + 8], 0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [ebp - 8], edi
mov edi, dword [eax]
mov dword [ebp - 4], edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], 0x20
sub dword [ebp + 8], 0x61c88647
mov eax, edx
mov edi, edx
shl eax, 4
add eax, dword [ebp - 4]
shr edi, 5
add edi, dword [ebp - 8]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, edx
xor eax, edi
add ecx, eax
mov eax, ecx
mov edi, ecx
shl eax, 4
add eax, dword [ebp - 0xc]
shr edi, 5
add edi, dword [ebp - 0x10]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, ecx
xor eax, edi
add edx, eax
dec dword [ebp + 0xc]
jne 0x1000dbd9
mov dword [esi], ecx
mov dword [esi + 4], edx
pop edi
pop esi
leave
ret

Function at 0x1001f4d4
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
push edi
push 0x10
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
lea edi, [ecx + 0x18]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Identify system language via api

Disassembly:
push 0x40
push 0x1000
push 0xb2c00
push 0
call sub.kernel32.dll_GetUserDefaultLangID
call sub.kernel32.dll_VirtualAlloc
call fcn.0049fb05
ret

Function at 0x49fb05
Capabilities:
Encode data using xor

Disassembly:
jmp 0x49fb25
mov al, byte [esi]
nop
xor al, dl
mov byte [edi], al
inc edx
inc esi
inc edi
nop
dec ecx
cmp ecx, 0
nop
jne 0x49fb0a
jmp 0x49fb35
sub esp, 0x2f4
mov esi, 0x5b7aa8
jmp 0x49fb56
call ebx
nop
add esp, 0x2f4
ret
mov ebx, edi
mov ecx, 0x2f4
mov edx, 0x86
jmp 0x49fb0a
mov edi, 0x4aa370
mov dword [edi], eax
nop
mov edi, eax
nop
jmp 0x49fb45
Function at 0x10008350
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1007ef80]
test eax, eax
je 0x1000836e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100a13e0], eax
mov dword [0x1007ef80], 0
mov eax, dword [0x100a13e0]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x100083e2
push 8
call fcn.10008c30
mov esi, eax
add esp, 4
test esi, esi
jne 0x10008393
pop esi
ret
push 0x5000
call fcn.10008c30
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x100083b4
push esi
call fcn.10008c60
add esp, 4
xor eax, eax
pop esi
ret
mov dword [esi], 0x5000
mov ecx, dword [0x100a13e0]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100083e2
mov edx, dword [esi + 4]
push edx
call fcn.10008c60
push esi
call fcn.10008c60
add esp, 8
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x100108c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
je 0x100229ee
jne 0x100108cf
std
cmpsd dword [esi], dword es:[edi]
mov word [ebx - 0x14f595fa], cs
mov eax, dword [esi]
push 0xa
jmp 0x100108d4
push eax
call fcn.1002c149
add esp, 8
shr bl, 0x40
pop edi
pop esi
pop ebp
mov cl, cl
js 0x100229e9
jns 0x100108f3
arpl word [edi + 0x20f0890f], bp
add dword [eax], eax
jns 0x100229e9
hlt
retf
xor al, 0xc5
add byte [edi + 0x5e], bl
test edi, edi
jb 0x1001927a
jne 0x1001ef03
je 0x1001eee4
cmpsb byte [esi], byte es:[edi]
mov ecx, dword [esi]
add byte [eax], al
add byte [edi + 0x5e], bl
push 8
push 0x10078018
jmp 0x1001ef0b
adc bl, ch
push edi
call fcn.1003b969
add esp, 0xc
test al, al
jb 0x10019284
je 0x1001ef46
jne 0x1001ef2c
mov al, 0xc3
jecxz 0x1001eeb8
xchg esi, ebx
xchg ebx, esi
mov edx, dword [esi]
push 0xfa
shr ecx, 0x40
push edx
call fcn.100378f7
add esp, 8
push 8
push 0x10078010
push edi
call fcn.1003b969
add esp, 0xc
test al, al
jb 0x1001928c
je 0x1002f919
jne 0x1001ef6f
jns 0x1001ef09
out dx, eax
jmp 0x1001eef6
mov eax, dword [esi]
push 0x32
js 0x1002f907
jns 0x1001ef7d
xchg dword [ecx + 0xf], ebx
mov dword [ecx + ecx + 0x18340001], eax
jns 0x1002f907
xor al, 0x18
pop dword [esp - 4]
lea esi, [esi]
ret
add ecx, 0
jae 0x100229f9
jg 0x10022a0a
jge 0x10022997
popfd
popfd
jae 0x1001eecf
xor eax, 0xfc9842c
or byte [ecx], 0x23
add byte [eax], al
test byte [ebx], ah
or eax, 0x575ffff
push eax
call fcn.100378f7
sub cx, 0
add esp, 8
push 8
jmp 0x1004a3ce
xchg dx, bx
xchg bx, dx
mov edi, dword [ebp + 8]
cmp eax, 0x10000
jle 0x10036e3c
mov ebx, ebx
jg 0x10036e37
pushfd
cpuid
ret
mov eax, 0xffff
lea edx, [ebp - 0x20]
push esi
jmp fcn.10036e42
invalid
hlt
add esp, 8
push 8
adc dh, 0x66
mov edx, dword [ebp + 8]
push 0x10078008
push edi
call fcn.1003b969
add esp, 0xc
test al, al
jb 0x100436a9
je 0x10041c69
jne 0x1004a3f4
cpuid
xchg ebx, eax
mov ecx, dword [esi]
push 0x14
xchg edi, esi
xchg esi, edi
push ecx
call fcn.100378f7
jno 0x10041c63
jo 0x1004a40f
nop
cpuid
ret 0x800f
jo 0x10041c63
add eax, 0xec895b9b
Function at 0x10011117
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
shl ebx, 0x20
mov ecx, dword [ebp + 0x10]
jmp 0x100464d2
invalid
add eax, ebp
js 0x1001ceca
mov cl, cl
jns 0x10016965
mov word [edi], es
cmp edi, dword [ebx]
xchg byte [edi], cl
mov dword [edi + 0x65], ebx
add byte [eax], al
jns 0x1001ceca
xor eax, 0xff595148
imul dword [eax + 0x58]
and al, 0x40
pushfd
jmp 0x10016977
push ebx
xchg di, bp
xchg bp, di
call dword [0x100806f8]
mov esi, eax
mov eax, dword [0x1008015c]
test eax, eax
jb 0x10016171
je 0x1001e106
jne 0x100169a0
or ecx, dword [edi]
mov byte [0x4f880fc3], al
ja 0x100169a5
js 0x1001e0f5
add byte [ecx + 3], bh
jns 0x100169ab
sbb al, 0xff
pop esp
jns 0x1001e0f5
fmul dword [edi]
xchg dx, cx
xchg cx, dx
shr ebx, 0x40
shl ax, 0x20
mov ebx, dword [esi + 4]
push 0x1001333c
ret
lea esi, [esi]
push 0x1003d18c
ret
jmp 0x1001e0f6
push edi
call fcn.10029f82
add esp, 4
xchg dh, cl
std
jmp dword [0xffff]
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
shl bh, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jb 0x10016954
jne 0x10046508
je 0x10046500
test byte [edi], 0xd9
jae 0x10046487
xchg dh, bh
xchg bh, dh
pop ebp
ret
inc byte [esi - 0x683ca209]
push ds
mov esi, esi
mov eax, dword [ebp + 0x10]
shr ch, 0x40
pop ebp
ret

Function at 0x100123a9
Capabilities:
Check for software breakpoints

Disassembly:
pop dword [esp - 4]
shl eax, cl
or ebx, eax
jb 0x100162a0
mov eax, dword [ebp + 0xc]
cmp edi, edi
add ebx, edx
dec eax
mov ebx, ebx
mov dword [edi], ebx
mov dword [ebp + 0xc], eax
jne 0x10020110
je 0x100123d3
mov al, ch
invalid
pop edi
pop esi
shl dx, 0x20
pop ebx
xchg dh, bh
xchg bh, dh
pop ebp
ret
add eax, 0x8c4815d
add byte [eax], al
add byte [ebp - 0x4d7df040], al
dec ebp
add eax, dword [eax]
Function at 0x1001915f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov al, byte [edi + esi]
cmp al, 0x61
jb 0x10036c32
shl dx, 0x20
jae 0x10019173
in eax, dx
clc
push 0x68
or dword [ebx + eax + 0x10], ebp
push 0x10036c09
ret

Function at 0x1001b0a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
mov edx, edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jb 0x1001dcd3
jne 0x1001b0db
je 0x1001b0d7
cpuid
add bl, 0x5d
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop ebp
jne 0x1001a5b7
je 0x1001b0ea
arpl word [esp + eax - 0xb387bf1], bx
invalid
je 0x1001a5b7
Function at 0x1001c632
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
jno 0x10027c59
jo 0x1001c62a
loope 0x1001c5fa
lodsb al, byte [esi]
outsd dx, dword [esi]
fmul qword [edi]
sub byte [ecx], 0xb6
add byte [eax], al
jo 0x10027c59
fsub dword [eax]
add eax, edx
sar eax, 3
test eax, eax
jb 0x10035367
mov dword [ebp - 0x10], eax
jle fcn.10019af5
jg 0x1001c64d
cmp dh, byte [ebp + 0x44]
add edi, 0x14
pop dword [edi]
call 0x100345bd
sal dword [esi + 0x210f810f], 0xff
push dword [eax + 3]

Function at 0x1001dcb1
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
or esp, esp
jno 0x1001dcbf
push 0x11f65b62
invalid
jno 0x10021e47
sbb dl, 0x66
mov ebp, ebp
mov cl, bl
rcr byte [edi], cl
call fcn.1002577c
xor al, 0x1f
or al, 0x47
add dword [eax], edx
add byte [ecx], al
cmp byte [eax], 0
add byte [eax], al
add byte [ecx], al
add byte [eax], al
clc
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
inc ecx
add byte [eax], al
cmp al, 0
add byte [eax], al
cli
test eax, 0xb8841002
add dword [eax], edx
invalid

Function at 0x1001ea2a
Capabilities:
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jno 0x1003075d
jo 0x1001ea38
invalid
jo 0x1003075d
xor byte [edx + 0xf], 0xb7
pop es
add ebx, eax
jmp loc.1003d8c9
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
shl eax, 0x20
Function at 0x100297d2
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dh, dh
lea edx, [ebp - 4]
lea esi, [esi]
ja 0x100154b8
jbe 0x1000faa1
push edi
jbe 0x100154b6
jbe 0x100154b8
add byte [eax], al
fstpnce st(3), st(0)
push esi
push edx
mov ebx, ebx
lea eax, [ebp - 0x910]
push 0x400
ja 0x100466b3
jbe 0x100154d5
xor al, 0xea
invalid
jbe 0x100466b3
fldcw word [edi]
pop dword [esp - 4]
shr si, 0x40
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
shr al, 0x40
jmp 0x1001d24d
stc
call fcn.1002ac48
mov al, byte [ebp + 0xb]
add esp, 0x3c
stc
jno 0x1001b167
shl di, 0x20
jo 0x1001d26d
dec ebp
std
inc eax
std
test al, 0xf
xor ah, 0xde
invalid
jo 0x1001b167
fcmovbe st(0), st(0)
lea edx, [edx]
mov eax, dword [ebp + 0x4c]
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [eax + edx]
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
jmp dword [esi]
add eax, 0x870f4921
jo 0x1002981b
invalid
add byte [eax], al
push eax
call fcn.10056440
and ecx, ecx
add esp, 0x14
test ax, ax
jb 0x100297d0
je 0x1000fa90
shl ecx, 0x20
jne 0x100426e8
lodsd eax, dword [esi]
lea edx, [di - 0x510]
invalid
lea edx, [ebp - 0x510]
cmp edi, edx
je 0x10042706
jne 0x100426fa
mov esp, 0xe8e8574e
mov byte [eax], al
add byte [ecx + 0x4c4], al
add byte [ebx - 0xf00f7bb], cl
push edi
call fcn.1004afe8
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.1004afe8
shl bp, 0x20
mov ecx, dword [esi]
push 0x15
push ecx
lea edi, [edi]
call fcn.1002c149
add esp, 0xc
mov bh, bh
pop edi
pop esi
mov si, si
pop ebx
mov esp, ebp
jmp fcn.1000fa8c
push eax
push ebx
mov eax, eax

Function at 0x10029a69
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov bh, bh
mov word [esi + 0xbc], di

Function at 0x10029ac8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
mov ebp, ebp
shl eax, cl
ja 0x1003bcc2
jbe 0x10029adc
sti
jge 0x10029b56
cmp dword [edi], ecx
xchg al, ah
and dword [ecx], eax
add byte [edx + 0x40ecc052], al
jbe 0x1003bcc2
adc byte [edx - 0x40], 0xec
inc eax
jmp dword [esi - 4]
test edi, 0xa3e2ab1b
Function at 0x100316c9
Capabilities:
Encode data using xor

Disassembly:
jmp dword [esi]
invalid
xor eax, 0x315e5f66
ror byte [edi], 0x82
adc dword [ebx], edi
add al, byte [eax]
pop ebx
pop ebp
ret
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
jno 0x1004fd03
shl ebx, 0x20
jo 0x1002cdd7
fnstenv [ecx - 0x68]
mov bl, 0xf
and byte [esi], 0x2f
add al, byte [eax]
jo 0x1004fd03
xor al, 0x4c
mov ebx, dword [ebp + 0x4c]
js 0x1002d6b7
jns 0x1002cdee
xor ebp, dword [ecx + 2]
bnd jns 0x1002d6b7
jns 0x1002d6b7
fldlg2
ret
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
shl cx, 0x20
lea esi, [esi + 0xc]
xor byte [ebx + edx], al
jb 0x1002ae6e
jmp 0x100194ca
mov eax, dword [esi + 4]
lea esp, [esp + 4]
ja 0x1002cddf
or al, 0xb7
invalid
jbe 0x100316d7
jno 0x1003165c
jbe 0x1002cddf
xor eax, 0x33a80ed
adc byte [edi + eax*2], cl
add dword [eax], edx
add byte [ecx], ah
add byte [eax], 0
inc eax
add byte [eax], al
add byte [eax], al
and dword [eax], eax
add byte [eax + eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add cl, bl
imul eax, dword [ebx], 0x311c810
adc dh, bl
dec edx
add dl, byte [eax]
jb 0x100316eb
add dl, byte [eax]
cmp dword es:[ebx], eax
adc byte [esi + ecx - 0x5886efff], cl
add al, 0x10
pop ss
add edx, dword [eax]
xchg ebp, eax
pop edx
scasb al, byte es:[edi]
jns 0x100316cf
add al, 0x10
mov word [esi], cs
add dword [eax], edx
and eax, 0xbb86c679
add byte [eax], al
add byte [eax], al
shr ax, 0x40
mov word [esi + 0xbc], dx
mov ax, ax
mov esi, esi
call fcn.1002111e
mov al, byte [ebp + 0xb]
push esi
mov byte [esi + 0xba], bl
jne 0x10048140
je 0x10031761
lahf
pop esp
mov edi, 0x69d9840f
add dword [eax], eax
je 0x10048140
xor al, 0xef
call fcn.1002daf9
shl ebp, 0x20
shl bp, 0x20
mov al, byte [ebp + 0xb]
mov eax, eax
push esi
mov cl, cl
mov byte [esi + 0xba], bl
mov ch, ch
shl ah, 0x20
xchg di, ax
xchg di, ax
mov byte [esi + 0xbb], al
push 0x10025e1a
ret
mov byte [esi + 0xbb], al
lea ecx, [ecx]
mov word [esi + 0xbc], di
mov bp, bp
shl eax, 0x20
call fcn.1003eefd
xchg cl, bl
xchg bl, cl
mov cl, byte [ebp + 0xc]
mov di, di
shl ecx, 0x20
mov cx, cx
xchg al, bl
xchg bl, al
mov dx, word [ebp + 0x10]
cmc
add esp, 0x40
mov bp, bp
mov byte [esi + 0xba], cl
jne 0x1002cdb9
je 0x10036809
cmp byte [ebp - 0x557bf053], dh
invalid
je 0x1002cdb9
fst dword [esi]
ja 0x100367bc
jbe 0x1004814c
nop
cpuid
ret
jbe 0x100367bc
fdivr dword [edx - 0x17]
add al, 0
add byte [eax], al
sbb byte [edx], cl
add al, 0x30
and cl, 0xf
jb 0x1001ca87
lea edi, [edi]
mov byte [edx - 1], al
add bx, 0
cmp cl, 9
jbe 0x1004818b
ja 0x1004817e
test ch, 0x4f
add cl, 0x37
mov di, di
jmp 0x1004818e
add cl, 0x30
mov byte [edx], cl
inc esi
add edx, 2
stc
jb 0x1004819e
cpuid
nop
ret
jb 0x1003ed12
and eax, 0xf87d8bfe
push eax
push esi
xchg bp, bx
xchg bx, bp
call fcn.10012fb7
shl ebx, 0x20
mov al, byte [ebp + 0xb]
jmp 0x1003d360
Function at 0x100333bd
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub byte [edi - 0x18], 0x95
or eax, 0xd382ffff
lea esi, [esi + 0xc]
cmp esi, esi
add byte [ebp + ebx], al
jmp dword [esi]
push ecx
jmp 0x100333b4
push eax
call fcn.10028c2d
xor eax, 0x34ea80d4
xor cl, dl
jb 0x10032259
add cl, 0x58
mov byte [ebp + esi - 0x10], cl
inc esi
cmp esi, 8
jl 0x1001b75f
jge 0x100333e2
cpuid
ret
jmp fcn.1003eb6e
mov ax, word [ebp + 0x10]
call fcn.1000f13d
fsubr dword [ebp + 4]
loopne 0x10047035
inc esi
sar ebp, 1
push dword [esi + 5]

Function at 0x100339f9
Capabilities:
Query environment variable

Disassembly:
add esp, 4
test eax, eax
jb 0x10047a72
jne 0x10033a1a
je 0x10033a12
cwde
mov cl, 0x6f
mov eax, dword [0x1007ff64]
ret
shl dh, 0x20
push 0x58
push 0x1007ff0c
push 0x1008014c
mov dword [0x10080158], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jb 0x10047a7a
mov bx, bx
mov dword [0x1007ff64], eax
je 0x10027ab5
jne 0x10033a55
and eax, 0x521c85cf
push edx
pop edx
mov eax, 0x1007ff0c
js 0x10027aaa
jns 0x10033a69
adc byte [edx + 0xfcc2e3a], al
mov dword [ebx], edi
inc eax
invalid
jns 0x10027aaa
and eax, 0x4768ded
cli
mov bp, bp
jmp dword [esi]
mov ah, 0x35
push 0x10010de5
ret
adc byte [ebx + 0x5b], 0x2a
add dl, byte [eax]
dec esp
add byte [eax], al
add byte [ebp + 0x4810014d], cl
add byte [eax], al
add byte [eax + eax], cl
add byte [edi - 0x2e], dh
add dword [eax], edx
or al, 0
add byte [eax], al
cmp al, 0
add byte [eax], al
pop ebx
sub al, byte [edx]
adc byte [eax + eax], cl
add byte [ebp + 0x4c100427], dl
add byte [eax], al
add byte [edi + eax*2], cl
add dword [eax], edx
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [edx], bh
adc al, byte [eax]
add byte [eax], al
inc edx
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
adc byte [ebp - 0x7d9feffc], ah
add dl, byte [eax]
add dword [eax], eax
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
wait
sub eax, dword [eax + edx]
jmp 0x10047b5d
inc ebp
add byte [eax], al
add byte [ecx], bh
add byte [eax], al
add ch, dh
add dword [eax], edx
cmp dword [eax], eax
add byte [eax], al
inc ebp
add byte [eax], al
add byte [edi + eax*2], cl
add dword [eax], edx
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [ecx], al
popal
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
push cs
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
invalid
Function at 0x10042dc7
Capabilities:
Check for software breakpoints

Disassembly:
jmp dword [esi]
invalid
jae 0x10020de9
mov eax, eax
jb 0x10020de1
pop edx
mov ax, 0x18
push esi
mov esi, dword [ebp + 0x10]
mov ah, ah
push 0xa
push 0
push esi
call fcn.1001c238
mov eax, dword [ebp + 0x18]
add esp, 0xc
test eax, eax
jb 0x1003ebf4
je 0x10020e1d
jne 0x10020e15
inc ecx
mov edx, 0x20e3c0b0
shl bl, 0x20
mov word [eax], 0xa
jno 0x10034566
shl bl, 0x20
jo 0x10020e2d
retf
jo 0x10034566
and byte [ebx + ecx*4], 0x55
adc byte [edx - 0x78], dl
in al, 0x6a
add cl, ch
push cs
outsd dx, dword [esi]
add dword [eax], eax
xor eax, 0xffff250b
add byte [eax], al
jb 0x10019bf9
jmp fcn.1003f784
mov word [esi], dx
mov dword [esi + 6], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [esi + 2], ecx
mov dx, word [eax + 4]
jno 0x10030716
jo 0x1003457c
or dword [eax + 0xf], edx
adc byte [ecx + eax*8 + 0x4c35ffff], 0x95
xchg ebp, eax
shl bh, 0x20
jo 0x10030716
xor eax, 0xc095954c
out 0x20, eax
jno 0x10026a5a
jo 0x10034593
jo 0x10026a5a
cmc
xchg di, dx
xchg dx, di
mov cl, byte [ebp + 0x3c]
mov ebx, dword [esi + 4]
mov ax, ax
lea esi, [esi + 8]
rol byte [ebx], cl
js 0x1000ef71
jns 0x1003ec18
xor ah, byte [ecx + 0x509e46b9]
jns 0x1000ef71
shl dx, 0x20
push ebp
push eax
pop eax
ja 0x1004e642
jbe 0x10042ddc
aad 0xab
sbb edx, dword [ecx + 0x58]
jbe 0x1004e642
xor al, 0xd7
mov eax, dword [esi]
push ebx
mov dh, dh
push eax
call fcn.1002c149
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, esp
cmc
cmp word [ebp + 0x14], 0xa
xchg cl, ch
xchg ch, cl
ja 0x10020dd4
jbe 0x1004e659
and al, 0xa2
jbe 0x10020dd4
fdiv st(2)

Function at 0x10043d26
Capabilities:
Authenticate hmac
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x1001e85e
ret
pop edi
pop esi
inc eax
pop ebx
pop ebp
mov edx, edx
ret
push esi
shl eax, 0x20
call fcn.1001b52b
fcomp st(3)
add esp, 4
add ah, 0xc5
cmp esi, esi
test ebp, 0x9dbb016b
sub ah, 0xc5
cmp eax, 8
shl ecx, 0x20
mov al, al
jno 0x1001e433
jo 0x10043d4f
invalid
jo 0x1001e433
add eax, 0xff006ae0
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameA
test eax, eax
jb 0x1003fa53
jne 0x10043d7d
mov edx, edx
je 0x10043d76
test byte [ebx + ebp*2 - 0x54], dh
xlatb
pop edi
pop esi
pop ebx
pop ebp
ret
mov cl, byte [eax + esi]
cmp cl, 0x5c
je 0x10027af0
mov ah, ah
jne 0x10043d8f
inc eax
cdq
cmp cl, 0x3a
call fcn.100282a7
xor al, 0xa4
call fcn.1002e634
shl ebx, 0x20
shl bx, 0x20
mov cl, byte [ebp + 0xc]
mov dx, word [ebp + 0x10]
push eax
lea esi, [esi]
ja 0x10033078
shr bp, 0x40
lea ecx, [ecx]
jbe 0x10043dc1
aad 0x9c
les ecx, [edi]
xchg byte [ecx + 0x35fffef2], dh
inc eax
jmp fcn.100304ed
jbe 0x10033078
xor eax, 0xc71fe940
invalid
Function at 0x1004cf02
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.10019cf4
and eax, 0x114c377
adc byte [eax], bh
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add al, cl
adc dword [ebx], eax
adc byte [ebx - 0x1f], al
add dl, byte [eax]
cmc
add dword [eax], edx
cmp eax, 0x39000000
add byte [eax], al
add ch, dh
add dword [eax], edx
cmp dword [eax], eax
add byte [eax], al
cmp eax, 0xc000000
inc edi
add dword [eax], edx
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [edx], bl
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
invalid
inc ebx
add eax, 0x10
call fcn.10021310
sub byte [ecx + 0x11e981], 0
add byte [esi - 9], ah
ret 0xd6f6
push eax
jmp 0x1004cecf
push esi
xchg cl, dl
xchg dl, cl
shr al, 0x40
mov al, al
shr si, 0x40
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x10028aaf
shl si, 0x20
je 0x1004cefa
enter 0xfffffffffffffd03, 0xf
test byte [edi - 0x27000245], ch
pop ecx
mov ebx, dword [ecx]
shr edx, 0x10
mov word [esi + ebx*4 + 2], dx
xchg di, ax
xchg di, ax
mov ebx, dword [ecx]
js 0x10046bf8
je 0x10028aaf
fcomp dword [ecx - 0x75]
sbb ecx, eax
ljmp 0x29e
shr dh, 0x40
jns 0x1004cf20
adc dword es:[eax + 0xf], ebp
mov edx, edx
pushfd
invalid
jns 0x10046bf8
cmp byte [eax], 0x8f
inc esp
and al, 0xfc

Function at 0x1004d8e4
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
pop edi
ja 0x1001a3de
xchg dx, bp
shl si, 0x20
xchg bp, dx
jbe 0x1004d900
cdq
mov eax, 0xfe94f7d
xchg al, bl
retf 0xfffc
jbe 0x1001a3de
mov al, byte [ebp - 0x24]
push 0x1c
lea ecx, [ebp - 0xb0]
push 0
push ecx
mov byte [ebp - 0x15], al
mov bp, bp
call fcn.1001c238
jno 0x1001d5c9
jo 0x1004d929
pop ecx
cmp cl, byte [edi]
sbb byte [edx - 0x26000304], 0x6f
mov eax, dword [ebp - 8]
jo 0x1001d5c9
fldcw word [edi - 0x75]
inc ebp
clc
push ebx
pop ebx
mov ecx, dword [ebp - 4]
mov dword [esi - 8], eax
shl edi, 0x20
mov dword [esi - 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
jmp fcn.10028835